Using statistical information to communicate android permission risks to users

L Kraus, I Wechsung, S Möller - 2014 Workshop on Socio …, 2014 - ieeexplore.ieee.org
2014 Workshop on Socio-Technical Aspects in Security and Trust, 2014ieeexplore.ieee.org
The Android OS has a permission-based security system that controls the third party
applications' access to sensitive information on the smartphone. The risk evaluation is left to
the user who has to evaluate whether or not the requested permissions are appropriate.
However, former work has shown that users lack attention to and understanding of the
permissions which makes it difficult for them to make appropriate decisions. To support
users with better understandable information we provide statistical information about …
The Android OS has a permission-based security system that controls the third party applications' access to sensitive information on the smartphone. The risk evaluation is left to the user who has to evaluate whether or not the requested permissions are appropriate. However, former work has shown that users lack attention to and understanding of the permissions which makes it difficult for them to make appropriate decisions. To support users with better understandable information we provide statistical information about permissions, grouped by functionality. We use methods from health risk communication to communicate this information to the users. In a lab experiment with 48 participants we find that users tend to choose more often the app with a lower number of permissions when statistical information is provided together with graphics. We also find that the privacy-intrusiveness and trustworthiness of apps is perceived differently when statistical information is given.
ieeexplore.ieee.org