With the advent of GPS-enabled smartphones, location-sharing services (LSSs) have emerged that share data collected through those mobile devices. However, research has shown that many users are uncomfortable with LSS operators managing their location histories, and that the ease with which contextual data can be shared with unintended audiences can lead to regrets that sometimes outweigh the benefits of these systems. In an effort to address these issues, we have developed SLS: a secure location sharing system that combines location-limited channels, multi-channel key establishment, and untrusted cloud storage to hide user locations from LSS operators while also limiting unintended audience sharing. In addition to describing the key agreement and locationsharing protocols used by the architecture, we discuss an iOS implementation of SLS that enables location sharing at tunable granularity through an intuitive policy interface on the user's mobile device. [6,8,21,22,28,29,35] and in practice [12,15,18, 20] her geographic location with her social contacts either as a first-class data object or as support for other content (e.g., attaching one's location to restaurant review). This sharing can be done in a near seamless manner, particularly when the LSS is embedded within a larger social platform.Despite their popularity, LSSs are not without their own security and privacy problems. By their very design, these systems have the implicit shortcoming that sharing one's location with social contacts requires sharing this location with the LSS operator as well. This can lead to undesirable profiling of users by third parties, or increase users' exposure risk in the event of an LSS compromise. In addition, it is has been shown that social networks in general [36] and LSSs in particular [29] can sometimes lead to situations in which users experience regrets after (over)sharing information. This is often the result of the so-called unintended audience problem, in which data is shared with individuals other than those with whom the subject intended to share.This may manifest as a result of a location being automatically attached to content posted on a social network, accidental sharing of a location with a user's entire set of contacts instead of a restricted subset, or posting a location that contradicts other statements made by the user [29].The latter problem is symptomatic of both LSS and access control complexity. For instance, it is well-known that users' social networks have many more contacts than they interact with on a day-to-day basis: a 2011 poll of 1,954 British citizens found that the average person had 476 1 Facebook friends, but only 152 contacts in their cellular phone [38]. Furthermore, research studies have shown that users frequently make mistakes when authoring even basic access control policies in commodity systems [5,11,30]. As such, it is clear that accidents and misconfigurations can lead to over-sharing in large social networks. On the other hand, the problem of required sharing with LSS operator...