Permission vs. App Limiters: Profiling Smartphone Users to Understand Differing Strategies for Mobile Privacy Management

Authors : Ashwaq Alsoubai , Reza Ghaiumy Anaraky , Yao Li , Xinru Page , Bart Knijnenburg , Pamela J. Wisniewski Authors Info & Claims

Article No.: 406, Pages 1 - 18 Published : 29 April 2022 Publication History 8 citation 465 Downloads Total Citations 8 Total Downloads 465 Last 12 Months 115 Last 6 weeks 9 Get Citation Alerts

New Citation Alert added!

This alert has been successfully added and will be sent to: You will be notified whenever a record that you have chosen has been cited.

To manage your alert preferences, click on the button below. Manage my Alerts

New Citation Alert!

Abstract

We conducted a user study with 380 Android users, profiling them according to two key privacy behaviors: the number of apps installed and the Dangerous permissions granted to those apps. We identified four unique privacy profiles: 1) Privacy Balancers (49.74% of participants), 2) Permission Limiters (28.68%), 3) App Limiters (14.74%), and 4) the Privacy Unconcerned (6.84%). App and Permission Limiters were significantly more concerned about perceived surveillance than Privacy Balancers and the Privacy Unconcerned. App Limiters had the lowest number of apps installed on their devices with the lowest intention of using apps and sharing information with them, compared to Permission Limiters who had the highest number of apps installed and reported higher intention to share information with apps. The four profiles reflect the differing privacy management strategies, perceptions, and intentions of Android users that go beyond the binary decision to share or withhold information via mobile apps.

Supplementary Material

MP4 File (3491102.3517652-talk-video.mp4) Talk Video

References

Icek Ajzen. 1991. The theory of planned behavior. Organizational behavior and human decision processes 50, 2 (1991), 179–211.

Hazim Almuhimedi, Florian Schaub, Norman Sadeh, Idris Adjerid, Alessandro Acquisti, Joshua Gluck, Lorrie Faith Cranor, and Yuvraj Agarwal. 2015. Your location has been shared 5,398 times! A field study on mobile app privacy nudging. In Proceedings of the 33rd annual ACM conference on human factors in computing systems. ACM, Seoul, Korea, 787–796.

Rawan Baalous and Ronald Poet. 2018. How Dangerous Permissions are Described in Android Apps’ Privacy Policies?. In Proceedings of the 11th International Conference on Security of Information and Networks. ACM, New York, United States, 1–2.

Paritosh Bahirat, Yangyang He, Abhilash Menon, and Bart Knijnenburg. 2018. A Data-Driven Approach to Developing IoT Privacy-Setting Interfaces. In 23rd International Conference on Intelligent User Interfaces(IUI ’18). ACM, New York, NY, USA, 165–176. https://doi.org/10.1145/3172944.3172982

Susanne Barth and Menno DT De Jong. 2017. The privacy paradox–Investigating discrepancies between expressed privacy concerns and actual online behavior–A systematic literature review. Telematics and informatics 34, 7 (2017), 1038–1058.

Susanne Barth, Menno DT de Jong, Marianne Junger, Pieter H Hartel, and Janina C Roppelt. 2019. Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial resources. Telematics and informatics 41 (2019), 55–69.

Bram Bonné, Sai Teja Peddinti, Igor Bilogrevic, and Nina Taft. 2017. Exploring decision making with Android’s runtime permission dialogs using in-context surveys. In Thirteenth Symposium on Usable Privacy and Security ( 2017). ACM, Santa Clara, CA, USA, 195–210.

Christoph Buck, Chris Horbel, Tim Kessler, and Claas Christian. 2014. Mobile consumer apps: Big data brother is watching you. Marketing Review St. Gallen 31, 1 (2014), 26–35.

Martin J Burnham, Yen K Le, and Ralph L Piedmont. 2018. Who is Mturk? Personal characteristics and sample consistency of these online workers. Mental Health, Religion & Culture 21, 9-10 (2018), 934–944.

Paolo Calciati, Konstantin Kuznetsov, Alessandra Gorla, and Andreas Zeller. 2020. Automatically Granted Permissions in Android apps: An Empirical Study on their Prevalence and on the Potential Threats for Privacy. In Proceedings of the 17th International Conference on Mining Software Repositories. ACM, Seoul, Korea, 114–124.

