Best Practices for Notification Studiesfor Security and Privacy Issues on the Internet

Maaß, Max; Pridöhl, Henning; Herrmann, Dominik; Hollick, Matthias

doi:10.1145/3465481.3470081

Cited by 5 publications

(4 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Message tone was found to not affect fix rates [49,61]. Maass et al compared existing work and outlined practical recommendations for future notification studies [37].…”

Section: Related Workmentioning

confidence: 99%

“…In addition, we followed best practices recommended by prior work for ethical network checks [13] and notification studies [37]. We communicated our identities and benign intentions at all points of contact with the monitored websites and their operators: In all notification emails and on the study website we identified ourselves as researchers and explained the purpose and scope of our checks and the whole research project.…”

Section: Research Ethicsmentioning

confidence: 99%

“…However, we do not believe this had any effect on our findings. We openly communicated that the notification process was part of a scientific study, possibly prompting fixes that would not have taken place otherwise due to the observer effect [37].…”

Section: Limitationsmentioning

confidence: 99%

“…not see spikes in access rates in early November that would have indicated many automated accesses. As recommended by prior work[37], we sent debriefing emails to 67,194 addresses for the 28,724 domains in the Control group on December 20, about seven weeks after the notification of experimental groups. The message text matched the initial notification for the No Warning group, including links to the info website, report, and survey.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Comparing Large-Scale Privacy and Security Notifications

Utz

Michels

Degeling

et al. 2023

PoPETs

View full text Add to dashboard Cite

Over the last decade, web security research has used notification campaigns as a tool to help web operators fix security problems or stop infrastructure abuse. First attempts at applying this approach to privacy issues focused on single services or vendors. Hence, little is known if notifications can also raise awareness and encourage remediation of more complex, vendor-independent violations of privacy legislation at scale, such as informed consent to cookie usage under the EU's ePrivacy Directive or the General Data Protection Regulation's requirement for a privacy policy. It is also unclear how privacy notifications perform and are perceived compared to those about security vulnerabilities. To fill this research gap, we conduct a large-scale, automated email notification study with more than 115K websites we notify about lack of a privacy policy, use of third-party cookies without or before informed consent, and input forms for personal data that do not use HTTPS. We investigate the impact of warnings about fines and compare the results with security notifications to more than 40K domains about openly accessible Git repositories. Based on our measurements and interactions with operators through email and a survey, we find that notifications about privacy issues are not as well received as security notifications. They result in lower fix rates, less incentive to take immediate action, and more negative feedback. Specific reasons include a lack of awareness and knowledge of privacy laws' applicability, difficulties to pinpoint the problem, and limited intrinsic motivation.

show abstract

“…Message tone was found to not affect fix rates [49,61]. Maass et al compared existing work and outlined practical recommendations for future notification studies [37].…”

Section: Related Workmentioning

confidence: 99%

Section: Research Ethicsmentioning

confidence: 99%

Section: Limitationsmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations