Third-party Apps Research Articles

Our Data, Our Solutions: A Participatory Approach for Enhancing Privacy in Wearable Activity Tracker Third-Party Apps

Wearable activity trackers (WATs) have recently gained worldwide popularity, with over a billion devices collecting a range of personal data. To receive additional services, users commonly share this data with third-party applications (TPAs). However, this practice poses potential privacy risks. Privacy-enhancing technologies have been developed to address these concerns, but they often lack user-centered design, and therefore, are less likely to be directly related to users' concerns and to be widely adopted. This study takes a participatory design approach involving N=26 experienced WAT users who share data with TPAs. Through a series of design sessions, participants conceptualized 19 solutions, from which we identified seven different design features. We further analyze and discuss how these features can be combined to assist users in managing their data sharing with TPAs and, therefore, enhancing their privacy. Finally, we selected the three most promising features, namely partial sharing, reminder, and revocation assistance, and conducted an online survey with N=201 WAT users to better understand the potential effectiveness and usability of these features. This work makes an important contribution by offering user-centered solutions and valuable insights for integrating privacy-enhancing technologies into the WAT ecosystem.

A look at the possible impact of Apple's new policy on third-party apps and the data food chain of iOS users

The research presents and discusses that Apple's new policy of applying the privacy application framework "App Tracking Transparency" to Apple's IOS14 system has implications for third-party companies in the data food chain as well as users. Users has paid attention to private information including consumption habits, spending power, product preferences, price sensitivity. We found that Apple's new Privacy Application Framework gives Apple absolute dominance in the data food chain of smart media users, Apple and the Apple ecosystem, third-party application platforms, and downstream marketing companies that provide data mining analysis for third-party applications, changing the traditional equal relationship between third-party application platforms and their direct access to user data.

Gasoline Discount Programs in Lakewood, Colorado: A Cost-Saving Analysis

Using gas price data and discount or cashback offers collected in Q4 of 2022, we examined which among four programs: wholesale club membership; grocery store fuel points; gas station loyalty programs; and third-party mobile applications, would likely provide the most savings to alternative demographics proxied by faculty, staff and students on campus, as well as the average American consumer. Though what’s best ultimately depends on personal circumstances, the key result from this research was that for the average American consumer who buys about 45 gallons of regular gas per month, Costco gas is best only if we disregard and exclude the membership fee in the cost of gas. Otherwise, Costco gas is best for premium gas only, and cedes supremacy to the third-party app Upside for regular gas. Upside is best for midgrade gas too. However, grocery fuel points supersede both Costco and Upside if the consumer spends about $300 or more and redeems the points for discounts at the pump. Ultimately, the study shows that consumers in both the high-spending and low-spending demographic may need to reassess their circumstances and reconsider their options to avoid potentially losing about $124 and saving $126 on gas a year.

Integration of Oracle HCM with Third-Party Tools

A major step forward in the field of Human Resources (HR) technology is represented by the integration of Oracle Human Capital Management (HCM) with technologies developed by third parties. The integration of Oracle Human Capital Management (HCM) with a variety of third-party apps allows organisations to use a complete ecosystem that improves HR capabilities and overall organisational performance. This is particularly useful for organisations that are striving to achieve higher efficiency and simplify their procedures. Through this interface, Oracle Human Capital Management (HCM) is able to support the smooth interchange of data between itself and other systems, such as payroll, benefits administration, and recruiting platforms. This eliminates data silos and reduces the amount of human data input that is required. The enhancement of the correctness and consistency of the data is one of the most significant advantages brought about by this integration. The integration of Oracle Human Capital Management (HCM) with third-party technologies enables organisations to guarantee that employee data is consistently updated across all platforms, therefore reducing the likelihood of mistakes and conflicts. Real-time data synchronisation is also supported by this interface, which enables human resource professionals to have access to the most recent information in order to improve their decision-making abilities.

