Styx: Design and Evaluation of a New Privacy Risk Communication Method for Smartphones

Abstract

Abstract. Modern smartphone platforms are highly privacy-affecting but not effective in properly communicating their privacy impacts to its users. Particularly, actual data-access behavior of apps is not considered in current privacy risk communication approaches. We argue that factors such as frequency of access to sensitive information is significantly affecting the privacy-invasiveness of applications. We introduce Styx, a novel privacy risk communication system that provides the user with more meaningful privacy information based on the actual behavior of apps. In a proof-of-concept study we evaluate the effectiveness of Styx. Our results show that more meaningful privacy warnings can increase user trust into smartphone platforms and also reduce privacy concerns.

On the Trade-Off Between Privacy and Utility in Mobile Services: A Qualitative Study

“…Various privacy-preserving technologies, with examples including permission management tools [13,10], app analysing tools [2,26] and privacy-preserving frameworks in specific fields [27,17], have been proposed to help people decrease their privacy risks when using mobile devices. While the theoretical advantages of such privacy-preserving technologies are clear, little adoption has been observed in practice [4].…”

E-government

“…In this respect, quantifying privacy risks also plays an important role in raising user awareness and designing fitting data protection regulations. Moreover, privacy risk communication paradigms should also be incorporated into the solution design [6]. However, despite its importance, previous research in privacy risk quantification has not fully considered the user's heterogeneously subjective perceptions on privacy, and her right to informational self determination since, often, the privacy risk analysis and prevention (usually by applying anonymisation techniques) takes place once the data is out of her control.…”

“…1, 3, 7), and 12,13,14,21,25,26,27,28,30,31) or/with an open part, where respondents were asked to choose their degree of agreement or disagreement, filling -if exists -the answer of their choice (q. 6,10,11,15,16,20).…”

“…Similar to our approach, their main goal is to enable users to perform informed decisions with respect to their privacy and personal information disclosure. Yet, many of those approaches such as [29], [6] and [31] have focused on monitoring accesses and permissions requested by mobile applications; however, little attention has been given to the information sharing habits from users. Privacy risk communication was also identified as an important challenge by Bal et al [6].…”

“…Yet, many of those approaches such as [29], [6] and [31] have focused on monitoring accesses and permissions requested by mobile applications; however, little attention has been given to the information sharing habits from users. Privacy risk communication was also identified as an important challenge by Bal et al [6]. Authors proposed to graphically communicate to users about benefits and consequences when allowing mobile applications to access device information.…”