Analyzing confidentiality and privacy concerns

Abstract

Context: Post-release user feedback plays an integral role in improving software quality and informing new features. Given its growing importance, feedback concerning security enhancements is particularly noteworthy. In considering the rapid uptake of Android we have examined the scale and severity of Android security threats as reported by its stakeholders. Objective: We systematically mine Android issue logs to derive insights into stakeholder perceptions and experiences in relation to certain Android security issues. Method: We employed contextual analysis techniques to study issues raised regarding confidentiality and privacy in the last three major Android releases, considering covariance of stakeholder comments, and the level of consistency in user preferences and priorities. Results: Confidentiality and privacy concerns varied in severity, and were most prevalent over Jelly Bean releases. Issues raised in regard to confidentiality related mostly to access, user credentials and permission management, while privacy concerns were mainly expressed about phone locking. Community users also expressed divergent preferences for new security features, ranging from more relaxed to very strict. Conclusions: Strategies that support continuous corrective measures for both old and new Android releases would likely maintain stakeholder confidence. An approach that provides users with basic default security settings, but with the power to configure additional security features if desired, would provide the best balance for Android's wide cohort of stakeholders.

On Satisfying the Android OS Community: User Feedback Still Central to Developers' Portfolios

“…3), suggesting that some releases were more problematic than others. In fact, our earlier work also detected this pattern for issues logged overall and for security issues [21]. In contrast here, however, and as noted above, developers did not always respond to the most pressing issues.…”

“…Given that device manufacturers have been shown to delay upgrading their hardware with recent Android OS releases [25], there is a possibility that some issues reported between specific releases were in fact related to earlier releases. However, this misalignment was not detected during our previous contextual analysis [21], suggesting that our approach appropriately classified issues.…”

A mixed methods probe into the direct disclosure of software vulnerabilities

“…Although not visible in the sample, it should be emphasized that the reluctance was presumably also explained by business and related factors. This presumption is backed by observations that security issues can have a negative impact upon quality perceptions (Licorish et al, 2015), and even affect firms' stock prices (Spanos and Angelis, 2016). The following key result points out more practical problems:…”

Augmenting Text Mining Approaches with Social Network Analysis to Understand the Complex Relationships among Users' Requests: A Case Study of the Android Operating System

“…One extremely large and successful community that has received considerable text mining attention is that of the Android OS. Studies have examined where bugs are most prevalent in the Android architecture [14], the quality of various types of bug reports [15], top user concerns and the attention they receive from the Android community [6], and the scale and severity of Android security threats as reported by its stakeholders [16]. With Android devices now leading mobile device sales [17], it is fitting that the text mining community would look to understand this platform and provide improvement advice.…”