Investigating Documented Privacy Changes in Android OS

Android has empowered third-party apps to access data and services on mobile devices since its genesis.This involves a wide spectrum of user privacy-sensitive data, such as the device ID and location. In recent years, Android has taken proactive measures to adapt its access control policies for such data, in response to the increasingly strict privacy protection regulations around the world. When each new Android version is released, its privacy changes induced by the version evolution are transparently disclosed, and we refer to them as documented privacy changes (DPCs). Implementing DPCs in Android OS is a non-trivial task, due to not only the dispersed nature of those access control points within the OS, but also the challenges posed by backward compatibility. As a result, whether the actual access control enforcement in the OS implementations aligns with the disclosed DPCs becomes a critical concern. In this work, we conduct the first systematic study on the consistency between the operational behaviors of the OS at runtime and the officially disclosed DPCs. We propose DopCheck, an automatic DPC-driven testing framework equipped with a large language model (LLM) pipeline. It features a serial of analysis to extract the ontology from the privacy change documents written in natural language, and then harnesses the few-shot capability of LLMs to construct test cases for the detection of DPC-compliance issues in OS implementations. We apply DopCheck with the latest versions (10 to 13) of Android Open Source Project (AOSP). Our evaluation involving 79 privacy-sensitive APIs demonstrates that DopCheck can effectively recognize DPCs from Android documentation and generate rigorous test cases. Our study reveals that the status quo of the DPC-compliance issues is concerning, evidenced by 19 bugs identified by DopCheck. Notably, 12 of them are discovered in Android 13 and 6 in Android 10 for the first time, posing more than 35% Android users to the risk of privacy leakage. Our findings should raise an alert to Android users and app developers on the DPC compliance issues when using or developing an app, and would also underscore the necessity for Google to comprehensively validate the actual implementation against its privacy documentation prior to the OS release.

The Monetisation of Personal Data in EU Strategies: The Hoda/Google Case

In July 2022, the Competition and Market Authority opened, on Hoda s.r.l.’s recommendation, an investigation (Competition and Market Authority, 2022) against Google for its alleged abuse of its dominant position and for having hindered interoperability in sharing the data of its users with other operators. Hoda itself is a start-up, active in the intermediation of personal data through the Weople app; natural persons who register with the app delegate Hoda for the collection of their data held by other companies, which are then archived in a digital wallet. The aforementioned proceeding concluded with an undertaking, with communication dated 28th February 2023, by the Alphabet company, to develop new, automatic tools that allow network users to download and export their data from Google to a third-party app. The case leads one to reflect on the consequences and challenges that Europe is called upon to face in managing the phenomenon of the governance and the monetisation of personal data. The institution of data portability, to the extent that it facilitates the circulation of data and the mobility of users, offers alternative operators the possibility of exerting competitive pressure on tech giants such as Google, which assert their dominance on the creation of ecosystems based on the management of potentially unlimited quantities of data, functional to one’s business model. The topic arouses particular interest because if, on the one hand, it paves the way for the monetisation of personal data, on the other, it leads one to reflect, as highlighted in the past by the President of the Guarantor Authority for the protection of personal data, on the consequences in terms of a re-feudalisation of social relationships that the remuneration of consent to the treatment of one’s data would risk determining.

Defining Activity Thresholds Triggering a "Stand Hour" for Apple Watch Users: Cross-Sectional Study.

