[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
10.1145/3491102.3517652acmconferencesArticle/Chapter ViewAbstractPublication PageschiConference Proceedingsconference-collections
research-article

Permission vs. App Limiters: Profiling Smartphone Users to Understand Differing Strategies for Mobile Privacy Management

Published: 29 April 2022 Publication History

Abstract

We conducted a user study with 380 Android users, profiling them according to two key privacy behaviors: the number of apps installed and the Dangerous permissions granted to those apps. We identified four unique privacy profiles: 1) Privacy Balancers (49.74% of participants), 2) Permission Limiters (28.68%), 3) App Limiters (14.74%), and 4) the Privacy Unconcerned (6.84%). App and Permission Limiters were significantly more concerned about perceived surveillance than Privacy Balancers and the Privacy Unconcerned. App Limiters had the lowest number of apps installed on their devices with the lowest intention of using apps and sharing information with them, compared to Permission Limiters who had the highest number of apps installed and reported higher intention to share information with apps. The four profiles reflect the differing privacy management strategies, perceptions, and intentions of Android users that go beyond the binary decision to share or withhold information via mobile apps.

Supplementary Material

MP4 File (3491102.3517652-talk-video.mp4)
Talk Video

References

[1]
Icek Ajzen. 1991. The theory of planned behavior. Organizational behavior and human decision processes 50, 2 (1991), 179–211.
[2]
Hazim Almuhimedi, Florian Schaub, Norman Sadeh, Idris Adjerid, Alessandro Acquisti, Joshua Gluck, Lorrie Faith Cranor, and Yuvraj Agarwal. 2015. Your location has been shared 5,398 times! A field study on mobile app privacy nudging. In Proceedings of the 33rd annual ACM conference on human factors in computing systems. ACM, Seoul, Korea, 787–796.
[3]
Rawan Baalous and Ronald Poet. 2018. How Dangerous Permissions are Described in Android Apps’ Privacy Policies?. In Proceedings of the 11th International Conference on Security of Information and Networks. ACM, New York, United States, 1–2.
[4]
Paritosh Bahirat, Yangyang He, Abhilash Menon, and Bart Knijnenburg. 2018. A Data-Driven Approach to Developing IoT Privacy-Setting Interfaces. In 23rd International Conference on Intelligent User Interfaces(IUI ’18). ACM, New York, NY, USA, 165–176. https://doi.org/10.1145/3172944.3172982
[5]
Susanne Barth and Menno DT De Jong. 2017. The privacy paradox–Investigating discrepancies between expressed privacy concerns and actual online behavior–A systematic literature review. Telematics and informatics 34, 7 (2017), 1038–1058.
[6]
Susanne Barth, Menno DT de Jong, Marianne Junger, Pieter H Hartel, and Janina C Roppelt. 2019. Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial resources. Telematics and informatics 41 (2019), 55–69.
[7]
Bram Bonné, Sai Teja Peddinti, Igor Bilogrevic, and Nina Taft. 2017. Exploring decision making with Android’s runtime permission dialogs using in-context surveys. In Thirteenth Symposium on Usable Privacy and Security ({SOUPS} 2017). ACM, Santa Clara, CA, USA, 195–210.
[8]
Christoph Buck, Chris Horbel, Tim Kessler, and Claas Christian. 2014. Mobile consumer apps: Big data brother is watching you. Marketing Review St. Gallen 31, 1 (2014), 26–35.
[9]
Martin J Burnham, Yen K Le, and Ralph L Piedmont. 2018. Who is Mturk? Personal characteristics and sample consistency of these online workers. Mental Health, Religion & Culture 21, 9-10 (2018), 934–944.
[10]
Paolo Calciati, Konstantin Kuznetsov, Alessandra Gorla, and Andreas Zeller. 2020. Automatically Granted Permissions in Android apps: An Empirical Study on their Prevalence and on the Potential Threats for Privacy. In Proceedings of the 17th International Conference on Mining Software Repositories. ACM, Seoul, Korea, 114–124.
[11]
Weicheng Cao, Chunqiu Xia, Sai Teja Peddinti, David Lie, Nina Taft, and Lisa M. Austin. 2021. A Large Scale Study of User Behavior, Expectations and Engagement with Android Permissions. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Virtual, 803–820. https://www.usenix.org/conference/usenixsecurity21/presentation/cao-weicheng
[12]
Pew Research Center. 2016. Americans increasingly use smartphones for more than voice calls, texting. https://www.pewresearch.org/internet/ft_01-27-16_smartphoneactivities_640/
