Do You Get What You Pay For? Comparing the Privacy Behaviors of Free vs. Paid Apps
Do You Get What You Pay For? Comparing the Privacy Behaviors of Free vs. Paid Apps
复制标题
DOI：
--
复制
发表时间：
2019-05
期刊：
影响因子：
--
通讯作者：
K. Bamberger;Catherine Han;Irwin Reyes;A. Elazari;Joel Reardon;Álvaro Feal;Serge Egelman;Narseo Vallina-Rodriguez
中科院分区：
文献类型：
--
作者：
K. Bamberger;Catherine Han;Irwin Reyes;A. Elazari;Joel Reardon;Álvaro Feal;Serge Egelman;Narseo Vallina-Rodriguez
人们通常认为，“免费”移动的应用程序的可用性是以消费者隐私为代价的，而为应用程序付费可以保护消费者免受行为广告和长期跟踪的影响。这项工作通过调查“免费”应用程序及其付费高级版本在捆绑代码、声明权限以及数据收集行为和隐私实践方面的差异程度，实证评估了这一假设的有效性。我们使用静态和动态分析相结合的方法来比较免费和付费应用程序对。我们还研究了对内的隐私政策的差异。我们依靠静态分析来确定每个应用程序中请求的权限和第三方SDK;我们使用动态分析来检测远程服务在网络流量级别收集的敏感数据;我们比较隐私政策的文本版本，以确定数据收集行为披露的差异。我们总共分析了1，505对免费Android应用程序及其付费应用程序，免费应用程序从Google Play商店的类别级别顶部图表中随机抽取。我们的研究结果表明，在我们的免费和付费对语料库中，没有明确的证据表明支付应用程序将保证免受广泛的数据收集。具体来说，48%的付费版本重复使用了与免费版本相同的所有第三方库，而56%的付费版本继承了免费版本的所有Android权限来访问敏感设备资源（考虑到免费应用程序包含至少一个第三方库并请求至少一个Android权限）。此外，我们的动态分析显示，38%的付费应用程序与免费应用程序具有相同的数据收集和传输行为。我们对隐私政策的探索表明，只有45%的对提供某种隐私政策，并且只有不到1%的对在免费和付费版本之间有不同的政策。
It is commonly assumed that the availability of “free” mobile apps comes at the cost of consumer privacy, and that paying for apps could offer consumers protection from behavioral advertising and long-term tracking. This work empirically evaluates the validity of this assumption by investigating the degree to which “free” apps and their paid premium versions differ in their bundled code, their declared permissions, and their data collection behaviors and privacy practices. We compare pairs of free and paid apps using a combination of static and dynamic analysis. We also examine the differences in the privacy policies within pairs. We rely on static analysis to determine the requested permissions and third-party SDKs in each app; we use dynamic analysis to detect sensitive data collected by remote services at the network traffic level; and we compare text versions of privacy policies to identify differences in the disclosure of data collection behaviors. In total, we analyzed 1,505 pairs of free Android apps and their paid counterparts, with free apps randomly drawn from the Google Play Store’s category-level top charts. Our results show that over our corpus of free and paid pairs, there is no clear evidence that paying for an app will guarantee protection from extensive data collection. Specifically, 48% of the paid versions reused all of the same third-party libraries as their free versions, while 56% of the paid versions inherited all of the free versions’ Android permissions to access sensitive device resources (when considering free apps that include at least one third-party library and request at least one Android permission). Additionally, our dynamic analysis reveals that 38% of the paid apps exhibit all of the same data collection and transmission behaviors as their free counterparts. Our exploration of privacy policies reveals that only 45% of the pairs provide a privacy policy of some sort, and less than 1% of the pairs overall have policies that differ between free and paid versions.