Hey Alexa, Who Am I Talking to?: Analyzing Users’ Perception and Awareness Regarding Third-party Alexa Skills
Hey Alexa, Who Am I Talking to?: Analyzing Users’ Perception and Awareness Regarding Third-party Alexa Skills
复制标题
DOI：
10.1145/3491102.3517510
复制
发表时间：
2022-04
期刊：
影响因子：
--
通讯作者：
Aafaq Sabir;Evan Lafontaine;Anupam Das
中科院分区：
文献类型：
--
作者：
Aafaq Sabir;Evan Lafontaine;Anupam Das
Amazon Alexa语音助手通过使用语音命令对智能家用电器进行自动化和控制，提供了便利。亚马逊允许名为Skills的第三方应用程序在Alexa上运行，以进一步扩展Alexa的能力。然而，由于多项技能可以共享相同的调用短语并请求访问敏感用户数据，第三方技能带来了越来越多的安全和隐私问题。在本文中，我们研究了现有的安全指标的可用性和有效性，或缺乏这些指标，以帮助用户正确理解与不同类型的技能交互的风险。我们进行了一项互动用户研究(邀请Amazon Alexa的活跃用户)，参与者使用官方Alexa应用程序收听现实世界的技能并与之互动。我们发现，大多数参与者无法正确识别技能开发者(即，他们假设Amazon也开发了第三方技能)，并且无法正确确定哪些技能将通过语音界面自动激活。我们还提出并评估了几个基于语音的技能类型指标，展示了用户将如何从这些基于语音的指标中受益。
The Amazon Alexa voice assistant provides convenience through automation and control of smart home appliances using voice commands. Amazon allows third-party applications known as skills to run on top of Alexa to further extend Alexa’s capability. However, as multiple skills can share the same invocation phrase and request access to sensitive user data, growing security and privacy concerns surround third-party skills. In this paper, we study the availability and effectiveness of existing security indicators or a lack thereof to help users properly comprehend the risk of interacting with different types of skills. We conduct an interactive user study (inviting active users of Amazon Alexa) where participants listen to and interact with real-world skills using the official Alexa app. We find that most participants fail to identify the skill developer correctly (i.e., they assume Amazon also develops the third-party skills) and cannot correctly determine which skills will be automatically activated through the voice interface. We also propose and evaluate a few voice-based skill type indicators, showcasing how users would benefit from such voice-based indicators.