Implications of XR on Privacy, Security and Behaviour: Insights from Experts

Abstract

Extended-Reality (XR) devices are packed with sensors that allow tracking of users (e.g., behaviour, actions, eye-gaze) and their surroundings (e.g., people, places, objects). As a consequence, XR devices pose significant risks to privacy, security, and our ability to understand and influence the behaviour of users -risks that will be amplified by ever-increasing adoption. This necessitates addressing these concerns before XR becomes ubiquitous. We conducted three focus groups with thirteen XR experts from industry and academia interested in XR, security, and privacy, to investigate current and emerging issues relating to security, privacy, and influencing behaviour. We identified issues such as virtual threats leading to physical harm, missing opting-out methods, and amplifying bias through perceptual filters. From the results we establish a collection of prescient challenges relating to security, privacy and behavioural manipulation within XR and present recommendations working towards developing future XR devices that better support security and privacy by default. CCS CONCEPTS• Human-centered computing → Mixed / augmented reality; • Security and privacy → Human and societal aspects of security and privacy.

Recent Trends of Authentication Methods in Extended Reality: A Survey

“…Year Contribution/Title Authentication [34] SoK: Authentication in augmented and virtual reality [35] SoK: A Systematic Literature Review of Knowledge-Based Authentication on Augmented Reality Head-Mounted Displays [36] A literature review on virtual reality authentication [37] Security of Virtual Reality Authentication Methods in Metaverse: An Overview [38] Biometric as Secure Authentication for Virtual Reality Environment: A Systematic Literature Review [39] Recent advances in biometrics-based user authentication for wearable devices: A contemporary survey [40] A Review of multimodal facial biometric authentication methods in mobile devices and their application in Head mounted displays [41] Gaze-based authentication in virtual reality [43] A Survey on metaverse: fundamentals, security, and privacy [44] Security and privacy in metaverse: A comprehensive survey [45] Identity Threats in the Metaverse and Future Research Opportunities [46] Visualization and cybersecurity in the metaverse: A Survey [47] Cybersecurity in the AI-based metaverse: A Survey [48] Metaverse security and privacy: An overview [49] Metaverse: Security and privacy issues [50] Vision: Usable privacy for XR in the era of the metaverse [51] Implications of XR on privacy, security, and behaviour: Insights from experts [52] Security and privacy approaches in mixed reality: A literature survey [53] Security and Privacy Evaluation of Popular Augmented and Virtual Reality Technologies [54] A systematic literature review on Virtual Reality and Augmented Reality in terms of privacy, authorization, and data-leaks [55] Overview of vulnerabilities of decision support interfaces based on virtual and augmented reality technologies [56] SoK, Data Privacy in Virtual Reality [57] Security and privacy in virtual reality-A literature survey [58] Security and privacy in virtual reality: A literature review [59] Virtually secure: A taxonomic assessment of cybersecurity challenges in virtual reality environments [60] Digital body, identity, and privacy in social virtual reality: A systematic review [61] Security and privacy for augmented reality systems…”

“…For example, in [43][44][45][46][47][48][49], the authors presented the architecture, technologies, and characteristics of the metaverse and discussed its different security challenges and their associated countermeasures. Other related works focused on only the security and privacy of sub-fields of the metaverse, like XR [50,51], MR [52], VR/AR [53][54][55], VR [56][57][58][59][60], and AR [61].…”

You Can’t Hide Behind Your Headset: User Profiling in Augmented and Virtual Reality

“…For instance, Adams et al [39] deeply investigated VR security and privacy perceptions from users and developers, outlining a ''code of ethics'' for developers. Abraham et al [40] interviewed XR experts from industry and academia to investigate issues relating to security, privacy, and influencing behavior, providing guidelines for future XR devices supporting security and privacy by default. Recent works [41], [42] deeply discussed security and privacy issues arising in the metaverse, allowing a better understanding and a consequent improvement of the technology concerning its users.…”

“…For instance, to the best of our knowledge, there are no attempts in the literature to infer users' private data (e.g., age, gender) from modern XR devices. Indeed, many works [39], [40], [50] theorized that private data inference in XR was possible based on eye trackers studies [57], but none of these theories were empirically proven. The only evidence of gender profiling comes from Steil et al [8], who purposely equipped the VR headset Oculus DK2 (2016) with an eyetracker (Pupil 4 ).…”

Privacy-Enhancing Technology and Everyday Augmented Reality

“…The implications of AR-driven privacy risks, for users and bystanders alike, represent pertinent issues beyond face-value concerns regarding recording activities [5,114]. AR devices' capability for "persistent, ubiquitous recording" [21] and veilance of others [86] has the potential to erode a bystander's "reasonable expectation of privacy" [45], supporting "cyborg stalkers" [68], and facilitating a "global panopticon society of constant surveillance", where "the possibility of being recorded looms over every walk in the park, every conversation in a bar, and indeed, everything you do near other people" [124].…”