A Data-Driven Approach to Developing IoT Privacy-Setting Interfaces

ABSTRACT

User testing is often used to inform the development of user interfaces (UIs). But what if an interface needs to be developed for a system that does not yet exist? In that case, existing datasets can provide valuable input for UI development. We apply a data-driven approach to the development of a privacy-setting interface for Internet-of-Things (IoT) devices. Applying machine learning techniques to an existing dataset of users' sharing preferences in IoT scenarios, we develop a set of "smart" default profiles. Our resulting interface asks users to choose among these profiles, which capture their preferences with an accuracy of 82%---a 14% improvement over a naive default setting and a 12% improvement over a single smart default setting for all users.

References

1. Acquisti, A., and Gross, R. Imagined communities: Awareness, information sharing, and privacy on the facebook. In International workshop on privacy enhancing technologies (2006), Springer, pp. 36--58.
2. Ajzen, I., and Fishbein, M. Attitude-behavior relations: A theoretical analysis and review of empirical research. Psychological bulletin 84, 5 (1977).
3. Baron, R. M., and Kenny, D. A. The moderator--mediator variable distinction in social psychological research: Conceptual, strategic, and statistical considerations. Journal of personality and social psychology 51, 6 (1986), 1173.
4. Boyles, J. L., Smith, A., and Madden, M. Privacy and Data Management on Mobile Devices. Tech. rep., Pew Internet & American Life Project, 2012.
5. Chow, R., Egelman, S., Kannavara, R., Lee, H., Misra, S., and Wang, E. HCI in Business: A Collaboration with Academia in IoT Privacy. In HCI in Business, F. F.-H. Nah and C.-H. Tan, Eds., no. 9191 in Lecture Notes in Computer Science. Springer International Publishing, 2015.
6. Dong, C., Jin, H., and Knijnenburg, B. P. Ppm: A privacy prediction model for online social networks. In International Conference on Social Informatics (2016), Springer, pp. 400--420.
7. Fang, L., and LeFevre, K. Privacy wizards for social networking sites. In Proceedings of the 19th international conference on World wide web (2010), ACM, pp. 351--360.
8. Good, N., Dhamija, R., Grossklags, J., Thaw, D., Aronowitz, S., Mulligan, D., and Konstan, J. Stopping Spyware at the Gate: A User Study of Privacy, Notice and Spyware. In Proceedings of the 2005 Symposium on Usable Privacy and Security (2005), ACM, pp. 43--52.
9. Gross, R., and Acquisti, A. Information revelation and privacy in online social networks. In Proceedings of the 2005 ACM workshop on Privacy in the electronic society (2005), ACM, pp. 71--80.
10. Gubbi, J., Buyya, R., Marusic, S., and Palaniswami, M. Internet of things (iot): A vision, architectural elements, and future directions. Future generation computer systems 29, 7 (2013), 1645--1660.
11. Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., and Witten, I. H. The weka data mining software: an update. ACM SIGKDD explorations newsletter 11, 1 (2009), 10--18.
12. Jensen, C., and Potts, C. Privacy Policies as Decision-Making Tools: An Evaluation of Online Privacy Notices. In 2004 Conference on Human Factors in Computing Systems (2004), pp. 471--478.
13. Knijnenburg, B. P. A user-tailored approach to privacy decision support. Ph.D. Thesis, University of California, Irvine, Irvine, CA, 2015.
14. Knijnenburg, B. P., Kobsa, A., and Jin, H. Dimensionality of information disclosure behavior. International Journal of Human-Computer Studies 71, 12 (2013), 1144--1162.
15. Lederer, S., Mankoff, J., and Dey, A. K. Who wants to know what when - privacy preference determinants in ubiquitous computing. In CHI'03 extended abstracts on Human factors in computing systems (2003), ACM, pp. 724--725.
16. Lee, H., and Kobsa, A. Understanding user privacy in internet of things environments. Internet of Things (WF-IoT) (2016).
17. Li, Y., Kobsa, A., Knijnenburg, B. P., and Nguyen, M. C. Cross-cultural privacy prediction. Proceedings on Privacy Enhancing Technologies 2 (2017), 93--112.
18. Liu, B., Andersen, M. S., Schaub, F., Almuhimedi, H., Zhang, S. A., Sadeh, N., Agarwal, Y., and Acquisti, A. Follow My Recommendations: A Personalized Privacy Assistant for Mobile App Permissions. In Proceedings of the 2016 Symposium on Usable Privacy and Security (2016).
19. Madejski, M., Johnson, M., and Bellovin, S. M. A study of privacy settings errors in an online social network. In IEEE International Conference on Pervasive Computing and Communications Workshops (2012), IEEE, pp. 340--345.
20. Olson, J. S., Grudin, J., and Horvitz, E. A study of preferences for sharing and privacy. In CHI'05 extended abstracts on Human factors in computing systems (2005), ACM, pp. 1985--1988.
21. Pallapa, G., Das, S. K., Di Francesco, M., and Aura, T. Adaptive and context-aware privacy preservation exploiting user interactions in smart environments. Pervasive and Mobile Computing 12 (2014), 232--243.
22. Raber, F., Luca, A. D., and Graus, M. Privacy wedges: Area-based audience selection for social network posts. In Proceedings of the 2016 Symposium on Usable Privacy and Security (2016).
23. Ravichandran, R., Benisch, M., Kelley, P. G., and Sadeh, N. M. Capturing social networking privacy preferences. In Proceedings of the 2009 Symposium on Usable Privacy and Security (2009), Springer, pp. 1--18.
24. Sadeh, N., Hong, J., Cranor, L., Fette, I., Kelley, P., Prabaker, M., and Rao, J. Understanding and capturing people's privacy policies in a mobile social networking application. Personal and Ubiquitous Computing 13, 6 (2009), 401--412.
25. Sandhu, R. S., and Samarati, P. Access control: principle and practice. IEEE Communications Magazine 32, 9 (1994), 40--48.
26. Smith, N. C., Goldstein, D. G., and Johnson, E. J. Choice Without Awareness: Ethical and Policy Implications of Defaults. Journal of Public Policy & Marketing 32, 2 (2013), 159--172.
27. Watson, J., Besmer, A., and Lipford, H. R.
28. Your circles: sharing behavior on Google+. In Proceedings of the 8th Symposium on Usable Privacy and Security (2012), ACM, pp. 12:1--12:10.
29. Williams, M., Nurse, J. R., and Creese, S. The perfect storm: The privacy paradox and the internet-of-things. In Availability, Reliability and Security (ARES), 2016 11th International Conference on (2016), IEEE, pp. 644--652.
30. Wisniewski, P. J., Knijnenburg, B. P., and Lipford, H. R. Making privacy personal: Profiling social network users to inform privacy education and nudging. International Journal of Human-Computer Studies 98 (2017), 95--108.

Index Terms

• Human-centered computing

  • Human computer interaction (HCI)

    • HCI theory, concepts and models

  • Interaction design

    • Interaction design process and methods

      • User interface design

• Security and privacy

  • Human and societal aspects of security and privacy

    • Usability in security and privacy