[13]
Pew Research Center. 2021. Demographics of Mobile Device Ownership and Adoption in the United States.https://www.pewresearch.org/internet/fact- sheet/mobile/. Retrieved May 9, 2021.
[14]
Saksham Chitkara, Nishad Gothoskar, Suhas Harish, Jason I Hong, and Yuvraj Agarwal. 2017. Does this app really need my location? Context-aware privacy management for smartphones. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 1, 3 (2017), 1–22.
[15]
Eunseong Cho and Seonghoon Kim. 2015. Cronbach’s coefficient alpha: Well known but poorly understood. Organizational research methods 18, 2 (2015), 207–230.
[16]
Chhaya Chouhan, Christy M LaPerriere, Zaina Aljallad, Jess Kropczynski, Heather Lipford, and Pamela J Wisniewski. 2019. Co-designing for community oversight: Helping people make privacy and security decisions together. Proceedings of the ACM on Human-Computer Interaction 3, CSCW(2019), 1–31.
[17]
Lee J Cronbach and Paul E Meehl. 1955. Construct validity in psychological tests.Psychological bulletin 52, 4 (1955), 281.
[18]
Prajit Kumar Das, Anupam Joshi, and Tim Finin. 2017. Personalizing context-aware access control on mobile platforms. In 2017 IEEE 3rd International Conference on Collaboration and Internet Computing (CIC). IEEE, IEEE, San Jose, CA, USA, 107–116.
[19]
Larry Dignan. 2011. Google’s Android wears big bullseye for mobile malware. https://www.zdnet.com/article/googles-android-wears-big-bullseye-for-mobile-malware/
[20]
Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vigna. 2011. PiOS: Detecting Privacy Leaks in iOS Applications. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, 6th February - 9th February 2011. The Internet Society, San Diego, California, USA, 15. https://www.ndss-symposium.org/ndss2011/pios-detecting-privacy-leaks-ios-applications-paper
[21]
Serge Egelman, Adrienne Porter Felt, and David Wagner. 2013. Choice architecture and smartphone privacy: There’sa price for that. Springer, Germany. 211–236 pages.
[22]
Leandre R Fabrigar and Duane T Wegener. 2011. Exploratory factor analysis. Oxford University Press, England.
[23]
Zheran Fang, Weili Han, and Yingjiu Li. 2014. Permission based Android security: Issues and countermeasures. computers & security 43(2014), 205–218.
[24]
Johannes Feichtner and Stefan Gruber. 2020. Understanding privacy awareness in android app descriptions using deep learning. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy. ACM, New Orleans, LA, USA, 203–214.
[25]
Adrienne Porter Felt, Elizabeth Ha, Serge Egelman, Ariel Haney, Erika Chin, and David Wagner. 2012. Android permissions: User attention, comprehension, and behavior. In Proceedings of the eighth symposium on usable privacy and security. ACM, Washington, D.C., 1–14.
[26]
Nina Gerber, Paul Gerber, and Melanie Volkamer. 2018. Explaining the privacy paradox: A systematic review of literature investigating privacy attitude and behavior. Computers & security 77(2018), 226–261.
[27]
Reza Ghaiumy Anaraky, Kaileigh Angela Byrne, Pamela J Wisniewski, Xinru Page, and Bart Knijnenburg. 2021. To Disclose or Not to Disclose: Examining the Privacy Decision-Making Processes of Older vs. Younger Adults. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. ACM, Virtual, 1–14.
[28]
Google. 2021. Google and Open Handset Alliance. n.d. Android API Guide.https://developer.android.com/guide/topics/permissions/overview#dangerous_permissions. Retrieved Feb 21, 2021.
[29]
Google. 2022. Android Developers. https://developer.android.com/guide/topics/manifest/manifest-element
[30]
L Harris, AF Westin, 2003. Consumer Privacy Attitudes: A Major Shift Since 2000 and Why.
[31]
Yangyang He, Paritosh Bahirat, Bart P. Knijnenburg, and Abhilash Menon. 2019. A Data-Driven Approach to Designing for Privacy in Household IoT. ACM Trans. Interact. Intell. Syst. 10, 1 (Sept. 2019), 10:1–10:47. https://doi.org/10.1145/3241378
[32]
Patrick Gage Kelley, Sunny Consolvo, Lorrie Faith Cranor, Jaeyeon Jung, Norman Sadeh, and David Wetherall. 2012. A conundrum of permissions: installing applications on an android smartphone. In International conference on financial cryptography and data security. Springer, Kralendijk, Caribbean Netherlands, 68–79.
[33]
Asma Khatoon and Peter Corcoran. 2017. Android permission system and user privacy—a review of concept and approaches. In 2017 IEEE 7th International Conference on Consumer Electronics-Berlin (ICCE-Berlin). IEEE, Berlin, 153–158.
