IT lexicon › Security › Alma Whitten

Alma Whitten

Security På svenska → Updated: 2026-10-15

The researcher whose 1999 study Why Johnny Can't Encrypt showed that ordinary people could not encrypt email with PGP.

Whitten and J. D. Tygar at Carnegie Mellon asked twelve participants to sign and encrypt a message with PGP 5.0, which was being sold as easy to use. Given ninety minutes, most failed, and several accidentally sent the secret in the clear. The trouble wasn't the buttons but the concepts: public and private keys, trust and signatures are not things anyone grasps intuitively.

Presented at USENIX Security 1999, the paper is generally seen as the founding text of usable security. Its conclusion — security that requires users to understand cryptography will not get used — has been confirmed by nearly every email encryption project since. Whitten later led privacy work at Google.

← Back to the lexicon