暴露的风险：评估移动数据隐私的测量和用户研究
Exposures Exposed: A Measurement and User Study to Assess Mobile Data Privacy in Context
摘要：
移动设备可以访问个人的、潜在的敏感数据，并且有大量移动应用程序和第三方库可以通过网络将这些信息传输到远程服务器（包括应用程序开发人员服务器和第三方服务器）。在本文中，我们不仅希望更好地了解个人身份信息（PII）暴露的程度，而且还希望了解其背景，即，应用程序的功能、目标服务器、使用的加密等）以及当今移动用户所感知的风险。为此，我们采取两个步骤。首先，我们进行测量研究：我们通过手动和自动测试收集新的数据集，并从400个最受欢迎的Android应用程序中捕获16种PII类型的暴露情况。我们分析这些风险，并深入了解移动应用程序共享PII的程度和模式，以便日后用于预测和预防。其次，我们对Amazon Mechanical Turk上的220名参与者进行了用户研究：我们按类别总结了测量研究的结果，在现实环境中呈现它们，并评估用户的理解，关注和采取行动的意愿。据我们所知，我们的用户研究是第一个以如此精细的粒度收集和分析用户输入以及移动设备上的实际（而不仅仅是潜在或允许的）隐私暴露的用户研究。尽管许多用户最初并不了解其PII被暴露的全部影响，但在通过研究获得更好的信息后，他们对更好的隐私实践表示赞赏和兴趣。
英文摘要：
Mobile devices have access to personal, potentially sensitive data, and there is a large number of mobile applications and third-party libraries that transmit this information over the network to remote servers (including app developer servers and third party servers). In this paper, we are interested in better understanding of not just the extent of personally identifiable information (PII) exposure, but also its context i.e., functionality of the app, destination server, encryption used, etc.) and the risk perceived by mobile users today. To that end we take two steps. First, we perform a measurement study: we collect a new dataset via manual and automatic testing and capture the exposure of 16 PII types from 400 most popular Android apps. We analyze these exposures and provide insights into the extent and patterns of mobile apps sharing PII, which can be later used for prediction and prevention. Second, we perform a user study with 220 participants on Amazon Mechanical Turk: we summarize the results of the measurement study in categories, present them in a realistic context, and assess users' understanding, concern, and willingness to take action. To the best of our knowledge, our user study is the first to collect and analyze user input in such fine granularity and on actual (not just potential or permitted) privacy exposures on mobile devices. Although many users did not initially understand the full implications of their PII being exposed, after being better informed through the study, they became appreciative and interested in better privacy practices.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
