Too Much Accessibility is Harmful! Automated Detection and Analysis of Overly Accessible Elements in Mobile Apps
Too Much Accessibility is Harmful! Automated Detection and Analysis of Overly Accessible Elements in Mobile Apps
复制标题
太多的可访问性是有害的！
DOI：
10.1145/3551349.3560424
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Malek, Sam
中科院分区：
文献类型：
--
作者：
Mehralian, Forough;Salehnamadi, Navid;Huq, Syed Fatiul;Malek, Sam
移动的应用程序是当今世界的一项基本技术，应该为所有人提供平等的访问，包括占世界15%的残疾人。辅助技术（AT）在辅助功能API的帮助下，为无法看到或触摸屏幕的残疾用户提供了与应用程序交互的替代方式。先前的研究表明，移动的应用程序容易出现访问不足的问题，即，残疾用户无法访问应用程序中的功能（即使使用AT）的情况。我们研究了这个问题的对偶，称为过度访问问题，并定义为AT可以用于访问应用程序中无法访问的功能的条件。过度访问具有严重的安全和隐私影响，允许使用AT绕过受保护的功能，例如，使用旁白在锁定的手机上阅读笔记。过度访问也会降低应用程序的可访问性，因为它会向残疾用户提供实际上不打算在屏幕上提供的信息，从而混淆和阻碍他们有效导航的能力。在这项工作中，我们首先实证研究过度访问的Android应用程序中的元素，并定义了一组条件，可能会导致过度访问的问题。然后，我们提出了OverSight，一个自动化的框架，利用这些条件来检测过度可访问的元素，并使用AT动态验证其可访问性。我们对OverSight在真实应用程序上的经验评估证明了OverSight在检测以前未知的安全威胁、工作流违规和可访问性问题方面的有效性。
Mobile apps, an essential technology in today’s world, should provide equal access to all, including 15% of the world population with disabilities. Assistive Technologies (AT), with the help of Accessibility APIs, provide alternative ways of interaction with apps for disabled users who cannot see or touch the screen. Prior studies have shown that mobile apps are prone to the under-access problem, i.e., a condition in which functionalities in an app are not accessible to disabled users, even with the use of ATs. We study the dual of this problem, called the over-access problem, and defined as a condition in which an AT can be used to gain access to functionalities in an app that are inaccessible otherwise. Over-access has severe security and privacy implications, allowing one to bypass protected functionalities using ATs, e.g., using VoiceOver to read notes on a locked phone. Over-access also degrades the accessibility of apps by presenting to disabled users information that is actually not intended to be available on a screen, thereby confusing and hindering their ability to effectively navigate. In this work, we first empirically study overly accessible elements in Android apps and define a set of conditions that can result in over-access problem. We then present OverSight, an automated framework that leverages these conditions to detect overly accessible elements and verifies their accessibility dynamically using an AT. Our empirical evaluation of OverSight on real-world apps demonstrates OverSight’s effectiveness in detecting previously unknown security threats, workflow violations, and accessibility issues.
登录
查看更多内容
影响因子：
--
作者：
Mohammad Naseri;N. P. Borges;A. Zeller;Romain Rouvoy
通讯作者：
Mohammad Naseri;N. P. Borges;A. Zeller;Romain Rouvoy
DOI：
--
发表时间：
2019
期刊：
IEEE International Conference on Software Maintenance and Evolution
影响因子：
--
作者：
Christopher Vendome;Diana Solano;Santiago Linan;Mario Linares
通讯作者：
Mario Linares
流行病学作为大规模移动应用程序可访问性评估的框架
DOI：
10.1145/3132525.3132547
发表时间：
2017
期刊：
Proceedings of the ACM Conference on Computers and Accessibility (ASSETS 2017
影响因子：
--
作者：
Ross, Anne Spencer;Zhang, Xiaoyi;Fogarty, James;Wobbrock, Jacob O.
通讯作者：
Wobbrock, Jacob O.
DOI：
10.1145/3411764.3445186
发表时间：
2021-01
期刊：
Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems
影响因子：
--
作者：
Xiaoyi Zhang;Lilian de Greef;Amanda Swearngin;Samuel White;Kyle I. Murray;Lisa Yu;Qi Shan;Jeffrey Nichols;Jason Wu;Chris Fleizach;Aaron Everitt;Jeffrey P. Bigham
通讯作者：
Xiaoyi Zhang;Lilian de Greef;Amanda Swearngin;Samuel White;Kyle I. Murray;Lisa Yu;Qi Shan;Jeffrey Nichols;Jason Wu;Chris Fleizach;Aaron Everitt;Jeffrey P. Bigham
Latte：用例和辅助服务驱动的 Android 自动辅助功能测试框架
DOI：
--
发表时间：
2021
期刊：
International Conference on Human Factors in Computing Systems
影响因子：
--
作者：
Navid Salehnamadi;Abdulaziz Alshayban;Jun;Iftekhar Ahmed;S. Branham;S. Malek
通讯作者：
S. Malek