SoK: Privacy on Mobile Devices – It’s Complicated

Abstract

Modern mobile devices place a wide variety of sensors and services within the personal space of their users. As a result, these devices are capable of transparently monitoring many sensitive aspects of these users’ lives (e.g., location, health, or correspondences). Users typically trade access to this data for convenient applications and features, in many cases without a full appreciation of the nature and extent of the information that they are exposing to a variety of third parties. Nevertheless, studies show that users remain concerned about their privacy and vendors have similarly been increasing their utilization of privacy-preserving technologies in these devices. Still, despite significant efforts, these technologies continue to fail in fundamental ways, leaving users’ private data exposed.In this work, we survey the numerous components of mobile devices, giving particular attention to those that collect, process, or protect users’ private data. Whereas the individual components have been generally well studied and understood, examining the entire mobile device ecosystem provides significant insights into its overwhelming complexity. The numerous components of this complex ecosystem are frequently built and controlled by different parties with varying interests and incentives. Moreover, most of these parties are unknown to the typical user. The technologies that are employed to protect the users’ privacy typically only do so within a small slice of this ecosystem, abstracting away the greater complexity of the system. Our analysis suggests that this abstracted complexity is the major cause of many privacy-related vulnerabilities, and that a fundamentally new, holistic, approach to privacy is needed going forward. We thus highlight various existing technology gaps and propose several promising research directions for addressing and reducing this complexity.

Privacy in the Smart City—Applications, Technologies, Challenges, and Solutions

“…This problem can be observed for many smart city technologies, including the IoT, wearable devices, sensor networks, autonomous systems, and intelligent vehicles, especially when these devices support a wide range of protocols and include many software components. This is naturally the case for mobile phones that, when compromised, can lead to a complete violation of user privacy (see [170] and [64] for surveys on mobile phone security and privacy). The fact that users can actively download third-party software onto the devices furthermore opens up the problem of malware [171].…”

“…In addition, these devices consist of various components developed by different parties with different goals and incentives, which makes the protection of sensitive user data more difficult. As a result, existing privacy solutions often focus only on a small part of the mobile device ecosystem and thus leave the user vulnerable [64].…”

“…Even though both Android and iOS employ permission models to restrict the data that third-party apps can access, apps often request more permissions than necessary, and users often grant permissions that are more far-reaching than expected [199]. We refer the reader to a recent survey by Spensky et al [64] for a more detailed discussion of these issues.…”

Pets without PETs: on pet owners’ under-estimation of privacy concerns in pet wearables

“…Such concerns are grounded in concrete vulnerabilities of existing wearables, as shown in an extensive survey of consumer wearables [60] spanning from typical activity trackers to smart textile implants -albeit ignoring pet wearables or indeed any wearable not directly worn by a human. A systematization of knowledge on privacy on mobile devices by Spensky et al [62] found that many privacy related vulnerabilities arise due to the complexity of software ecosystems, as technologies to protect privacy tend to focus on small parts of the ecosystem, abstracting away from its entire complexity. Pu and Grossklags [54] investigated factors that influenced users' privacy concerns towards data of themselves and data of friends (e.g., through Facebook connections).…”

Sensors of Smart Devices in the Internet of Everything (IoE) Era: Big Opportunities and Massive Doubts

“…In [163], the authors have shown that smart device privacy is complicated since it consists of different layers of hardware, operating system, and apps. Another layer of the sensor data mining process is added over this layered stack.…”