You can't always get what you want: towards user-controlled privacy on Android

Abstract

Mobile applications (hereafter, apps) collect a plethora of information regarding the user behavior and his device through third-party analytics libraries. However, the collection and usage of such data raised several privacy concerns, mainly because the end-user -i.e., the actual owner of the data -is out of the loop in this collection process. Also, the existing privacy-enhanced solutions that emerged in the last years follow an "all or nothing" approach, leaving the user the sole option to accept or completely deny the access to privacy-related data. This work has the two-fold objective of assessing the privacy implications on the usage of analytics libraries in mobile apps and proposing a data anonymization methodology that enables a trade-off between the utility and privacy of the collected data and gives the user complete control over the sharing process. To achieve that, we present an empirical privacy assessment on the analytics libraries contained in the 4500 most-used Android apps of the Google Play Store between November 2020 and January 2021. Then, we propose an empowered anonymization methodology, based on MobHide [1], that gives the end-user complete control over the collection and anonymization process. Finally, we empirically demonstrate the applicability and effectiveness of such anonymization methodology thanks to HideDroid, a fully-fledged anonymization app for the Android ecosystem.

Intent-aware Permission Architecture: A Model for Rethinking Informed Consent for Android Apps

“…Several studies have explored the introduction of fine controls over permissions at the framework, the middle layer, or the operating system-level using different strategies (Beresford et al, 2011;Zhou et al, 2011;Brutschy et al, 2015;Nauman et al, 2010;Jeon et al, 2012;Liu et al, 2016b;Caputo et al, 2021). Proposed techniques such as Mockdroid (Beresford et al, 2011), and TISSA (Zhou et al, 2011) facilitate users to control access whenever access to the resource is attempted by providing dummy information instead of the real one.…”

“…FlaskDroid (Bugiel et al, 2013) on the other hand, provides compulsory access control on Android's middleware and kernel layers to avert unwanted information disclosure. Some recent solutions, such as (Caputo et al, 2021) focused on anonymization of data to preserve the privacy of the user. In (Qu et al, 2020), authors introduce an automatic permission management model, which collectively considers the risk of the permission, functionalities of the app, and user's privacy requirement.…”