HappyPermi

Abstract

Malicious Android applications can obtain user's private data and silently send it to a server. Android permissions are currently not sufficient enough to ensure the security of users' sensitive information. For a sufficient permission model it is important to account the target of the outgoing data flow. On the other hand, permission dialogues often contain relevant information, but most of the users generally do not understand the implications or the visualization fails to guide the user attention to it. It is important to empower users by providing applications that show them who can access their private data and who might send this data to the outside. In order to raise user awareness considering Android permissions, we developed HappyPermi, an application that visualizes which user information is accessible by the granted permissions. Our evaluation (n=20) shows that most users are not aware of the sensitive data that their installed applications have access to. Our results suggest how different users feel about accessing their sensitive data when they are aware of its outgoing destinations.