[34]
Jennifer King, Airi Lampinen, and Alex Smolen. 2011. Privacy: Is there an app for that?. In Proceedings of the Seventh Symposium on Usable Privacy and Security. ACM, Pittsburgh, Pennsylvania, USA, 1–20.
[35]
Bart P Knijnenburg, Alfred Kobsa, and Hongxia Jin. 2013. Dimensionality of information disclosure behavior. International Journal of Human-Computer Studies 71, 12 (2013), 1144–1162.
[36]
Spyros Kokolakis. 2017. Privacy attitudes and privacy behaviour: A review of current research on the privacy paradox phenomenon. Computers & security 64(2017), 122–134.
[37]
Robert S Laufer and Maxine Wolfe. 1977. Privacy as a concept and a social issue: A multidimensional developmental theory. Journal of social Issues 33, 3 (1977), 22–42.
[38]
Christian Fernando Libaque-Sáenz, Siew Fan Wong, Younghoon Chang, and Edgardo R Bravo. 2021. The effect of fair information practices and data collection methods on privacy-related behaviors: a study of Mobile apps. Information & Management 58, 1 (2021), 103284.
[39]
Jialiu Lin, Bin Liu, Norman Sadeh, and Jason I Hong. 2014. Modeling users’ mobile app privacy preferences: Restoring usability in a sea of permission settings. In 10th Symposium On Usable Privacy and Security ({SOUPS} 2014). Usenix, Menlo Park, California, 199–212.
[40]
Bin Liu, Mads Schaarup Andersen, Florian Schaub, Hazim Almuhimedi, Shikun Aerin Zhang, Norman Sadeh, Yuvraj Agarwal, and Alessandro Acquisti. 2016. Follow my recommendations: A personalized privacy assistant for mobile app permissions. In Twelfth Symposium on Usable Privacy and Security ({SOUPS} 2016). usenix, Denver, Colorado, USA, 27–41.
[41]
Bin Liu, Jialiu Lin, and Norman Sadeh. 2014. Reconciling mobile app privacy and usability on smartphones: Could user privacy profiles help?. In Proceedings of the 23rd international conference on World wide web. ACM, Seoul, Republic of Korea, 201–212.
[42]
Gitta H Lubke and Bengt Muthén. 2005. Investigating population heterogeneity with factor mixture models.Psychological methods 10, 1 (2005), 21.
[43]
Christoph Lutz and Pepe Strathoff. 2014. Privacy concerns and online behavior–Not so paradoxical after all? Viewing the privacy paradox through different theoretical lenses. Viewing the Privacy Paradox Through Different Theoretical Lenses (April 15, 2014) 4(2014), 81–99.
[44]
Mary Madden, Lee Rainie, Kathryn Zickuhr, Maeve Duggan, and Aaron Smith. 2014. Public perceptions of privacy and security in the post-Snowden era.
[45]
Naresh K Malhotra, Sung S Kim, and James Agarwal. 2004. Internet users’ information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information systems research 15, 4 (2004), 336–355.
[46]
Karl Moder. 2010. Alternatives to F-test in one way ANOVA in case of heterogeneity of variances (a simulation study). Psychological Test and Assessment Modeling 52, 4 (2010), 343–353.
[47]
Bengt Muthén and Bengt O Muthén. 2009. Statistical analysis with latent variables. Wiley, New York, NY.
[48]
Moses Namara, Reza Ghaiumy Anaraky, Pamela Wisniewski, Xinru Page, and Bart P Knijnenburg. 2021. Examining Power Use and the Privacy Paradox between Intention vs. Actual Use of Mobile Applications. In European Symposium on Usable Security 2021. ACM, Virtual, 223–235.
[49]
Karen L Nylund, Tihomir Asparouhov, and Bengt O Muthén. 2007. Deciding on the number of classes in latent class analysis and growth mixture modeling: A Monte Carlo simulation study. Structural equation modeling: A multidisciplinary Journal 14, 4(2007), 535–569.
[50]
K Olmstead and M Atkinson. 2017. Apps permissions in the Google Play store. Pew Research Center.
[51]
Privacy and American Business.1997. Commerce, Communication and Privacy Online: A National Survey of Computer Users.
[52]
Elissa M Redmiles, Sean Kross, and Michelle L Mazurek. 2019. How well do my results generalize? comparing security and privacy survey results from mturk, web, and telephone samples. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 1326–1343.
[53]
Neil Rubens, Mehdi Elahi, Masashi Sugiyama, and Dain Kaplan. 2015. Active learning in recommender systems. In Recommender systems handbook. Springer, Boston, MA, 809–846.
[54]
Odnan Ref Sanchez, Ilaria Torre, Yangyang He, and Bart P. Knijnenburg. 2019. A recommendation approach for user privacy preferences in the fitness domain. User Modeling and User-Adapted Interaction 30 (Oct. 2019), 513–565. https://doi.org/10.1007/s11257-019-09246-3
