Privacy Protection Tools Research Articles

Exploring user privacy awareness on GitHub: an empirical study

GitHub provides developers with a practical way to distribute source code and collaboratively work on common projects. To enhance account security and privacy, GitHub allows its users to manage access permissions, review audit logs, and enable two-factor authentication. However, despite the endless effort, the platform still faces various issues related to the privacy of its users. This paper presents an empirical study delving into the GitHub ecosystem. Our focus is on investigating the utilization of privacy settings on the platform and identifying various types of sensitive information disclosed by users. Leveraging a dataset comprising 6,132 developers, we report and analyze their activities by means of comments on pull requests. Our findings indicate an active engagement by users with the available privacy settings on GitHub. Notably, we observe the disclosure of different forms of private information within pull request comments. This observation has prompted our exploration into sensitivity detection using a large language model and BERT, to pave the way for a personalized privacy assistant. Our work provides insights into the utilization of existing privacy protection tools, such as privacy settings, along with their inherent limitations. Essentially, we aim to advance research in this field by providing both the motivation for creating such privacy protection tools and a proposed methodology for personalizing them.

Application Status and Prospect of Data Privacy Protection Technology

This article aims to explore the current application status and future prospects of data privacy protection technology, analyze the challenges faced by current data privacy, explore possible solutions, and provide reference and inspiration for the development of data privacy protection technology. This article adopts literature review and experience summary methods. Through sorting and summarizing relevant literature, combined with the author's own experience in the field of data privacy protection, a comprehensive and in-depth analysis is conducted on the current application status of data privacy protection technology. Through literature review and experience summary, we found that current data privacy protection technologies have made significant progress with the rapid development of information technology. Among them, the research and application of data encryption technology based on encryption algorithms, privacy protection protocols, and privacy protection tools have gradually matured data privacy protection technology. At the same time, the frequent occurrence of data privacy breaches also highlights the importance and urgency of data privacy protection technology. Data privacy protection technology is particularly important in the current context of information technology in society. In the future, with the continuous development of technologies such as big data and artificial intelligence, data privacy protection technology will face greater challenges and opportunities.

Online privacy literacy and users' information privacy empowerment: the case of GDPR in Europe

PurposeResearch on online user privacy shows that empirical evidence on how privacy literacy relates to users' information privacy empowerment is missing. To fill this gap, this paper investigated the respective influence of two primary dimensions of online privacy literacy – namely declarative and procedural knowledge – on online users' information privacy empowerment.Design/methodology/approachAn empirical analysis is conducted using a dataset collected in Europe. This survey was conducted in 2019 among 27,524 representative respondents of the European population.FindingsThe main results show that users' procedural knowledge is positively linked to users' privacy empowerment. The relationship between users' declarative knowledge and users' privacy empowerment is partially supported. While greater awareness about firms and organizations practices in terms of data collections and further uses conditions was found to be significantly associated with increased users' privacy empowerment, unpredictably, results revealed that the awareness about the GDPR and user’s privacy empowerment are negatively associated. The empirical findings reveal also that greater online privacy literacy is associated with heightened users' information privacy empowerment.Originality/valueWhile few advanced studies made systematic efforts to measure changes occurred on websites since the GDPR enforcement, it remains unclear, however, how individuals perceive, understand and apply the GDPR rights/guarantees and their likelihood to strengthen users' information privacy control. Therefore, this paper contributes empirically to understanding how online users' privacy literacy shaped by both users' declarative and procedural knowledge is likely to affect users' information privacy empowerment. The study empirically investigates the effectiveness of the GDPR in raising users' information privacy empowerment from user-based perspective. Results stress the importance of greater transparency of data tracking and processing decisions made by online businesses and services to strengthen users' control over information privacy. Study findings also put emphasis on the crucial need for more educational efforts to raise users' awareness about the GDPR rights/guarantees related to data protection. Empirical findings also show that users who are more likely to adopt self-protective approaches to reinforce personal data privacy are more likely to perceive greater control over personal data. A broad implication of this finding for practitioners and E-businesses stresses the need for empowering users with adequate privacy protection tools to ensure more confidential transactions.

