Examining the Adoption and Abandonment of Security, Privacy, and Identity Theft Protection Practices

Zou, Yixin; Roundy, Kevin A.; Tamersoy, Acar; Shintre, Saurabh; Roturier, Johann; Schaub, Florian

doi:10.1145/3313831.3376570

Cited by 46 publications

(33 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One of our contributions is an estimate of people's adoption of a series of privacy-enhancing tools. Zou et al surveyed crowdworkers about their adoption and abandonment of 30 security and privacy practices [100]. The authors found that the most common reasons for abandoning a practice were perceptions that the practice was no longer needed, that associated risks had decreased, or that the practice was inconvenient.…”

Section: Adoption Of Toolsmentioning

confidence: 99%

See 1 more Smart Citation

Awareness, Adoption, and Misconceptions of Web Privacy Tools

Story¹,

Smullen²,

Yao

et al. 2021

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

Privacy and security tools can help users protect themselves online. Unfortunately, people are often unaware of such tools, and have potentially harmful misconceptions about the protections provided by the tools they know about. Effectively encouraging the adoption of privacy tools requires insights into people’s tool awareness and understanding. Towards that end, we conducted a demographically-stratified survey of 500 US participants to measure their use of and perceptions about five web browsing-related tools: private browsing, VPNs, Tor Browser, ad blockers, and antivirus software. We asked about participants’ perceptions of the protections provided by these tools across twelve realistic scenarios. Our thematic analysis of participants’ responses revealed diverse forms of misconceptions. Some types of misconceptions were common across tools and scenarios, while others were associated with particular combinations of tools and scenarios. For example, some participants suggested that the privacy protections offered by private browsing, VPNs, and Tor Browser would also protect them from security threats – a misconception that might expose them to preventable risks. We anticipate that our findings will help researchers, tool designers, and privacy advocates educate the public about privacy- and security-enhancing technologies.

show abstract

Section: Adoption Of Toolsmentioning

confidence: 99%

“…A majority of Americans are concerned about their privacy [5]. Yet, despite expressed interest in privacyenhancing solutions, adoption of tools that offer privacy protection remains low [100]. A variety of tools are available, but it is unclear how much end users know about them.…”

Section: Introductionmentioning

confidence: 99%

Awareness, Adoption, and Misconceptions of Web Privacy Tools

Story¹,

Smullen²,

Yao

et al. 2021

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

show abstract

“…Studies have shown that some users encounter difficulty and usability issues managing tracking related to targeted ads [2,6,35,43] and social media [22,57]. Many other studies have investigated mental models and preferences toward tracking management and online tracking in general [10,39,81]. Some have focused on narrow and specific contextual threats, such as browser history [50], opt-out and data deletion on websites [8,35,36], privacy expectations on the Internet of Things [53,79], and in mobile app contexts [44,45].…”

Section: User Modelingmentioning

confidence: 99%

“…As in prior studies [1,81], our participants suffered from misconceptions about the efficacy of various protections against PIPs, as well as difficulty identifying their presence or absence. Particularly, our qualitative data shows that users are likely to be misled by the signals they observe, placing greater importance on these signals than other more objective signals.…”

Section: Perspectives On Notices and Controlsmentioning

confidence: 99%

“…Sign-in services and fingerprinting are used ostensibly for user convenience and security [67,71]. However, PIPs are increasingly ubiquitous [61], and lack transparency -many users experience annoyance, frustration, fear, or feelings of being spied upon when they find out that they had been subjected to them without their consent [6,19,81].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Managing Potentially Intrusive Practices in the Browser: A User-Centered Perspective

Smullen

Yao

Feng

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Browser users encounter a broad array of potentially intrusive practices: from behavioral profiling, to crypto-mining, fingerprinting, and more. We study people’s perception, awareness, understanding, and preferences to opt out of those practices. We conducted a mixed-methods study that included qualitative (n=186) and quantitative (n=888) surveys covering 8 neutrally presented practices, equally highlighting both their benefits and risks. Consistent with prior research focusing on specific practices and mitigation techniques, we observe that most people are unaware of how to effectively identify or control the practices we surveyed. However, our user-centered approach reveals diverse views about the perceived risks and benefits, and that the majority of our participants wished to both restrict and be explicitly notified about the surveyed practices. Though prior research shows that meaningful controls are rarely available, we found that many participants mistakenly assume opt-out settings are common but just too difficult to find. However, even if they were hypothetically available on every website, our findings suggest that settings which allow practices by default are more burdensome to users than alternatives which are contextualized to website categories instead. Our results argue for settings which can distinguish among website categories where certain practices are seen as permissible, proactively notify users about their presence, and otherwise deny intrusive practices by default. Standardizing these settings in the browser rather than being left to individual websites would have the advantage of providing a uniform interface to support notification, control, and could help mitigate dark patterns. We also discuss the regulatory implications of the findings.

show abstract