Mobile privacy leakage detection and prevention : from technical solutions to user experience.

Abstract

Mobile apps feed on variety of users’ information to provide great services. Some of the features require more sensitive details such as contact list to connect with friends or a precise location to find a desired restaurant nearby. Handling per- sonal information is vital because the user would expect them to be processed in an appropriate manner. However, research has proven that some third-party apps accidentally or maliciously leak users’ personal details. Thus, researchers made huge effort to come up with tools that detect leakage attempts. In this thesis, we targeted several gaps to improve user experience with mobile privacy leakage prob- lem. Initially, we designed a system that evaluates mobile privacy protection tools. This system can be useful for developers to assess their tools, and users to evaluate offered solutions. 165 selected Android privacy protection apps have been tested using our system, and it was established that the most effective approach of mobile privacy protection requires modification on mobile operating system level in order to capture explicit and implicit leakages. That requirement makes it difficult to find “off-the-shelve” protection tool. Therefore, it was decided to assist the user in selecting safe apps as a precaution step before problems occur. To achieve that, it is important to understand how mobile users form their decision when selecting apps. 1,100 crowdsourcing participants have been recruited to study their perceived trust of subjective and objective ratings of mobile apps’ privacy. This experiment guided us to design new interfaces that could assist decision making towards more privacy-friendly mobile apps, which was our most recent work. A newly designed interface, which communicates objective privacy ratings to the user, has been pro- posed. We have also conducted several user-studies involving 300 participants to evaluate our proposed app’s efficiency, the result ultimately showed that users were more motivated to engage in privacy-related decisions.