Sedentary behavior (SB) is one of the largest contributing factors increasing the risk of developing noncommunicable diseases, including cardiovascular disease and type 2 diabetes. Guidelines from the World Health Organization for physical activity suggest the substitution of SB with light physical activity. The Apple Watch contains a health metric known as the stand hour (SH). The SH is intended to record standing with movement for at least 1 minute per hour; however, the activity measured during the determination of the SH is unclear. In this cross-sectional study, we analyzed the algorithm used to determine time spent standing per hour. To do this, we investigated activity measurements also recorded on Apple Watches that influence the recording of an SH. We also aimed to estimate the values of any significant SH predictors in the recording of a SH. The cross-sectional study used anonymized data obtained in August 2022 from 20 healthy individuals gathered via convenience sampling. Apple Watch data were extracted from the Apple Health app through the use of a third-party app. Appropriate statistical models were fitted to analyze SH predictors. Our findings show that active energy (AE) and step count (SC) measurements influence the recording of an SH. Comparing when an SH is recorded with when an SH is not recorded, we found a significant difference in the mean and median AE and SC. Above a threshold of 97.5 steps or 100 kJ of energy, it became much more likely that an SH would be recorded when each predictor was analyzed as a separate entity. The findings of this study reveal the pivotal role of AE and SC measurements in the algorithm underlying the SH recording; however, our findings also suggest that a recording of an SH is influenced by more than one factor. Irrespective of the internal validity of the SH metric, it is representative of light physical activity and might, therefore, have use in encouraging individuals through various means, for example, notifications, to reduce their levels of SB.

Analysing and managing risk from third-party OAuth application access

Modern cloud application architectures allow users to dynamically grant third-party apps access to their cloud resources. When looking at a large, anonymised dataset of over 600,000 users and their approvals of over 43,000 applications, we found that organisations often are unaware of the magnitude of the access problems: on average, an organisation will grant 440 unique third-party apps access to Google data and resources; one organisation’s users approved 12,330 unique applications; out of all the approved applications, over 44 per cent have been granted access to either sensitive data or all data on the user’s Google Drive. The use of OAuth 2.0 has resulted in users creating numerous, unknown access paths from external third-party apps to organisations’ data and resources, in a way that is often hidden and unmanaged by organisations’ IT or security departments. In addition, the credentials granted to access users’ cloud data and resources often can be refreshed indefinitely. Security operations face challenges such as minimal to no tracking or management of these paths or credentials, along with immature or incomplete technical controls. This paper discusses an approach to understanding, assessing, analysing and managing third-party OAuth application risk, using anonymised real-world data as relevant examples, to provide prescriptive guidance on reducing risk associated with third-party applications.

Denial of interoperability and future first-party entry

Motivated by a recent antitrust case involving Google, we develop a rationale for foreclosure when the owner of an essential input is not yet integrated downstream. Our theory rests on data-enabled network effects across periods. If a platform considers offering a first-party app in the future, by not allowing a third-party app to be hosted on its platform, it ensures that the third-party app would be a weaker competitor to its own app in the future. This makes denial of access attractive as a full or partial foreclosure strategy, which is costly in the short term but may be beneficial in the long term. We also study the effects of policies such as compulsory access or data-sharing, showing under which conditions they might be beneficial to consumers or backfire.

Enhancing Student Experience through an Integrated Portal System

substantial shift towards digital content, prompting educational institutions to adapt to virtual learning environments. However, the increasing reliance on a multitude of applications for various activities, from attendance tracking to fee payment and examinations, has created a formidable challenge in aggregating data seamlessly. Students often grapple with login issues, exacerbated by the involvement of third-party applications, leading to time-consuming resolutions. Furthermore, the transition to online formats has posed challenges for extracurricular activities, particularly club promotions, leaving club leaders unsure of how to effectively engage participants in the absence of traditional class-by-class canvassing. Addressing these challenges, a proposed web portal emerges as a comprehensive solution, consolidating diverse institutional activities into a centralized hub. This portal not only streamlines academic functions such as attendance tracking and examination results but also acts as an information nexus for club activities, offering a centralized platform for students to discover and engage with various clubs. Additionally, the portal incorporates a digital grievance redressal system, providing students with a unified avenue to express concerns. In essence, this web portal aims to simplify and enhance the college experience, offering students a cohesive platform to navigate the complexities of their educational journey efficiently. KeyWords: Centralised, Web Application, Student Centric,Thirdparty Apps,Data Aggreagation, Career Guidance, Grievance Redressal, Virtual Learning

A Scalable Malware Detection Approach through Significant Permission Identification for Android Devices

