Measuring Alexa Skill Privacy Practices across Three Years
Measuring Alexa Skill Privacy Practices across Three Years
复制标题
DOI：
10.1145/3485447.3512289
复制
发表时间：
2022-04
期刊：
影响因子：
--
通讯作者：
Jide S. Edu;Xavier Ferrer Aran;J. Such;Guillermo Suarez-Tangil
中科院分区：
文献类型：
--
作者：
Jide S. Edu;Xavier Ferrer Aran;J. Such;Guillermo Suarez-Tangil
智能语音助手正在改变用户与技术交互的方式。这种转变主要是由第三方开发商通过在线市场提供的语音驱动应用程序（称为技能）的激增推动的。我们看到近年来技能数量发生了怎样的变化，Amazon Alexa 技能生态系统从 2016 年初的 135 项技能增长到 2021 年初的约 125,000 项技能。随着技能的增长，人们越来越担心第三方技能对用户隐私造成的风险。在本文中，我们对 Alexa 市场进行了系统的纵向测量研究。我们利用 2019 年至 2021 年三年间收集的数据揭示了这个生态系统如何演变。我们揭开了开发者数据披露实践的神秘面纱，并概述了第三方生态系统。我们看到研究界如何不断为市场卫生做出贡献，但亚马逊的审查流程仍然需要重大改进。我们执行负责任的披露流程，向亚马逊和所有受影响的开发者报告 675 项存在隐私问题的技能，其中 246 项技能存在重要问题（即，可追溯性被破坏）。我们发现，246 项技能中有 107 项 (43.5%) 在被报告近一年后仍然显示出可追溯性被破坏的情况。因此，多年来生态系统的整体状况有所改善。然而，新提交的技能和未解决的已知问题构成了地方性风险。
Smart Voice Assistants are transforming the way users interact with technology. This transformation is mostly fostered by the proliferation of voice-driven applications (called skills) offered by third-party developers through an online market. We see how the number of skills has rocked in recent years, with the Amazon Alexa skill ecosystem growing from just 135 skills in early 2016 to about 125k skills in early 2021. Along with the growth in skills, there is increasing concern over the risks that third-party skills pose to users’ privacy. In this paper, we perform a systematic and longitudinal measurement study of the Alexa marketplace. We shed light on how this ecosystem evolves using data collected across three years between 2019 and 2021. We demystify developers’ data disclosure practices and present an overview of the third-party ecosystem. We see how the research community continuously contribute to the market’s sanitation, but the Amazon vetting process still requires significant improvement. We perform a responsible disclosure process reporting 675 skills with privacy issues to both Amazon and all affected developers, out of which 246 skills suffer from important issues (i.e., broken traceability). We see that 107 out of the 246 (43.5%) skills continue to display broken traceability almost one year after being reported. As a result, the overall state of affairs has improved in the ecosystem over the years. Yet, newly submitted skills and unresolved known issues pose an endemic risk.