CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networks

Farooqi, Shehroze; Musa, Maaz Bin; Shafiq, Zubair; Zaffar, Fareed

doi:10.2478/popets-2020-0076

Cited by 9 publications

(13 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Researchers consistently demonstrate privacy eroding techniques deployed in the wild [15][16][17][18][19] motivated by online advertising business models [32]. Personal data is leaked via social networks [33], third-party web scripts [34], apps [35], software development kits [36], and organizational breaches [37]. The scale of tracking motivate re-designing systems to provide privacy guarantees.…”

Section: Privacy Practicesmentioning

confidence: 99%

Privacy Preference Signals: Past, Present and Future

Hils

Woods

Böhme

2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Privacy preference signals are digital representations of how users want their personal data to be processed. Such signals must be adopted by both the sender (users) and intended recipients (data processors). Adoption represents a coordination problem that remains unsolved despite efforts dating back to the 1990s. Browsers implemented standards like the Platform for Privacy Preferences (P3P) and Do Not Track (DNT), but vendors profiting from personal data faced few incentives to receive and respect the expressed wishes of data subjects. In the wake of recent privacy laws, a coalition of AdTech firms published the Transparency and Consent Framework (TCF), which defines an optin consent signal. This paper integrates post-GDPR developments into the wider history of privacy preference signals. Our main contribution is a high-frequency longitudinal study describing how TCF signal gained dominance as of February 2021. We explore which factors correlate with adoption at the website level. Both the number of third parties on a website and the presence of Google Ads are associated with higher adoption of TCF. Further, we show that vendors acted as early adopters of TCF 2.0 and provide two case-studies describing how Consent Management Providers shifted existing customers to TCF 2.0. We sketch ways forward for a pro-privacy signal.

show abstract

Section: Privacy Practicesmentioning

confidence: 99%

Privacy Preference Signals: Past, Present and Future

Hils

Woods

Böhme

2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

“…unused-apps (44), new-apps-with-access (22), what-datais-accessible ( 16), do-not-remember-authorizing (12), permissions (10), how-much-access-allowed (8), accidentallyadded (7), necessary-permissions-only (7), unfamiliar-apps (6), account-login (4), privacy (4), permissions-changed (4), how-long-access (3), suspicious-apps (3), unauthorizedapps (2), most-used (2), all (1), unauthorized-permissions (1), unnecessary-access (1), specific-app (1), full-accountaccess (1)…”

Section: Qualitative Codebookmentioning

confidence: 99%

“…• unknowns (92) information-access (35), use-of-information (15), howdata-used (10), no-unwanted-email (7), what-permissionallows ( 6), do-they-keep-information (3), email-access (3), why-access-needed (3), why-permissions-necessary (2), why-information-needed (2), who-can-access-data (2), associated-with-personal-info (2), payments (1), can-idelete-my-data (1), google-guideline-enforcement (1), willit-notify-on-data-delete (1), how-long-data-stored (1)…”

Section: Qualitative Codebookmentioning

confidence: 99%

“…Google third-party apps do not necessarily operate client-side. More recently, Farooqi et al [10] used "honeytoken" email addresses (i. e., auto-generated accounts on an email server that the researchers control) to detect Facebook apps inappropriately collecting and using those addresses. Such a method could also be used for Google third-party apps but was not the primary focus of this research.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Security and Privacy Perceptions of Third-Party Application Access for Google Accounts (Extended Version)

G.¹,

Wu²,

Miles³

et al. 2021

Preprint

View full text Add to dashboard Cite

Online services like Google provide a variety of application programming interfaces (APIs). These online APIs enable authenticated third-party services and applications (apps) to access a user's account data for tasks such as single sign-on (SSO), calendar integration, and sending email on behalf of the user, among others. Despite their prevalence, API access could pose significant privacy and security risks, where a thirdparty could have unexpected privileges to a user's account. To gauge users' perceptions and concerns regarding third-party apps that integrate with online APIs, we performed a multipart online survey of Google users. First, we asked n = 432 participants to recall if and when they allowed third-party access to their Google account: 89% recalled using at least one SSO and 52% remembered at least one third-party app. In the second survey, we re-recruited n = 214 participants to ask about specific apps and SSOs they've authorized on their own Google accounts. We collected in-the-wild data about users' actual SSOs and authorized apps: 86% used Google SSO on at least one service, and 67% had at least one third-party app authorized. After examining their apps and SSOs, participants expressed the most concern about access to personal information like email addresses and other publicly shared info. However, participants were less concerned with broader-and perhaps more invasive-access to calendars, emails, or cloud storage (as needed by third-party apps). This discrepancy may be due in part to trust transference to apps that integrate with Google, forming an implied partnership. Our results suggest opportunities for design improvements to the current third-party management tools offered by Google; for example, tracking recent access, automatically revoking access due to app disuse, and providing permission controls.

show abstract

“…If sharing personal data can be of benefit in principle, it can also become a problem when the transferred data is used for purposes that go against its owners, a situation that appears when some data consumers perform activities with information from unwilling individuals, in what is known as personal data misuse. This is a huge problem even today, despite previous attention -research conducted in 2020 shows that data misuse, such as by ransomware or spam, still exists in Facebook even after the Cambridge Analytica scandal [12].…”

Section: Gentrification Of Personal Datamentioning

confidence: 99%

Personal Data Gentrification

Herrera¹,

Berrocal²,

García-Alonso³

et al. 2021

Preprint

View full text Add to dashboard Cite

We live in an era in which the most valued services are not paid for in money, but in personal data. Every day, service providers collect the personal information of billions of individuals, information that sustain their infrastructure by marketing profiles labeled with this information to personal data consumers, such as advertisers. Not all uses of this personal data are for marketing; data consumers can also include, for instance, public health authorities tracking pandemics. In either case, individuals have undergone a process of Personal Data Gentrification, as data ownership has shifted from individuals to service providers and data consumers, as if the data is worth nothing to the individuals; these new owners then harness the data to obtain large profits. Current privacy-enhancing technologies are beginning to allow individuals to control and share less information. However, not sharing individuals' personal information at all could lead to Personal Data Blight, in which the potential of personal data in applications that benefit all of society remains forever latent. In this paper, we propose Personal Data Enfranchisement as a middle ground, empowering individuals to control the sharing of their personal information to shift the business flows of personal information. Based on these insights, we propose a model to gradually and incrementally make a shift from our current situation towards one of Personal Data Enfranchisement. Finally, we present a roadmap and some challenges towards achieving this bold vision. CCS CONCEPTS• Security and privacy → Privacy protections; Economics of security and privacy.

show abstract

CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networks

Cited by 9 publications

References 29 publications

Privacy Preference Signals: Past, Present and Future

Privacy Preference Signals: Past, Present and Future

Security and Privacy Perceptions of Third-Party Application Access for Google Accounts (Extended Version)

Personal Data Gentrification

Contact Info

Product

Resources

About