Weicheng Cao, Chunqiu Xia, Sai Teja Peddinti, David Lie, Nina Taft, and Lisa M. Austin. 2021. A Large Scale Study of User Behavior, Expectations and Engagement with Android Permissions. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Virtual, 803–820. https://www.usenix.org/conference/usenixsecurity21/presentation/cao-weicheng

Pew Research Center. 2016. Americans increasingly use smartphones for more than voice calls, texting. https://www.pewresearch.org/internet/ft_01-27-16_smartphoneactivities_640/

Pew Research Center. 2021. Demographics of Mobile Device Ownership and Adoption in the United States.https://www.pewresearch.org/internet/fact- sheet/mobile/. Retrieved May 9, 2021.

Saksham Chitkara, Nishad Gothoskar, Suhas Harish, Jason I Hong, and Yuvraj Agarwal. 2017. Does this app really need my location? Context-aware privacy management for smartphones. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 1, 3 (2017), 1–22.

Eunseong Cho and Seonghoon Kim. 2015. Cronbach’s coefficient alpha: Well known but poorly understood. Organizational research methods 18, 2 (2015), 207–230.

Chhaya Chouhan, Christy M LaPerriere, Zaina Aljallad, Jess Kropczynski, Heather Lipford, and Pamela J Wisniewski. 2019. Co-designing for community oversight: Helping people make privacy and security decisions together. Proceedings of the ACM on Human-Computer Interaction 3, CSCW(2019), 1–31.

Lee J Cronbach and Paul E Meehl. 1955. Construct validity in psychological tests.Psychological bulletin 52, 4 (1955), 281.

Prajit Kumar Das, Anupam Joshi, and Tim Finin. 2017. Personalizing context-aware access control on mobile platforms. In 2017 IEEE 3rd International Conference on Collaboration and Internet Computing (CIC). IEEE, IEEE, San Jose, CA, USA, 107–116.

Larry Dignan. 2011. Google’s Android wears big bullseye for mobile malware. https://www.zdnet.com/article/googles-android-wears-big-bullseye-for-mobile-malware/

Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vigna. 2011. PiOS: Detecting Privacy Leaks in iOS Applications. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, 6th February - 9th February 2011. The Internet Society, San Diego, California, USA, 15. https://www.ndss-symposium.org/ndss2011/pios-detecting-privacy-leaks-ios-applications-paper

Serge Egelman, Adrienne Porter Felt, and David Wagner. 2013. Choice architecture and smartphone privacy: There’sa price for that. Springer, Germany. 211–236 pages.

Leandre R Fabrigar and Duane T Wegener. 2011. Exploratory factor analysis. Oxford University Press, England.

Zheran Fang, Weili Han, and Yingjiu Li. 2014. Permission based Android security: Issues and countermeasures. computers & security 43(2014), 205–218.

Johannes Feichtner and Stefan Gruber. 2020. Understanding privacy awareness in android app descriptions using deep learning. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy. ACM, New Orleans, LA, USA, 203–214.

Adrienne Porter Felt, Elizabeth Ha, Serge Egelman, Ariel Haney, Erika Chin, and David Wagner. 2012. Android permissions: User attention, comprehension, and behavior. In Proceedings of the eighth symposium on usable privacy and security. ACM, Washington, D.C., 1–14.

Nina Gerber, Paul Gerber, and Melanie Volkamer. 2018. Explaining the privacy paradox: A systematic review of literature investigating privacy attitude and behavior. Computers & security 77(2018), 226–261.

Reza Ghaiumy Anaraky, Kaileigh Angela Byrne, Pamela J Wisniewski, Xinru Page, and Bart Knijnenburg. 2021. To Disclose or Not to Disclose: Examining the Privacy Decision-Making Processes of Older vs. Younger Adults. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. ACM, Virtual, 1–14.

Google. 2021. Google and Open Handset Alliance. n.d. Android API Guide.https://developer.android.com/guide/topics/permissions/overview#dangerous_permissions. Retrieved Feb 21, 2021.

Google. 2022. Android Developers. https://developer.android.com/guide/topics/manifest/manifest-element

L Harris, AF Westin, 2003. Consumer Privacy Attitudes: A Major Shift Since 2000 and Why.