Effective Techniques for Protecting the Privacy of Web Users

With the rapid growth of web networks, the security and privacy of online users are becoming more compromised. Especially, the use of third-party services to track users’ activities and improve website performance. Therefore, it is unavoidable that using personal information to create unique profiles may violate individuals’ privacy. Recently, several tools have been developed such as anonymity, anti-tracking, and browser plugins to ensure the protection of users from third-party tracking methods by blocking JavaScript programs and other website components. However, the current state lacks an efficient approach that provides a comprehensive solution. In this paper, we conducted a systematic analysis of the most common privacy protection tools based on their accuracy and performance by evaluating their effectiveness in correctly classifying tracking and functional JavaScript programs, then evaluating the estimated time the browser takes to render the pages for each tool. To achieve this, we automatically browsed the most 50 websites determined in 2022 and categorized them according to different fields to get the in-page (as part of HTML script tags), and all external JavaScript programs. Then we collected data and datasets of 1578 JavaScript elements and obtained six diverse Firefox profiles when the tools were enabled. The results found that Ghostery has the highest percentage of allowing most functioning scripts with the lowest average error rate (AER). While at the same time NoScript achieved the highest percentage of blocking most tracking scripts since it is the highest blocker of third-party services. After that, we examined the speed of the browser finding that, Ghostery improved the load time by 36.2% faster than the baseline, while Privacy Badger only reduced the load time by 7.1%. We believe that our findings can help users decide on a privacy tool that meets their needs. Moreover, researchers and developers can use our findings to improve the privacy of internet users by designing more effective privacy protection techniques.

Privacy in LA Research

Protection of student privacy is critical for scaling up the use of learning analytics (LA) in education. Poorly implemented frameworks for privacy protection may negatively impact LA outcomes and undermine trust in the discipline. To design and implement models and tools for privacy protection, we need to understand privacy itself. To develop better understanding and build ground for developing tools and models for privacy protection, this paper examines how privacy hitherto has been defined by LA scholars, and how those definitions relate to the established approaches to define privacy. We conducted a scoping review of 59 articles focused on privacy in LA. In most of these studies (74%), privacy was not defined at all; 6% defined privacy as a right, 11% as a state, 15% as control, and 16% used other approaches to explain privacy in LA. The results suggest a need to define privacy in LA to be able to enact a responsible approach to the use of student data for analysis and decision-making.

Motive perception pathways to the release of personal information to healthcare organizations

BackgroundThe goal of the study is to assess the downstream effects of who requests personal information from individuals for artificial intelligence-(AI) based healthcare research purposes—be it a pharmaceutical company (as an example of a for-profit organization) or a university hospital (as an example of a not-for-profit organization)—as well as their boundary conditions on individuals’ likelihood to release personal information about their health. For the latter, the study considers two dimensions: the tendency to self-disclose (which is aimed to be high so that AI applications can reach their full potential) and the tendency to falsify (which is aimed to be low so that AI applications are based on both valid and reliable data).MethodsAcross three experimental studies with Amazon Mechanical Turk workers from the U.S. (n = 204, n = 330, and n = 328, respectively), Covid-19 was used as the healthcare research context.ResultsUniversity hospitals (vs. pharmaceutical companies) score higher on altruism and lower on egoism. Individuals were more willing to disclose data if they perceived that the requesting organization acts based on altruistic motives (i.e., the motives function as gate openers). Individuals were more likely to protect their data by intending to provide false information when they perceived egoistic motives to be the main driver for the organization requesting their data (i.e., the motives function as a privacy protection tool). Two moderators, namely message appeal (Study 2) and message endorser credibility (Study 3) influence the two indirect pathways of the release of personal information.ConclusionThe findings add to Communication Privacy Management Theory as well as Attribution Theory by suggesting motive-based pathways to the release of correct personal health data. Compared to not-for-profit organizations, for-profit organizations are particularly recommended to match their message appeal with the organizations’ purposes (to provide personal benefit) and to use high-credibility endorsers in order to reduce inherent disadvantages in motive perceptions.

Survey of privacy-preserving mechanisms for heterogeneous data types

Due to the pervasiveness of always connected devices, large amounts of heterogeneous data are continuously being collected. Beyond the benefits that accrue for the users, there are private and sensitive information that is exposed. Therefore, Privacy-Preserving Mechanisms (PPMs) are crucial to protect users’ privacy. In this paper, we perform a thorough study of the state of the art on the following topics: heterogeneous data types, PPMs, and tools for privacy protection. Building from the achieved knowledge, we propose a privacy taxonomy that establishes a relation between different types of data and suitable PPMs for the characteristics of those data types. Moreover, we perform a systematic analysis of solutions for privacy protection, by presenting and comparing privacy tools. From the performed analysis, we identify open challenges and future directions, namely, in the development of novel PPMs.

