  While passwords, by definition, are meant to be secret, recent trends have
witnessed an increasing number of people sharing their email passwords with
friends, colleagues, and significant others. However, leading websites like
Google advise their users not to share their passwords with anyone, to avoid
security and privacy breaches. To understand users' general password sharing
behavior and practices, we conducted an online survey with 209 Indian
participants and found that 64.35% of the participants felt a need to share
their email passwords. Further, about 77% of the participants said that they
would want to use a system which could provide them access control features, to
maintain their privacy while sharing emails. To address the privacy concerns of
users who need to share emails, we propose ChaMAILeon, a system which enables
users to share their email passwords while maintaining their privacy.
ChaMAILeon allows users to create multiple passwords for their email account.
Each such password corresponds to a different set of access control rules, and
gives a different view of the same email account. We conducted a controlled
experiment with 30 participants to evaluate the usability of the system. Each
participant was required to perform 5 tasks. Each task corresponded to
different access control rules, which the participant was required to set, for
a dummy email account. We found that, with a reasonable number of multiple
attempts, all 30 participants were able to perform all 5 tasks given to them.
The system usability score was found out to be 75.42. Moreover, 56.6% of the
participants said that they would like to use ChaMAILeon frequently.