The global ubiquity of smartphones has led to the availability of many free apps for gaming, communication, financial, and educational needs. However, hazardous malicious software targeting smartphones has increased as the global adoption of these devices has grown. Malware is growing rapidly, with reports predicting a new Android app every 10 seconds, threatening the mobile ecosystem. Due to Android's versatility, users can install apps from third-party app shops and file-sharing websites, compounding malware outbreaks. The seriousness of this situation requires scalable malware detection. Based on permission usage analysis, this project introduces Significant Permission Identification (SigPID), a novel malware detection technique. SigPID uses a three-tiered permission pruning mechanism to discover the most important permissions for distinguishing benign from malicious apps, unlike standard methods that scan all Android permissions. The system first uses the Random Forest method for machine learning classifications. The study reduces non-sensitive permissions by identifying benign and harmful permission lists. Support Vector Machine classification, K-Nearest Neighbor, and Linear Regression are then used to a fresh dataset. SigPID, written in Python 3.7, is a powerful and scalable Android malware countermeasure. SigPID uses advanced machine learning and large permissions to protect the mobile ecosystem from harmful apps, making it safer and more secure.

FLSys: Toward an Open Ecosystem for Federated Learning Mobile Apps

This article presents the design, implementation, and evaluation of <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">FLSys</b> , a mobile-cloud federated learning (FL) system, which can be a key component for an open ecosystem of FL models and apps. FLSys is designed to work on smart phones with mobile sensing data. It balances model performance with resource consumption, tolerates communication failures, and achieves scalability. In FLSys, different DL models with different FL aggregation methods can be trained and accessed concurrently by different apps. Furthermore, FLSys provides advanced privacy preserving mechanisms and a common API for third-party app developers to access FL models. FLSys adopts a modular design and is implemented in Android and AWS cloud. We co-designed FLSys with a human activity recognition (HAR) model. HAR sensing data was collected in the wild from 100+ college students during a 4-month period. We implemented HAR-Wild, a CNN model tailored to mobile devices, with a data augmentation mechanism to mitigate the problem of non-Independent and Identically Distributed data. A sentiment analysis model is also used to demonstrate that FLSys effectively supports concurrent models. This article reports our experience and lessons learned from conducting extensive experiments using simulations, Android/Linux emulations, and Android phones that demonstrate FLSys achieves good model utility and practical system performance.

Patient Usage of Apps to Access Online Medical Records

This cross-sectional study analyzes the use of patient portal apps and third-party apps for managing multiple patient portals between 2019 and 2022.

Best Practices for Integrating OAuth in Mobile Applications for Secure Authentication

For safe authentication in mobile apps, OAuth is becoming the de facto standard. Strong and reliable authentication methods are more important than ever before due to the meteoric surge in mobile app use. This need is satisfied by OAuth, which allows for protected resource access while protecting user credentials from prying eyes in third-party apps. In order to guarantee security and a smooth user experience, this abstract details best practices for incorporating OAuth into mobile applications, with an emphasis on critical concerns and tactics. An overview of OAuth's fundamental concepts, such as its authorisation processes, token management, and scope definitions, is provided at the outset of the talk. Use cases include mobile apps that make use of the Authorisation Code Flow with Proof Key for Code Exchange (PKCE) highlight the need of selecting the appropriate OAuth flow. Here is some practical advice on how to put these ideas into practice: make sure the OAuth client is securely registered with the authorisation server, use the device's secure storage facilities to store tokens, and use the right techniques for token expiry and renewal.

Measuring tree diameter using a LiDAR-equipped smartphone: a comparison of smartphone- and caliper-based DBH

