The Feasibility of Dynamically Granted Permissions: Aligning Mobile Privacy with User Preferences

Abstract

Abstract-Current smartphone operating systems regulate application permissions by prompting users on an ask-on-first-use basis. Prior research has shown that this method is ineffective because it fails to account for context: the circumstances under which an application first requests access to data may be vastly different than the circumstances under which it subsequently requests access. We performed a longitudinal 131-person field study to analyze the contextuality behind user privacy decisions to regulate access to sensitive resources. We built a classifier to make privacy decisions on the user's behalf by detecting when context has changed and, when necessary, inferring privacy preferences based on the user's past decisions and behavior. Our goal is to automatically grant appropriate resource requests without further user intervention, deny inappropriate requests, and only prompt the user when the system is uncertain of the user's preferences. We show that our approach can accurately predict users' privacy decisions 96.8% of the time, which is a four-fold reduction in error rate compared to current systems.

An Experience Sampling Study of User Reactions to Browser Warnings in the Field

“…Carrascal et al prompted study participants about the value that they placed on personal information that they had recently transmitted to various websites [11]. Others have used ESM prompts to gather participants' reactions to different types of location-sharing requests [6,16,35], as well as to examine participants' willingness to share information with smartphone apps [14,38,46], and users' decisions to use various security mechanisms on their mobile devices [26].…”

Keeping Context In Mind: Automating Mobile App Access Control with User Interface Inspection

“…We argue that sensitive services should not exist unless they provide sufficient foreground clues to indicate their purposes. Users tend to reject requests without foreground as suggested by three recent user studies [25], [26], [18]. Indeed, the recent updates of Android further restrict background services [12].…”

“…For instance, one user allowed a request from a product rating page but rejected another with a closely related context. One possible explanation is that sometimes users are less cautious and make random decisions as suggested in [26]. Fortunately, our system can greatly help protect users from malicious behaviors caused by malware even if users make random decisions, since our generic model has already learned many misbehaviors in offline training.…”

“…Ideally, a permission system should be able to identify suspicious permission requests on the fly and automatically by taking user preferences into account and notify users only when necessary. As shown in several user studies [25], [26], [18], it is crucial to consider the context pertinent to sensitive permission requests. Moreover, a user's preference is strongly correlated with the foreground app and the visibility of the permission requesting app (i.e., whether the app is currently visible to the user).…”

“…However, such a one-size-fits-all model is not always sufficient. In practice, different users may have very different preferences on the same permission request even in a similar context [26], [18]. Therefore, COSMOS then incrementally trains the generic model on each device with its user's privacy decisions made over time.…”