Understanding and Capturing People's Mobile App Privacy Preferences
PhD Thesis
October 2013
Users are increasingly expected to manage a wide range of security and privacy settings. An important example of this trend is the variety of users might be called upon to review permissions when they download mobile apps. Experiments have shown that most users struggle with reviewing these permissions. Earlier research efforts in this area have primarily focused on protecting users’ privacy and security through the development of analysis tools and extensions intended to further increase the level of control provided to users with little regard for human factor considerations. This thesis aims to address this gap through the study of user mobile app privacy preferences with the dual objective of both simplifying and enhancing mobile app privacy decision interfaces. Specifically, we combine static code analysis, crowdsourcing and machine learning techniques to elicit people’s mobile app privacy preferences. We show how the resulting preference models can inform the design of interfaces that offer the promise of alleviating user burden when it comes to reviewing the permissions requested by mobile apps. Our contribution is threefold. First, we provide the first large-scale, in-depth analysis of mobile app data collection and usage practices as found in the Google Play app store. This includes an analysis of over 100,000 Android apps, the permissions they request and the different types of third parties with which they share information. Second, we introduce a crowdsourcing methodology to collect people’s privacy preferences when it comes to granting permissions to mobile apps for different purposes (e.g. for internal purpose, for sharing with advertising networks) and use the results to develop new mobile app privacy decision interfaces. Third, by using machine learning techniques to analyze privacy preferences from over 700 smartphone users, we show that, while these preferences are diverse, a relatively small number of privacy profiles can go a long way in simplifying the number of decisions users have to make. This last contribution offers the promise of alleviating user burden and ultimately increasing their control over their information. This thesis provides an important scientific basis for starting to reconcile mobile privacy and usability and, in particular, helping inform the design of more usable privacy interfaces and settings.
