Information about the privacy and security of Internet of Things (IoT) devices is not readily available to consumers
who want to consider it before making purchase decisions. While
legislators have proposed adding succinct, consumer accessible,
labels, they do not provide guidance on the content of these
labels. In this paper, we report on the results of a series of
interviews and surveys with privacy and security experts, as well
as consumers, where we explore and test the design space of
the content to include on an IoT privacy and security label. We
conduct an expert elicitation study by following a three-round
Delphi process with 22 privacy and security experts to identify the
factors that experts believed are important for consumers when
comparing the privacy and security of IoT devices to inform
their purchase decisions. Based on how critical experts believed
each factor is in conveying risk to consumers, we distributed
these factors across two layers—a primary layer to display on
the product package itself or prominently on a website, and a
secondary layer available online through a web link or a QR
code. We report on the experts’ rationale and arguments used to
support their choice of factors. Moreover, to study how consumers
would perceive the privacy and security information specified by
experts, we conducted a series of semi-structured interviews with
15 participants, who had purchased at least one IoT device (smart
home device or wearable). Based on the results of our expert
elicitation and consumer studies, we propose a prototype privacy
and security label to help consumers make more informed IoTrelated purchase decisions.
more »
« less
Designing a Mobile Application to Support Social Processes for Privacy
People often rely on their friends, family, and other loved ones to help them make decisions about digital privacy and security. However, these social processes are rarely supported by technology. To address this gap, we developed an Android-based mobile application ("app") prototype which helps individuals collaborate with people they know to make informed decisions about their app privacy permissions. To evaluate our design, we conducted an interview study with 10 college students while they interacted with our prototype. Overall, participants responded positively to the novel idea of using social collaboration as a means for making better privacy decisions. Yet, we also found that users are less inclined to help others and may be only willing to partake in conversations that directly affect themselves. We discuss the potential for embedding social processes in the design of systems that support privacy decision-making, as well as some of the challenges of this approach.
more »
« less
- Award ID(s):
- 1814439
- NSF-PAR ID:
- 10097722
- Date Published:
- Journal Name:
- The 2019 NDSS Workshop on Usable Security and Privacy (USEC 2019
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Research exploring how to support decision-making has often used machine learning to automate or assist human decisions. We take an alternative approach for improving decision-making, using machine learning to help stakeholders surface ways to improve and make fairer decision-making processes. We created "Deliberating with AI", a web tool that enables people to create and evaluate ML models in order to examine strengths and shortcomings of past decision-making and deliberate on how to improve future decisions. We apply this tool to a context of people selection, having stakeholders---decision makers (faculty) and decision subjects (students)---use the tool to improve graduate school admission decisions. Through our case study, we demonstrate how the stakeholders used the web tool to create ML models that they used as boundary objects to deliberate over organization decision-making practices. We share insights from our study to inform future research on stakeholder-centered participatory AI design and technology for organizational decision-making.more » « less
-
more » « less
Abstract The objective of this study is to investigate students’ decision-making during the information gathering activities of a design process. Existing literature in engineering education has shown that students face difficulties while gathering information in various activities of a design process such as brainstorming and CAD modeling. Decision-making is an important aspect of these activities. While gathering information, students make several decisions such as what information to acquire and how to acquire that information. There lies a research gap in understanding how students make decisions while gathering information in a product design process. To address this gap, we conduct semi-structured interviews and surveys in a product design course. We analyze the students’ decision-making activities from the lens of a sequential information acquisition and decision-making (SIADM) framework. We find that the students recognize the need to acquire information about the physics and dynamics of their design artifact during the CAD modeling activity of the product design process. However, they do not acquire such information from their CAD models primarily due to the lack of the project requirements, their ability, and the time to do so. Instead, they acquire such information from the prototyping activity as their physical prototype does not satisfy their design objectives. However, the students do not get the opportunity to iterate their prototype with the given cost and time constraints. Consequently, they rely on improvising during prototyping. Based on our observations, we discuss the need for designing course project activities such that it facilitates students’ product design decisions.
-
Users face various privacy risks in smart homes, yet there are limited ways for them to learn about the details of such risks, such as the data practices of smart home devices and their data flow. In this paper, we present Privacy Plumber, a system that enables a user to inspect and explore the privacy "leaks" in their home using an augmented reality tool. Privacy Plumber allows the user to learn and understand the volume of data leaving the home and how that data may affect a user's privacy -- in the same physical context as the devices in question, because we visualize the privacy leaks with augmented reality. Privacy Plumber uses ARP spoofing to gather aggregate network traffic information and presents it through an overlay on top of the device in an smartphone app. The increased transparency aims to help the user make privacy decisions and mend potential privacy leaks, such as instruct Privacy Plumber on what devices to block, on what schedule (i.e., turn off Alexa when sleeping), etc. Our initial user study with six participants demonstrates participants' increased awareness of privacy leaks in smart devices, which further contributes to their privacy decisions (e.g., which devices to block).more » « less
-
In-app privacy notices can help smartphone users make informed privacy decisions. However, they are rarely used in real-world apps, since developers often lack the knowledge, time, and resources to design and implement them well. We present Honeysuckle, a programming tool that helps Android developers build in-app privacy notices using an annotation-based code generation approach facilitated by an IDE plugin, a build system plugin, and a library. We conducted a within-subjects study with 12 Android developers to evaluate Honeysuckle. Each participant was asked to implement privacy notices for two popular open-source apps using the Honeysuckle library as a baseline as well as the annotation-based approach. Our results show that the annotation-based approach helps developers accomplish the task faster with significantly lower cognitive load. Developers preferred the annotation-based approach over the library approach because it was much easier to learn and use and allowed developers to achieve various types of privacy notices using a unified code format, which can enhance code readability and benefit team collaboration.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- The DOI is not currently available.
