Involuntary Information Leakage in Social Network Services

Abstract

Abstract. Disclosing personal information in online social network services is a double-edged sword. Information exposure is usually a plus, even a must, if people want to participate in social communities; however, leakage of personal information, especially one's identity, may invite malicious attacks from the real world and cyberspace, such as stalking, reputation slander, personalized spamming and phishing. Even if people do not reveal their personal information online, others may do so. In this paper, we consider the problem of involuntary information leakage in social network services and demonstrate its seriousness with a case study of Wretch, the biggest social network site in Taiwan. Wretch allows users to annotate their friends' profiles with a one-line description, from which a friend's private information, such as real name, age, and school attendance records, may be inferred without the information owner's knowledge. Our analysis results show that users' efforts to protect their privacy cannot prevent their personal information from being revealed online. In 592, 548 effective profiles that we collected, the first name of 72% of the accounts and the full name of 30% of the accounts could be easily inferred by using a number of heuristics. The age of 15% of the account holders and at least one school attended by 42% of the holders could also be inferred. We discuss several potential means of mitigating the identified involuntary information leakage problem.

Privacy-Aware and Highly-Available OSN Profiles

“…The possibility for involuntary personal information leakage in current social networks is highlighted in [12], e.g. by means of certain OSN features like annotating or tagging user photos, and its effects are demonstrated in [4].…”

A Data-Reachability Model for Elucidating Privacy and Security Risks Related to the Use of Online Social Networks

“…It is hoped that this knowledge (to which a user-friendly interface can easily be developed) would be a key piece in the puzzle of making these risks more tangible to Internet users as they assess their profiles from the attack-centric view typically adopted by online criminals. In many ways, we regard our datareachability model as the natural progression from related work in the security and privacy of OSNs [3,[7][8][9][10][11], because it explicitly traces what data can reasonably be derived from what is currently shared. These derivations are based on an amalgamation and synthesis of current research and general knowledge of the field.…”

A Decentralized Online Social Network with Efficient User-Driven Replication

“…In [17] authors show that configuring privacy settings in the online social networks is a daunting task. The possibility for involuntary personal information leakage in current social networks is highlighted in [18], e.g., by means of certain OSN features like annotating or tagging user photos, and its effects are demonstrated in [3].…”