[55]
Thomas A Schmitt. 2011. Current methodological considerations in exploratory and confirmatory factor analysis. Journal of Psychoeducational Assessment 29, 4 (2011), 304–321.
[56]
Claude Elwood Shannon. 2001. A mathematical theory of communication. ACM SIGMOBILE mobile computing and communications review 5, 1(2001), 3–55.
[57]
Guey-Shin Shyu, Bai-You Cheng, Chi-Ting Chiang, Pei-Hsuan Yao, and Tsun-Kuo Chang. 2011. Applying factor analysis combined with kriging and information entropy theory for mapping and evaluating the stability of groundwater quality variation in Taiwan. International Journal of Environmental Research and Public Health 8, 4(2011), 1084–1109.
[58]
Drew Smith. 2020. iOS Client Administration. In Apple macOS and iOS System Administration. Springer, Apress, 109–144.
[59]
H Jeff Smith, Sandra J Milberg, and Sandra J Burke. 1996. Information privacy: Measuring individuals’ concerns about organizational practices. MIS quarterly 20(1996), 167–196.
[60]
Daniel Smullen, Yuanyuan Feng, Shikun Zhang, and Norman M Sadeh. 2020. The Best of Both Worlds: Mitigating Trade-offs Between Accuracy and User Burden in Capturing Mobile App Privacy Preferences.Proc. Priv. Enhancing Technol. 2020, 1 (2020), 195–215.
[61]
Daniel J Solove. 2005. A taxonomy of privacy. U. Pa. L. Rev. 154(2005), 477.
[62]
Siok Wah Tay, Pin Shen Teh, and Stephen J Payne. 2021. Reasoning about privacy in mobile application install decisions: Risk perception and framing. International Journal of Human-Computer Studies 145 (2021), 102517.
[63]
TRUSTe. 2014. US consumer confidence privacy report: consumer opinion and business impact. Technical Report. Research Report, TRUSTe Inc.
[64]
George Ursachi, Ioana Alexandra Horodnic, and Adriana Zait. 2015. How reliable are measurement scales? External factors with indirect influence on reliability estimators. Procedia Economics and Finance 20 (2015), 679–686.
[65]
Primal Wijesekera, Arjun Baokar, Lynn Tsai, Joel Reardon, Serge Egelman, David Wagner, and Konstantin Beznosov. 2017. The feasibility of dynamically granted permissions: Aligning mobile privacy with user preferences. In 2017 IEEE Symposium on Security and Privacy (SP). IEEE, San Jose, CA, USA, 1077–1093.
[66]
Rand R Wilcox. 2011. Introduction to robust estimation and hypothesis testing. Academic press, Global.
[67]
Pamela Wisniewski, AKM Islam, Heather Richter Lipford, and David C Wilson. 2016. Framing and measuring multi-dimensional interpersonal privacy preferences of social networking site users. Communications of the Association for information systems 38, 1(2016), 10.
[68]
Pamela Wisniewski, Heather Lipford, and David Wilson. 2012. Fighting for my space: Coping mechanisms for SNS boundary regulation. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. ACM, Austin, Texas, USA, 609–618.
[69]
Pamela Wisniewski, Muhammad Irtaza Safi, Sameer Patil, and Xinru Page. 2020. Predicting smartphone location-sharing decisions through self-reflection on past privacy behavior. Journal of Cybersecurity 6, 1 (2020), tyaa014.
[70]
Pamela J Wisniewski, Bart P Knijnenburg, and Heather Richter Lipford. 2017. Making privacy personal: Profiling social network users to inform privacy education and nudging. International Journal of human-computer studies 98 (2017), 95–108.
[71]
Allison Woodruff, Vasyl Pihur, Sunny Consolvo, Laura Brandimarte, and Alessandro Acquisti. 2014. Would a privacy fundamentalist sell their DNA for $1000... if nothing bad happened as a result? the westin categories, behavioral intentions, and consequences. In 10th Symposium On Usable Privacy and Security ({SOUPS} 2014). Usenix, Menlo Park, California, 1–18.
[72]
Zhiqiang Wu, Xin Chen, Muhammad Umair Khan, and Scott Uk-Jin Lee. 2021. Enhancing Fidelity of Description in Android Apps With Category-Based Common Permissions. IEEE Access 9(2021), 105493–105505.
[73]
Heng Xu, Sumeet Gupta, Mary Beth Rosson, and John M Carroll. 2012. Measuring mobile users’ concerns for information privacy. In Thirty Third International Conference on Information Systems. Citeseer, Orlando, FL, USA, 16.
[74]
Heng Xu and Hock-Hai Teo. 2004. Alleviating consumers’ privacy concerns in location-based services: a psychological control perspective. In Proceedings of the International Conference on Information Systems. Association for Information Systems, Washington, DC, USA, 64.