Introducing the Architecture of FASTER: A Digital Ecosystem for First Responder Teams

Emergency first responders play an important role during search and rescue missions, by helping people and saving lives. Thus, it is important to provide them with technology that will maximize their performance and their safety on the field of action. IFAFRI, the “International Forum to Advanced First Responder Innovation” has pointed out several capability gaps that are found in the existing solutions. Based on them, there is a need for the development of novel, modern digital solutions that will better assist responders by helping them on the field and, at the same time, better protect them. The work presented here introduces the logical architecture implemented in the Horizon 2020 project called FASTER (First responders Advanced technologies for Safe and efficienT Emergency Response), which is an innovating digital ecosystem for emergency first response teams. It is a system that meets the requirements of the consortium members but also fills all the gaps that IFARFI has pointed out and consists of mechanisms and tools for data communication, data analysis, monitoring, privacy protection and smart detection mechanisms.

Minimax randomized response methods for protecting respondent’s privacy

Randomized response (RR) is a common privacy protection tool. It perturbs each true response using a probabilistic mechanism. Local differential privacy (LDP) is a rigorous privacy protection criterion that demands a guarantee that no intruder will get much new information about any respondent’s true value from its perturbed value. Considering linear unbiased estimation of multinomial probabilities under LDP and squared error loss, we derive minimax RR methods. We address optimal choices for both the RR mechanism (or design) and the estimator. Our minimax design has a particular structure, which is used to define t-subset designs. We describe and study properties of t-subset designs including their practical implementation. We also study mixtures of t-subset designs and examine the RAPPOR method, which is used notably by Google and Apple. We note inadmissibility of the RAPPOR design and offer some suggestions for improving both the design and the customary estimator.

No boundaries: data exfiltration by third parties embedded on web pages

Abstract We investigate data exfiltration by third-party scripts directly embedded on web pages. Specifically, we study three attacks: misuse of browsers’ internal login managers, social data exfiltration, and whole-DOM exfiltration. Although the possibility of these attacks was well known, we provide the first empirical evidence based on measurements of 300,000 distinct web pages from 50,000 sites. We extend OpenWPM’s instrumentation to detect and precisely attribute these attacks to specific third-party scripts. Our analysis reveals invasive practices such as inserting invisible login forms to trigger autofilling of the saved user credentials, and reading and exfiltrating social network data when the user logs in via Facebook login. Further, we uncovered password, credit card, and health data leaks to third parties due to wholesale collection of the DOM. We discuss the lessons learned from the responses to the initial disclosure of our findings and fixes that were deployed by the websites, browser vendors, third-party libraries and privacy protection tools.

Link Prediction Adversarial Attack Via Iterative Gradient Attack

Increasing deep neural networks are applied in solving graph evolved tasks, such as node classification and link prediction. However, the vulnerability of deep models can be revealed using carefully crafted adversarial examples generated by various adversarial attack methods. To explore this security problem, we define the link prediction adversarial attack problem and put forward a novel iterative gradient attack (IGA) strategy using the gradient information in the trained graph autoencoder (GAE) model. Not surprisingly, GAE can be fooled by an adversarial graph with a few links perturbed on the clean one. The results on comprehensive experiments of different real-world graphs indicate that most deep models and even the state-of-the-art link prediction algorithms cannot escape the adversarial attack, such as GAE. We can benefit the attack as an efficient privacy protection tool from the link prediction of unknown violations. On the other hand, the adversarial attack is a robust evaluation metric for current link prediction algorithms of their defensibility.

Smart Contract Privacy Protection Using AI in Cyber-Physical Systems: Tools, Techniques and Challenges

Applications of Blockchain (BC) technology and Cyber-Physical Systems (CPS) are increasing exponentially. However, framing resilient and correct smart contracts (SCs) for these smart application is a quite challenging task because of the complexity associated with them. SC is modernizing the traditional industrial, technical, and business processes. It is self-executable, self-verifiable, and embedded into the BC that eliminates the need for trusted third-party systems, which ultimately saves administration as well as service costs. It also improves system efficiency and reduces the associated security risks. However, SCs are well encouraging the new technological reforms in Industry 4.0, but still, various security and privacy challenges need to be addressed. In this paper, a survey on SC security vulnerabilities in the software code that can be easily hacked by a malicious user or may compromise the entire BC network is presented. As per the literature, the challenges related to SC security and privacy are not explored much by the authors around the world. From the existing proposals, it has been observed that designing a complex SCs cannot mitigate its privacy and security issues. So, this paper investigates various Artificial Intelligence (AI) techniques and tools for SC privacy protection. Then, open issues and challenges for AI-based SC are analyzed. Finally, a case study of retail marketing is presented, which uses AI and SC to preserve its security and privacy.

