Current smartphone platforms provide ways for users to control access to information about their location. For instance, on the iPhone, when an application requests access to location information, the operating system...
详细信息
ISBN:
(纸本)9781450316668
Current smartphone platforms provide ways for users to control access to information about their location. For instance, on the iPhone, when an application requests access to location information, the operating system asks the user whether to grant location access to this application. In this paper, we study how users are using these controls. Do iPhone users allow applications to access their location? Do their decisions differ from application to application? Can we predict how a user will respond for a particular application, given their past responses for other applications? We gather data from iPhone users that sheds new light on these questions. Our results indicate that there are different classes of users: some deny all applications access to their location, some allow all applications access to their location, and some selectively permit a fraction of their applications to access their location. We also find that apps can be separated into different classes by what fraction of users trust the app with their location data. Finally, we investigate using machine learning techniques to predict users' location-sharing decisions;we find that we are sometimes able to predict the user's actual choice, though there is considerable room for improvement. If it is possible to improve the accuracy rate further, this information could be used to relieve users of the cognitive burden of individually assigning location permissions for each application, allowing users to focus their attention on more critical matters.
Online social networks (OSNs) such as Facebook and Google+ have transformed the way our society communicates. However, this success has come at the cost of user privacy;in today's OSNs, users are not in control of...
详细信息
We provide a detailed analysis of two largely unexplored aspects of the security decisions made by the Android op-erating system during the app installation process: update integrity and UID assignment. To inform our ...
详细信息
ISBN:
(纸本)9781450316668
We provide a detailed analysis of two largely unexplored aspects of the security decisions made by the Android op-erating system during the app installation process: update integrity and UID assignment. To inform our analysis, we collect a dataset of Android application metadata and ex-tract features from these binaries to gain a better under-standing of how developers interact with the security mech-anisms invoked during installation. Using the dataset, we find empirical evidence that Android's current signing ar-chitecture does not encourage best security practices. We also find that limitations of Android's UID sharing method force developers to write custom code rather than rely on OS-level mechanisms for secure data transfer between apps. As a result of our analysis, we recommend incrementally de-ployable improvements, including a novel UID sharing mech-anism with applicability to signature-level permissions. We additionally discuss mitigation options for a security bug in Google's Play store, which allows apps to transparently obtain more privileges than those requested in the manifest.
The proceedings contain 27 papers. The topics discussed include: distributed data usage control for web applications: a social network implementation;MyABDAC: compiling XacmL policies for attribute-based database acce...
ISBN:
(纸本)9781450304665
The proceedings contain 27 papers. The topics discussed include: distributed data usage control for web applications: a social network implementation;MyABDAC: compiling XacmL policies for attribute-based database access control;implementation and performance evaluation of privacy-preserving fair reconciliation protocols on ordered sets;an empirical assessment of approaches to distributed enforcement in role-based access control (RBAC);a language for provenance access control;non-interactive editable signatures for assured data provenance;identifying a critical threat to privacy through automatic image classification;k-out-of-n oblivious transfer based on homomorphic encryption and solvability of linear equations;mixture of gaussian models and bayes error under differential privacy;relationship-based access control: protection model and policy language;and enforcing physically restricted access control for remote data.
This paper addresses the making of security decisions, such as access-control decisions or spam filtering decisions, under uncertainty, when the benefit of doing so outweighs the need to absolutely guarantee these dec...
详细信息
This talk gives a personal perspective on the topic area of this new conference on data and applicationsecurity and privacy, the difficult nature of the challenge we are confronting and possible research thrusts that...
详细信息
ISBN:
(纸本)9781450304665
This talk gives a personal perspective on the topic area of this new conference on data and applicationsecurity and privacy, the difficult nature of the challenge we are confronting and possible research thrusts that may help us progress to an effective scientific discipline in this arena. Copyright 2011 acm.
We examine two privacy controls for Android smartphones that empower users to run permission-hungry applications while protecting private data from being exfiltrated: (1) covertly substituting shadow data in place of ...
详细信息
ISBN:
(纸本)9781450310758
We examine two privacy controls for Android smartphones that empower users to run permission-hungry applications while protecting private data from being exfiltrated: (1) covertly substituting shadow data in place of data that the user wants to keep private, and (2) blocking network transmissions that contain data the user made available to the application for on-device use only. We retrofit the Android operating system to implement these two controls for use with unmodified applications. A key challenge of imposing shadowing and exfiltration blocking on existing applications is that these controls could cause side effects that interfere with user-desired functionality. To measure the impact of side effects, we develop an automated testing methodology that records screenshots of application executions both with and without privacy controls, then automatically highlights the visual differences between the different executions. We evaluate our privacy controls on 50 applications from the Android Market, selected from those that were both popular and permission-hungry. We find that our privacy controls can successfully reduce the effective permissions of the application without causing side effects for 66% of the tested applications. The remaining 34% of applications implemented user-desired functionality that required violating the privacy requirements our controls were designed to enforce;there was an unavoidable choice between privacy and user-desired functionality.
data and applicationsecurity is traditionally viewed as a subfield of cybersecurity. The goal is still the same, namely to provide trustworthy computing infrastructure. However, in data and applicationsecurity, we a...
详细信息
ISBN:
(纸本)9781450304665
data and applicationsecurity is traditionally viewed as a subfield of cybersecurity. The goal is still the same, namely to provide trustworthy computing infrastructure. However, in data and applicationsecurity, we are dealing with the infrastructural aspects that are closer to humans, their interactions with the system, their perceptions, and their values. data should not be treated as just bits, but as semantically rich content. Hence, securing data may be different from securing bits. application software is much more diverse than system software, often directly responding to particular end-user needs. Hence, usability of security may be of more importance. The above may be just a small sample of the uniqueness of data and applicationsecurity. What else? What particular research agenda does this uniqueness call for? What about research methodologies? With the above questions in mind, this panel will bring 4-5 panelists to discuss their experiences and their views of future research directions in data and applicationsecurity. Copyright 2011 acm.
An encryption scheme is Key Dependent Message (KDM) secure if it is secure even against an attacker who has access to encryptions of messages which depend on the secret key. Recent studies have revealed that this stro...
详细信息
ISBN:
(纸本)9781450304665
An encryption scheme is Key Dependent Message (KDM) secure if it is secure even against an attacker who has access to encryptions of messages which depend on the secret key. Recent studies have revealed that this strong security notion is important both theoretically and practically. In this paper we review the defnition, and survey recent results and applications of KDM security. Copyright 2011 acm.
暂无评论