Cited By

View all
  • (2024)"I do (not) need that feature!"Proceedings of the Twentieth USENIX Conference on Usable Privacy and Security10.5555/3696899.3696923(453-472)Online publication date: 12-Aug-2024
  • (2024)Do You Need to Touch? Exploring Correlations between Personal Attributes and Preferences for Tangible Privacy MechanismsProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642863(1-23)Online publication date: 11-May-2024
  • (2024)On the Feasibility of Predicting Users' Privacy Concerns using Contextual Labels and Personal PreferencesProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642500(1-20)Online publication date: 11-May-2024
  • Show More Cited By

Index Terms

  1. Permission vs. App Limiters: Profiling Smartphone Users to Understand Differing Strategies for Mobile Privacy Management

      Recommendations

      Comments

      Please enable JavaScript to view thecomments powered by Disqus.

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      CHI '22: Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems
      April 2022
      10459 pages
      ISBN:9781450391573
      DOI:10.1145/3491102
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 29 April 2022

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. privacy preferences
      2. smartphone users’ privacy
      3. user behaviors
      4. users profiling

      Qualifiers

      • Research-article
      • Research
      • Refereed limited

      Funding Sources

      • U.S. National Science Foundation (NSF)

      Conference

      CHI '22
      Sponsor:
      CHI '22: CHI Conference on Human Factors in Computing Systems
      April 29 - May 5, 2022
      LA, New Orleans, USA

      Acceptance Rates

      Overall Acceptance Rate 6,199 of 26,314 submissions, 24%

      Upcoming Conference

      CHI 2025
      ACM CHI Conference on Human Factors in Computing Systems
      April 26 - May 1, 2025
      Yokohama , Japan

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)99
      • Downloads (Last 6 weeks)6
      Reflects downloads up to 15 Jan 2025

      Other Metrics

      Citations

      Cited By

      View all
      • (2024)"I do (not) need that feature!"Proceedings of the Twentieth USENIX Conference on Usable Privacy and Security10.5555/3696899.3696923(453-472)Online publication date: 12-Aug-2024
      • (2024)Do You Need to Touch? Exploring Correlations between Personal Attributes and Preferences for Tangible Privacy MechanismsProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642863(1-23)Online publication date: 11-May-2024
      • (2024)On the Feasibility of Predicting Users' Privacy Concerns using Contextual Labels and Personal PreferencesProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642500(1-20)Online publication date: 11-May-2024
      • (2024)Press play, install malware: a study of rhythm game-based malware droppingInternational Journal of Information Security10.1007/s10207-024-00893-123:5(3369-3391)Online publication date: 1-Oct-2024
      • (2024)Gaming the system: tetromino-based covert channel and its impact on mobile securityInternational Journal of Information Security10.1007/s10207-024-00875-323:4(3007-3027)Online publication date: 1-Aug-2024
      • (2024)Empowering User Security Awareness and Risk Assessment Within Gamified Smartphone EnvironmentEntertainment Computing – ICEC 202410.1007/978-3-031-74353-5_2(16-34)Online publication date: 1-Oct-2024
      • (2024)Hidden Realms: Exploring Steganography Methods in Games for Covert Malware DeliveryMalware10.1007/978-3-031-66245-4_15(355-368)Online publication date: 5-Jul-2024
      • (2023)Evaluating the impact of community oversight for managing mobile privacy and securityProceedings of the Nineteenth USENIX Conference on Usable Privacy and Security10.5555/3632186.3632210(437-456)Online publication date: 7-Aug-2023
      • (2023)Design Guidelines for Improving Mobile Sensing Data Collection: A Prospective Mixed-Methods Study (Preprint)Journal of Medical Internet Research10.2196/55694Online publication date: 20-Dec-2023
      • (2023)The access control double bind: How everyday interfaces regulate access and privacy, enable surveillance, and enforce identityConvergence: The International Journal of Research into New Media Technologies10.1177/1354856523119370630:3(1186-1218)Online publication date: 19-Aug-2023
      • Show More Cited By

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      HTML Format

      View this article in HTML Format.

      HTML Format

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media