Distinguishing Group Privacy From Personal Privacy

Machine learning and data mining threaten personal privacy, and many tools exist to help users protect their privacy (e.g., available privacy settings on Facebook, anonymization and encryption of personal data, etc.). But such technologies also pose threats to "group privacy," which is a concept scholars know relatively little about. Moreover, there are few tools to address the problem of protecting group privacy. This paper discusses an emerging class of software applications and services that pose new risks to group privacy by revealing group-level information based on individual information, such as social media postings or fitness app usage. The paper describes the results of two experiments that empirically establish the concept of group privacy and shows that it affects user perceptions of and interactions with information technology. The findings serve as a call to developers to design tools for group privacy protection.

Impact of Neighbors on the Privacy of Individuals in Online Social Networks

Abstract The problem of user privacy enforcement in online social networks (OSN) cannot be ignored and, in recent years, Facebook and other providers have improved considerably their privacy protection tools. However, in OSN’s the most powerful data protection “weapons” are the users themselves. The behavior of an individual acting in an OSN highly depends on her level of privacy attitude: an aware user tends not to share her private information, or the private information of her friends, while an unaware user could not recognize some information as private, and could share it without care to her contacts. In this paper, we experimentally study the role of the attitude on privacy of an individual and her friends on information propagation in social networks. We model information diffusion by means of an extension of the Susceptible-Infectious-Recovered (SIR) epidemic model that takes into account the privacy attitude of users. We employ this diffusion model in stochastic simulations on a synthetic social network, designed for miming the characteristics of the Facebook social graph.

A Study of Online Social Network Privacy Via the TAPE Framework

While personal information privacy is threatened by online social networks, researchers are seeking for privacy protection tools and methods to assist online social network users. In this paper, we propose a Trust-Aware Privacy Evaluation framework, called TAPE, aiming to address this problem. Under the TAPE framework we investigate how to quantitatively evaluate the privacy risk, as a function of people's awarenesses of privacy risks as well as whether people can be trusted by their friends to protect others' personal information. Simulations are performed to illustrate the key concepts and calculations, as well as the advantages of TAPE. Based on the TAPE framework, we also propose an unfriending strategy in terms of privacy protection, which outperforms other existing unfriending strategies.

Privacy by design: Networked computing, 1969–1979

Discourse analysis of the technical document series that records the internet design history, the RFCs, shows that those involved during the first decade saw privacy as a multi-dimensional and interactive problem requiring use of a suite of solutions at the network, individual, and data levels that had to take into account the need to balance privacy against experimentation and innovation. Internet designers were sophisticated in their pragmatic thinking about privacy when evaluated vis-a-vis theoretical developments since that time, viewing privacy as a contextual matter involving boundary setting, and using information architecture and metadata as tools for privacy protection. Those in the social science and legal communities think about the privacy effects of communication on humans, while those in the technical design community must focus on privacy as a set of logistical problems. Bringing these diverse communities into a single conversation can considerably enrich and strengthen the work of all.

Trust but Pre-Verify?

Governments should be uncompromising in jointly seeking both information and privacy goals for the data that is in their stewardship. The GAO’s 2001 report on Record Linkage and Privacy places a combined high priority on information gains and privacy issues–and presents this position in contrast to an alternative “zero-sum approach” that conceptualizes privacy and information mainly, or only in terms of, trade-offs. The 2001 GAO report further indicates that the way to achieve a combined high priority (for both information gains and privacy issues) is through an improved “privacy-protection tool box” to insure linkages that preserve privacy:

Zanik prywatności jako narastający problem społeczeństwa informacyjnego

Since the beginning of its existence, the Internet has been almost synonymous with anonymity, giving unfettered opportunities to create a virtual identity. A lot has changed after the introduction of the era of Web 2.0. The network has become primarily a tool of communication with friends and loved ones, a place of socializing and a giant, constantly expanding photo gallery. People in society, along with benefiting from the growing possibilities of the web have divulged more and more information about themselves. Today, in a time of scandals revealing states spying on their own citizens, and social networks constantly changing their terms of privacy, no one believes in the anonymity of the Internet. This paper is aimed at presenting the most important issues related to the concept of network surveillance, with an emphasis on the problem of online privacy. The task is to draw the attention of researchers, who previously were neglecting the problem of the loss of privacy, which is not only applicable to the virtual life, but also has a significant impact on the functioning offline. Two directions here are the most visible. Users, for the privilege, comfort, or just entertainment, share on the network more and more detailed information about themselves. At the same time the giants of the Internet, as well as governments, increase the scope of their surveillance, which may stand up to even the most aware and cautious person. Changes occur extremely quickly, and this is why publications a few years or even months ago rarely mentioned about problem, and then only briefly, which may be caused by insufficient awareness about its importance and its possible impact on developing societies. However, we cannot forget about increasing the awareness of modern societies, which results in the emergence of tools for privacy protection created by the users themselves.