Spiny CACTOS: OSN Users Attitudes and Perceptions Towards Cryptographic Access Control Tools

Abstract

Abstract-Cryptographic access control tools for online social networks (CACTOS) allow users to enforce their privacy settings online without relying on the social network provider or any other third party. Many such tools have been proposed in the literature, some of them implemented and currently publicly available, and yet they have seen poor or no adoption at all. In this paper we investigate which obstacles may be hindering the adoption of these tools. To this end, we perform a user study to inquire users about key issues related to the desirability and general perception of CACTOS. Our results suggest that, even if social network users would be potentially interested in these tools, several issues would effectively obstruct their adoption. Participants in our study perceived that CACTOS are a disproportionate means to protect their privacy online. This in turn may have been motivated by the explicit use of cryptography or the fact that users do not actually share on social networks the type of information they would feel the need to encrypt. Moreover, in this paper we point out to several key elements that are to be considered for the improvement and better usability of CACTOS.

On the Difficult Tradeoff Between Security and Privacy: Challenges for the Management of Digital Identities

“…On this point, we have to bear in mind that the low users' acceptance of encryption [38] is even worse when considering the broader spectrum of PET [30]. Therefore, it is highly advisable to acknowledge and learn from recent contributions on creating usable authentication procedures [24] and enforcing privacy settings online [5]. In fact, this last concern is of paramount importance in online services, since the related providers collect and manage PII whereas the user generally has only partial knowledge about the proper and legitimate use of his or her data [28].…”

Untitled

“…Unfortunately this feature does not help with the confidentiality of communications once access to the account is gained or if messages are accessed through the account of one of the other correspondents engaged in conversation. To guarantee confidentiality of the messages themselves, users may turn to the use of Cryptography-Based Access Control Tools (Balsa, Brandimarte, Acquisti, Diaz and Gürses, 2014). The use of such tools can enable a user to take back some control over the level of confidentiality of their content, to the extent that a platform like Facebook, or potential opponent who gains access to a Facebook account, would no longer have the ability to read one user's messages to another.…”

Enabling privacy-preserving SNS communications by design

“…This is very important considering the diversity of existing PETs, fulfilling partial privacy requirements, thus requiring the user to apply several tools for protection (Vemou and Karyda, 2013). Also, impact on performance of everyday SNS operations is important, as users wish to protect privacy without experiencing low latency of the service (Balsa et al, 2014).…”

“…For instance, users of Safe secure and private Facebook messages need to manage encryption keys, whereas to use MyPermissions one needs to be familiar with managing browser extensions. As requirements for technical expertise can discourage users from employing PETs, Balsa et. al.…”

“…Although users' concerns over privacy are rising (Acquisti and Gross, 2006;Karyda and Kokolakis, 2008;Boyd and Hargittai, 2010;Pavlou, 2011), they seem to neglect PETs embedded in SNS platforms (Boyd and Hargittai 2010;Madejskiy et al, 2011;Balsa et al, 2014), while diffusion of other PETs has been reported as low (London Economics 2010;ENISA 2012). This has been attributed to users' low awareness of privacy risks by certain privacy-threatening aspects of the services they are using (e.g.…”