Yangyang He, Paritosh Bahirat, Bart P. Knijnenburg, and Abhilash Menon. 2019. A Data-Driven Approach to Designing for Privacy in Household IoT. ACM Trans. Interact. Intell. Syst. 10, 1 (Sept. 2019), 10:1–10:47. https://doi.org/10.1145/3241378

Patrick Gage Kelley, Sunny Consolvo, Lorrie Faith Cranor, Jaeyeon Jung, Norman Sadeh, and David Wetherall. 2012. A conundrum of permissions: installing applications on an android smartphone. In International conference on financial cryptography and data security. Springer, Kralendijk, Caribbean Netherlands, 68–79.

Asma Khatoon and Peter Corcoran. 2017. Android permission system and user privacy—a review of concept and approaches. In 2017 IEEE 7th International Conference on Consumer Electronics-Berlin (ICCE-Berlin). IEEE, Berlin, 153–158.

Jennifer King, Airi Lampinen, and Alex Smolen. 2011. Privacy: Is there an app for that?. In Proceedings of the Seventh Symposium on Usable Privacy and Security. ACM, Pittsburgh, Pennsylvania, USA, 1–20.

Bart P Knijnenburg, Alfred Kobsa, and Hongxia Jin. 2013. Dimensionality of information disclosure behavior. International Journal of Human-Computer Studies 71, 12 (2013), 1144–1162.

Spyros Kokolakis. 2017. Privacy attitudes and privacy behaviour: A review of current research on the privacy paradox phenomenon. Computers & security 64(2017), 122–134.

Robert S Laufer and Maxine Wolfe. 1977. Privacy as a concept and a social issue: A multidimensional developmental theory. Journal of social Issues 33, 3 (1977), 22–42.

Christian Fernando Libaque-Sáenz, Siew Fan Wong, Younghoon Chang, and Edgardo R Bravo. 2021. The effect of fair information practices and data collection methods on privacy-related behaviors: a study of Mobile apps. Information & Management 58, 1 (2021), 103284.

Jialiu Lin, Bin Liu, Norman Sadeh, and Jason I Hong. 2014. Modeling users’ mobile app privacy preferences: Restoring usability in a sea of permission settings. In 10th Symposium On Usable Privacy and Security ( 2014). Usenix, Menlo Park, California, 199–212.

Bin Liu, Mads Schaarup Andersen, Florian Schaub, Hazim Almuhimedi, Shikun Aerin Zhang, Norman Sadeh, Yuvraj Agarwal, and Alessandro Acquisti. 2016. Follow my recommendations: A personalized privacy assistant for mobile app permissions. In Twelfth Symposium on Usable Privacy and Security ( 2016). usenix, Denver, Colorado, USA, 27–41.

Bin Liu, Jialiu Lin, and Norman Sadeh. 2014. Reconciling mobile app privacy and usability on smartphones: Could user privacy profiles help?. In Proceedings of the 23rd international conference on World wide web. ACM, Seoul, Republic of Korea, 201–212.

Gitta H Lubke and Bengt Muthén. 2005. Investigating population heterogeneity with factor mixture models.Psychological methods 10, 1 (2005), 21.

Christoph Lutz and Pepe Strathoff. 2014. Privacy concerns and online behavior–Not so paradoxical after all? Viewing the privacy paradox through different theoretical lenses. Viewing the Privacy Paradox Through Different Theoretical Lenses (April 15, 2014) 4(2014), 81–99.

Mary Madden, Lee Rainie, Kathryn Zickuhr, Maeve Duggan, and Aaron Smith. 2014. Public perceptions of privacy and security in the post-Snowden era.

Naresh K Malhotra, Sung S Kim, and James Agarwal. 2004. Internet users’ information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information systems research 15, 4 (2004), 336–355.

Karl Moder. 2010. Alternatives to F-test in one way ANOVA in case of heterogeneity of variances (a simulation study). Psychological Test and Assessment Modeling 52, 4 (2010), 343–353.

Bengt Muthén and Bengt O Muthén. 2009. Statistical analysis with latent variables. Wiley, New York, NY.

Moses Namara, Reza Ghaiumy Anaraky, Pamela Wisniewski, Xinru Page, and Bart P Knijnenburg. 2021. Examining Power Use and the Privacy Paradox between Intention vs. Actual Use of Mobile Applications. In European Symposium on Usable Security 2021. ACM, Virtual, 223–235.

Karen L Nylund, Tihomir Asparouhov, and Bengt O Muthén. 2007. Deciding on the number of classes in latent class analysis and growth mixture modeling: A Monte Carlo simulation study. Structural equation modeling: A multidisciplinary Journal 14, 4(2007), 535–569.