Understanding the Viability of Gmail's Origin Indicator for Identifying the Sender


Enze Liu, Lu Sun, and Alex Bellon, UC San Diego; Grant Ho, University of Chicago; Geoffrey M. Voelker, Stefan Savage, and Imani N. S. Munyaka, UC San Diego


The current design of email authentication mechanisms has made it challenging for email providers to establish the authenticity of email messages with complicated provenance, such as in the case of forwarding or third-party sending services, where the purported sender of an email is different from the actual originator. Email service providers such as Gmail have tried to address this issue by deploying sender identity indicators (SIIs), which seek to raise users' awareness about where a message originated and encourage safe behavior from users. However, the success of such indicators depends heavily on user interpretation and behavior, and there exists no work that empirically investigates these aspects. In this work, we conducted an interactive survey (n=180) that examined user comprehension of and behavior changes prompted by Gmail's passive SII, the 'via' indicator. Our quantitative analysis shows that although most participants (89%) noticed the indicator, it did not have a significant impact on whether users would adopt safe behaviors. Additionally, our qualitative analysis suggests that once prompted to consider why 'via' is presented, the domain name displayed after 'via' heavily influenced participants' interpretation of the message 'via' is communicating. Our work highlights the limitations of using passive indicators to assist users in making decisions about email messages with complicated provenance.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

@inproceedings {289490,
author = {Enze Liu and Lu Sun and Alex Bellon and Grant Ho and Geoffrey M. Voelker and Stefan Savage and Imani N. S. Munyaka},
title = {Understanding the Viability of Gmail{\textquoteright}s Origin Indicator for Identifying the Sender},
booktitle = {Nineteenth Symposium on Usable Privacy and Security (SOUPS 2023)},
year = {2023},
isbn = {978-1-939133-36-6},
address = {Anaheim, CA},
pages = {77--95},
url = {https://www.usenix.org/conference/soups2023/presentation/liu},
publisher = {USENIX Association},
month = aug

Presentation Video