Tree diameter measurement is one of the most important stages of forest inventories to assess growing stock, aboveground biomass, and landscape restoration options, among others. This study investigates the accuracy of measuring tree diameters using a Light Detection and Ranging (LiDAR)-equipped smartphone vs. a normal caliper (reference data) and the opportunity to use low-cost smartphone-based applications in forest inventories. To estimate the diameter at breast height (DBH) of single trees, we used a smartphone with a third-party app that automatically analyzed three-dimensional (3D) point clouds. For two different measurement techniques, we compared the two measurement techniques based on DBH data from 55 Calabrian pine (Pinus brutia Ten.) and 50 oriental plane (Platanus orientalis L.) trees using the paired-sample t-test and Wilcoxon signed-rank test. Mean absolute error (MAE), mean squared error (MSE), root mean square error (RMSE), percent bias (PBIAS), and coefficient of determination (R2) were used as precision and error statistics. Statistical differences were observed between the reference and smartphone-based DBH according to the paired-sample t-test and Wilcoxon signed-rank test. The R2 values obtained were determined as 0.91, 0.88, and 0.88 for Calabrian pine, oriental plane, and all tree species (105 trees), respectively. In addition to the overall accuracy performance of the comparison between reference and estimations, MAE, MSE, RMSE, and PBIAS values for the DBH of 105 tree stems were calculated as 1.56cm, 5.42cm, 2.33cm, and - 5.10%, respectively. The estimation accuracies increased in regular stem forms compared with forked stems particularly observed on plane trees. Further experiments are needed to investigate the uncertainties associated with trees of different stem forms, species (coniferous or deciduous), different work environments, and different types of LiDAR and LiDAR-based app scanners.

Chatbot Development using APIs and Integration into the MOOC

&#x0D; In recent years, chatbot technologies have evolved into modern information and communication technology applications that perform many virtual tasks, including learning. One of the challenges in improving the chatbot is the insufficient knowledge base of chatbots, including education-oriented conversational agents, the challenges in connecting the chatbot with course content on Massive Open Online Course platforms. In this study, a chatbot was developed to answer questions using publicly available technologies, specifically Application Program Interfaces (APIs) that promise convenient user accessibility via APIs, such as the Facebook Messenger platform along with wit.ai API, Canvas MOOC API, and Wikipedia API. API technologies were used to connect the chatbot to selected course content on the MOOC platform as well as to large knowledge bases such as Wikipedia to expand the knowledge base of the Conversational Agent. The course selected for the chatbot integration was on general informatics topics. Most course participants interacted with the chatbot via the Facebook Messenger platform using their handheld devices. Thus, integrating the chatbot into a widely used platform such as Facebook Messenger is a convenient and effective way for reaching learners. The API technology enabled an efficient connection between the chatbot and third-party apps, including the Messenger app, wit.ai, Canvas MOOC, and Wikipedia. This was due to the variety, richness, manipulation capabilities, and format of data that an API can transfer. In addition, the Wikipedia API seemed to be a vast source of information for expanding the chatbot's knowledge base. Not all of the queries posed to the chatbot were part of the course content. Some participants questioned the personality of the chatbot and were curious about the persona of the conversational agent. This suggests that a chatbot that has been endowed with some personality traits is stimulating and more likely to be accepted by learners.&#x0D;

Dual-Level Secured Autonomous Bank Locker System

The proposed development intends to establish an autonomous bank locker using industry-standard innovative locker technologies to deliver more flexible and reasonably priced semi-autonomous bank security mechanisms with minimal human intervention. In this design, there are two layers of locker security. The system proposed in this effort is a better security system regarding the number of security tiers. Its primary base is facial recognition. The first level is implemented by asking the user to input a passkey. A matrix keypad and Python programming are both employed. The user is then authorized to continue to the subsequent stage if a match is confirmed to exist. The second level was implemented using Python programming, OpenCV software, and face detection and identification techniques. To make Windows compatible with third-party apps Putty and Xming, the Raspberry Pi was linked to the laptop using IEEE 802.3 Ethernet and X11 forwarding on the UBUNTU operating system. IEEE 802.11 USB Wi-Fi was used to connect devices to the Wi-Fi network. The HAAR OpenCV standard has been used for face detection because of its better Face Acceptance and Rejection Ratio. The EIGENFACES OpenCV standard is employed for face recognition due to its efficacy, robustness, and simplicity.

