Asklemmy

I was on the IT staff at a small academic institution in the late '90s and tried to get administrative staff to use PGP — at least when they were discussing confidential student information that's covered by FERPA. The most popular mail client was Eudora for Classic MacOS, which did have a PGP plug-in. All you had to do was select a region of text and click a menu item to encrypt or decrypt it, provided that you had the keys in MacPGP for the email recipient.

But the background knowledge wasn't there. They didn't understand why it mattered. I could demonstrate how to encrypt or decrypt ... but there was no demo I could give them to show that if you encrypt, you are protecting your data from me (the email sysadmin) and from anyone else who gets root on the mail server.

Some members of the faculty and staff simply assumed that I could and would read anything they sent in email, and that anything I told them (like "use PGP") must be backdoored so I could keep doing so. (Sorry, folks, I have enough email of my own. You're not that interesting.)

Someone else at the same institution set up a math placement test for new students that used students' SSNs (!!!) as their passwords ... and took them from the financial database, and stored them in world-readable plaintext on the shared web server. My boss had words with them. I think it was decided that it was better to simply not have passwords for that test, and trust that the students will test themselves and sign up for the appropriate math course.