Using personal examples to improve risk communication for security & privacy decisions

Abstract

IT security systems often attempt to support users in taking a decision by communicating associated risks. However, a lack of efficacy as well as problems with habituation in such systems are well known issues. In this paper, we propose to leverage the rich set of personal data available on smartphones to communicate risks using personalized examples. Examples of private information that may be at risk can draw the users' attention to relevant information for a decision and also improve their response. We present two experiments that validate this approach in the context of Android app permissions. Private information that becomes accessible given certain permissions is displayed when a user wants to install an app, demonstrating the consequences this installation might have. We find that participants made more privacy-conscious choices when deciding which apps to install. Additionally, our results show that our approach causes a negative affect in participants, which makes them pay more attention

The simpler, the better? Presenting the COPING Android permission-granting interface for better privacy-related decisions

“…From the answers the following type of statements were deduced: "95% of users were surprised this app sent their approximate location to mobile ad providers". The corresponding interface is displayed in Figure 6 (A)) Harbach et al [8] present the permissions together with personal information such as photos stored on the particular Smartphone or the owner's actual location (see Figure 6 (B)). The idea is to help people to imagine the consequences of requested permissions, rather than merely listing them.…”

“…whether they are risky and/or needed, and the interaction between different permissions. [7] (B) on the right an example of the 'Your location' permission as it was used by Harbach et al [8] Since the interface proposed by Lin et al [7] already listed all permissions, and accompanied this with an assessment thereof we based our own proposal on theirs. However, we included even more information about the permission-requesting behavior to enhance comprehensiveness.…”

“…The proposals by Lin et al [7] and Harbach et al [8], on the other hand, provide more comprehensive information than the legacy interface, as does the COPING proposed interface.…”

“…Many of these were proven superior to the legacy Android interface [5,6,7,8]. Since different study designs were used a comparison of all alternatives to each other is not possible.…”

Is It Harmful? Re-examining Privacy Concerns

“…Therefore, the information concern is related to the flow of data between the user and involved data processors. The online privacy research recognized various antecedents of privacy concerns such as trust, risk perception, previous privacy experience, privacy awareness, personality traits and demographic differences [31,46,8,52,21,26]. Some of this research investigated the influence of concerns on privacy behaviors but the results are inconsistent.…”