The impact of social navigation on privacy policy configuration

Besmer, Andrew; Watson, Jason; Lipford, Heather Richter

doi:10.1145/1837110.1837120

Cited by 46 publications

(33 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This would limit the impact of negative externalities even though the problem is not tackled at its very source. Empirical results from a pilot lab experiment on personal data disclosure decisions suggest that social navigation may influence behavior if the visual cues to signal the norms are strong enough [10]. However, this study is inconclusive about the overall decision efficiency because the decision effort, measured in time to completion, increased with the strong cue, and the quality of the cue was not endogenized in this setup.…”

mentioning

confidence: 65%

See 1 more Smart Citation

The security cost of cheap user interaction

Böhme

Großklags

2011

Proceedings of the 2011 New Security Paradigms Workshop

View full text Add to dashboard Cite

Human attention is a scarce resource, and lack thereof can cause severe security breaches. As most security techniques rely on considerate human intervention in one way or another, this resource should be consumed economically. In this context, we postulate the view that every false alarm or unnecessary user interaction imposes a negative externality on all other potential consumers of this chunk of attention. The paper identifies incentive problems that stimulate overconsumption of human attention in security applications. It further outlines a lump-of-attention model, devised against the backdrop of established theories in the behavioral sciences, and discusses incentive mechanisms to fix the misallocation problem in security notification, for instance the idea of a Pigovian tax on attention consumption.

show abstract

mentioning

confidence: 65%

“…Another way to frame this idea is the adaptation of the social navigation paradigm [55] to guide user decisions on security [34] and privacy [10] options. Social navigation refers to the principle of communicating (aggregate) behavior of other users in order to facilitate choice in otherwise unmanageably large decision spaces.…”

mentioning

confidence: 99%

The security cost of cheap user interaction

Böhme

Großklags

2011

Proceedings of the 2011 New Security Paradigms Workshop

View full text Add to dashboard Cite

show abstract

“…Besmer et al [8] have explored the use of social navigation cues (e.g., the percentage of users who have allowed/denied a particular permission) in helping the users make better permission authorization decisions when installing Facebook applications. They find that social cues have barely any effect on users' Facebook privacy settings.…”

Section: Application Risk Signal Communicationmentioning

confidence: 99%

Look before you Authorize: Using Eye-Tracking to Enforce User Attention towards Application Permissions

Javed

Shehab

2017

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Abstract:Habituation is a key factor behind the lack of attention towards permission authorization dialogs during third party application installation. Various solutions have been proposed to combat the problem of achieving attention switch towards permissions. However, users continue to ignore these dialogs, and authorize dangerous permissions, which leads to security and privacy breaches. We leverage eye-tracking to approach this problem, and propose a mechanism for enforcing user attention towards application permissions before users are able to authorize them. We deactivate the dialog's decision buttons initially, and use feedback from the eye-tracker to ensure that the user has looked at the permissions. After determining user attention, the buttons are activated. We implemented a prototype of our approach as a Chrome browser extension, and conducted a user study on Facebook's application authorization dialogs. Using participants' permission identification, eye-gaze fixations, and authorization decisions, we evaluate participants' attention towards permissions. The participants who used our approach on authorization dialogs were able to identify the permissions better, compared to the rest of the participants, even after the habituation period. Their average number of eye-gaze fixations on the permission text was significantly higher than the other group participants. However, examining the rate in which participants denied a dangerous and unnecessary permission, the hypothesized increase from the control group to the treatment group was not statistically significant.

show abstract

“…An individual can use information regarding aggregate community choices as guidance for making decisions. Such "social navigation" [38] approaches have been applied to inform decisions about cookie management [39], firewall rules [40], phishing sites [41], information access policies for Facebook applications [42], and privacy preference settings in Instant Messengers [43].…”

Section: Peer Based Approaches In Technical Implementationmentioning

confidence: 99%

Peer-produced privacy protection

Garg

Patil

Kapadia

et al. 2013

2013 IEEE International Symposium on Technology and Society (ISTAS): Social Implications of Wearable Computing and Augmediated

View full text Add to dashboard Cite

Privacy risks have been addressed through technical solutions such as Privacy-Enhancing Technologies (PETs) as well as regulatory measures including Do Not Track. These approaches are inherently limited as they are grounded in the paradigm of a rational end user who can determine, articulate, and manage consistent privacy preferences. This assumes that self-serving efforts to enact privacy preferences lead to socially optimal outcomes with regard to information sharing. We argue that this assumption typically does not hold true. Consequently, solutions to specific risks are developed -even mandated -without effective reduction in the overall harm of privacy breaches. We present a systematic framework to examine these limitations of current technical and policy solutions. To address the shortcomings of existing privacy solutions, we argue for considering information sharing to be transactions within a community. Outcomes of privacy management can be improved at a lower overall cost if peers, as a community, are empowered by appropriate technical and policy mechanisms. Designing for a community requires encouraging dialogue, enabling transparency, and supporting enforcement of community norms. We describe how peer production of privacy is possible through PETs that are grounded in the notion of information as a common-pool resource subject to community governance.

show abstract

The impact of social navigation on privacy policy configuration

Cited by 46 publications

References 20 publications

The security cost of cheap user interaction

The security cost of cheap user interaction

Look before you Authorize: Using Eye-Tracking to Enforce User Attention towards Application Permissions

Peer-produced privacy protection

Contact Info

Product

Resources

About