Implementation and evaluation of EMAES – A hybrid encryption algorithm for sharing multimedia files with more security and speed

In this era of smartphones, a huge amount of multimedia files like audio, video, images, animation, and plain text are shared. And with this comes the threat of data being stolen and misused. Most people don’t think about the security of data before uploading it to any platform. Most apps used on smartphones upload our data to their server. Not only this, but other third-party apps can also read that data while it is being transmitted. One solution to this problem is encrypting the data before sharing it and decrypting it back at the other end so that even if it is intercepted in between the transmission, it would be impossible to decrypt it. In this paper, a newly designed hybrid encryption algorithm EMAES that includes the efficiency of MAES (Modified Advanced Encryption Standard) and security of ECC (Elliptic Curve Cryptography) was implemented in MATLAB as well as in android studio 4.0. using a mobile messaging application. Also, it was tested for different speeds and security parameters. Further, it was compared with standard algorithms like the RC4, RC6 and Blowfish as well as with other hybrid algorithms like RC4+ECC, RC6+ECC and Blowfish+ECC. The EMAES was found 30% more efficient in terms of encryption and decryption time. The security of EMAES also showed improvement when compared with other hybrid algorithms for parameters like SSIM (structural similarity index measure), SNR (Signal to Noise Ratio), PSNR(Peak Signal to Noise Ratio), MSE (Mean Squared Error) and RMSE (Root Mean Squared Error). And finally, no significant improvement was found in the CPU and RAM usage.

Subverting Telegram’s End-to-End Encryption

Telegram is a popular secure messaging service with third biggest user base as of 2021. In this paper, we analyze the security of Telegram’s end-to-end encryption (E2EE) protocol in presence of mass-surveillance. Specifically, we show &gt;that Telegram’s E2EE protocol is susceptible to fairly efficient algorithm substitution attacks. While official Telegram clients should be protected against this type of attack due their open-source nature and reproducible builds, this could potentially lead to a very efficient state sponsored surveillance of private communications over Telegram, either on individuals through a targeted attack or massively through some compromised third-party clients. We provide an efficient algorithm substitution attack against MTProto2.0 — the underlying authenticated encryption scheme — that recovers significant amount of encryption key material with a very high probability with few queries and fairly low latency. This could potentially lead to a very efficient state sponsored surveillance of private communications over Telegram, either through a targeted attack or a compromised third-party app. Our attack exploits MTProto2.0’s degree of freedom in choosing the random padding length and padding value. Accordingly, we strongly recommend that Telegram should revise MTProto2.0’s padding methodology. In particular, we show that a minor change in the padding description of MTProto2.0 makes it subversion-resistant in most of the practical scenarios. As a side-effect, we generalize the underlying mode of operation in MTProto2.0, as MTProto-G, and show that this generalization is a multi-user secure deterministic authenticated encryption scheme.

Integrating third-party apps with electronic health records to support COVID-19 response.

To (1) track the integration of telehealth- and COVID-19-related apps with electronic health records (EHRs) over time, (2) identify the primary functionality of apps designed to support the COVID-19 response, and (3) examine whether apps available prior to the pandemic added new telehealth- or COVID-19-related functionalities during the pandemic. Data were collected from public EHR app galleries on a monthly basis from December 31, 2019, through June 1, 2021. Apps were identified as relating to COVID-19 or telehealth using text analysis of the app marketing materials. Descriptive analyses were conducted to characterize telehealth- and COVID-19-related apps discovered through the app galleries, identify their primary functionality, and examine whether any apps added new telehealth- or COVID-19-related functionalities during the pandemic. The number of COVID-19-related apps increased from 0 in March 2020 to 19 a month later and continued to grow to 62 as of June 2021. The number of telehealth-related apps more than doubled from prepandemic levels (n = 41) to a total of 87 apps by June 2021. These apps were 2 times more likely to contain specialized capabilities used to support COVID-19 response efforts, such as secure messaging, vaccine administration, and laboratory testing, compared with all apps listed in the EHR app galleries. These findings demonstrate the potential of integrating third-party apps into EHRs to expand the range of tools that health care providers can use to diagnose, treat, and communicate with patients.