To Permit or Not to Permit, That is the Usability Question: Crowdsourcing Mobile Apps’ Privacy Permission Settings

Abstract

Abstract:Millions of apps available to smartphone owners request various permissions to resources on the devices including sensitive data such as location and contact information. Disabling permissions for sensitive resources could improve privacy but can also impact the usability of apps in ways users may not be able to predict. We study an efficient approach that ascertains the impact of disabling permissions on the usability of apps through large-scale, crowdsourced user testing with the ultimate goal of making recommendations to users about which permissions can be disabled for improved privacy without sacrificing usability. We replicate and significantly extend previous analysis that showed the promise of a crowdsourcing approach where crowd workers test and report back on various configurations of an app. Through a large, between-subjects user experiment, our work provides insight into the impact of removing permissions within and across different apps (our participants tested three apps: Facebook Messenger (N=218), Instagram (N=227), and Twitter (N=110)). We study the impact of removing various permissions within and across apps, and we discover that it is possible to increase user privacy by disabling app permissions while also maintaining app usability.

A Study on Testers’ Learning Curve in Crowdsourced Software Testing

“…Divide both sides of the equation by K (K>0), and the formula becomes: (9) Take the reciprocal of both sides: (10) Subtract 1 from both sides, and the formula becomes: (11) Take the reciprocal of both sides again, and the formula becomes: (12) In Equation ( 12), let , ,…”

Exposures Exposed: A Measurement and User Study to Assess Mobile Data Privacy in Context

“…Wang et al [44] studied user decisions when presented with permission settings that are separated between apps and ad libraries. More recently, Ismail et al [19] showed that it is possible to maintain app usability even when disallowing certain permissions. Chitkara et al proposed a retrofitted Android system, ProtectMyPrivacy [13], that allows users to make fewer privacy decisions by setting permissions based on third-party libraries instead of applications.…”

“…Permissions and how users interact with them have been extensively studied in [10,19,20,22,23,44]. Almuhimedi et al [10] studied how sending users privacy nudges affected their permission settings.…”

“…Our study was approved by the Institutional Review Board (IRB) of our Institution (details are omitted from this double-blind version). The workers were rewarded at a rate of $0.10 per minute of their time -a standard followed in other studies [19,22,24]. We allotted 30 minutes for the completion of our HIT, but the majority of workers completed it within 13 minutes approximately.…”

“…While these tools provide more fine-grained control over sensitive data (as opposed to just permissions), the way users engage with these privacy-preserving systems is less well studied. On the other hand, in the human-computer interaction (HCI) community, researchers have extensively studied how different designs for app permissions affect users' decisions on which apps to install and which permission requests are considered legitimate by users [10,19,20,22,44]. A detailed review of related work is provided in Section 2.…”