Should I Protect You? Understanding Developers' Behavior to Privacy-Preserving APIs

Abstract

There have been many proposals and developments to improve smartphone users' location privacy with respect to mobile applications. These include user-centric application permission models and disclosures. However, little attention has been paid to how application developers could build privacypreserving apps. In this paper, we present a laboratory study (N=25) to understand developers' behavior to enhanced APIs, which are a privacy-preserving modification of the existing Android Location API. In contrast to the existing methods, the studied API facilitates acquiring coarse location information without accessing the geocoordinates. Our results indicate that by offering a redesigned API, programmers can be nudged into making choices with their programming that help to preserve privacy of their users. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

A Survey on Developer-Centred Security

“…In our sample, 34 papers include quotes from participants. For example, Jain and Lindqvist incorporate relevant quotes in the text which fosters the results validity and also work as examples of how authors interpret the interviews [66].…”

“…The features provided by readily available APIs can also impact security and privacy choices of developers. In a case of geo-location libraries, developers who have access to a library with privacy-preserving options are more willing to use coarse location information over those with only access to the standard library [66].…”

A Large Scale Investigation of Obfuscation Use in Google Play

“…Balebako et al performed interviews and online surveys to investigate how app developers make decisions about privacy and security, identifying several hurdles and suggesting improvements that would help user-privacy [3,4]. Jain et al suggested design changes to the Android Location API based on the results of a developer lab study [32]. Fahl et al and Oltrogge et al conducted developer surveys and interviews, revealing deficits in the handling of TLS/SSL and suggesting several improvements [20,21,41].…”

No time at all

“…Obvious further work would be to understand if the shortened Request permission, in addition to being cost-effective, is effective in informing app consumers and helps them to make appropriate decisions. In our previous work, we have also explored alternative approaches to mobile app security & privacy, including explicitly showing users when their location is requested [11], showing network accesses of apps with Securacy [10], automated app analysis [2], crowdsourced privacy mental models [17] and privacy-preserving API design [13].…”