Improving User Choice Through Better Mobile Apps Transparency and Permissions Analysis
Improving User Choice Through Better Mobile Apps Transparency and Permissions Analysis
复制标题
通过更好的移动应用程序透明度和权限分析来改善用户选择
DOI：
--
复制
发表时间：
2014
影响因子：
--
通讯作者：
D. Weitzner
中科院分区：
文献类型：
--
作者：
Ilaria Liccardi;J. Pato;D. Weitzner
我们的个人信息、习惯、好恶都可以从我们的移动设备中推断出来。因此，保护手机隐私是一个非常重要的问题。透明度和个人控制是隐私的基本原则，但事实证明，在知情的情况下选择使用哪些移动应用程序是很困难的。为了了解移动应用程序信息收集的动态，并展示透明访问移动应用程序信息访问权限细节的价值，我们收集了谷歌Play上约528,433个应用程序的信息。并分析了每个应用程序请求的权限。我们通过设计“敏感性评分”来开发应用程序带来的风险的定量度量，以表示在可能进行网络通信的情况下读取用户个人信息的权限的出现次数。我们发现54%的应用程序不访问任何个人数据。剩下的46%收集1到20个敏感权限，并能够将其传输到手机外部。应用的敏感性在免费和付费应用之间，以及在类别和内容评级之间都存在很大差异。敏感权限通常与大量低风险权限混在一起，因此难以识别。容易获得的敏感度评分可以帮助用户在选择一款收集个人信息风险较小的应用时做出更明智的决定。即使一款应用“自我描述”为适合特定用户子集（如儿童），它也可能包含不合适或不期望的内容评级和许可请求。我们做这项研究的经验表明，很难获得有关如何使用或分析从应用程序收集的个人数据的信息。事实上，只有0.37%（1991）的应用程序声明了“隐私政策”。因此，为了让手机用户获得真正的控制权，应用分发平台应该提供更详细的信息，说明他们的数据是如何被使用的。为了实现更大的透明度和个人控制，目前不提供原始权限描述以供分析的应用程序分发平台可以改变其设计和操作策略，使这些数据在安装之前可用。
Our personal information, habits, likes and dislikes can be all deduced from our mobile devices. Safeguarding mobile privacy is therefore of great concern. Transparency and individual control are bedrock principles of privacy but making informed choices about which mobile apps to use has been shown to be difficult. In order to understand the dynamics of information collection in mobile apps and to demonstrate the value of transparent access to the details of mobile applications information access permissions, we have gathered information about 528,433 apps on Google Play, and analyzed the permissions requested by each app. We develop a quantitative measure of the risk posed by apps by devising a ‘sensitivity score’ to represent the number of occurrences of permissions that read personal information about users where network communication is possible. We found that 54% of apps do not access any personal data. The remaining 46% collect between 1 to 20 sensitive permissions and have the ability to transmit it outside the phone. The sensitivity of apps differs greatly between free and paid apps as well as between categories and content rating. Sensitive permissions are often mixed with a large amount of low-risk permissions and hence are difficult to identify. Easily available sensitivity scores could help users making more informed decision about choosing an app that could pose less risk in collecting personal information. Even though an app is “self-described” to be suitable for a certain subset of users (i.e children) it might contain content ratings and permission requests that are not appropriate or expected. Our experience in doing this research shows that it is difficult to obtain information about how personal data collected from apps is used or analyzed. In fact only 0.37% (1,991) of the collected apps show to have declared a “privacy policy”. Therefore, in order to make real control available to mobile users, apps distribution platforms should provide more detailed information about how their data if accessed is used. To achieve greater transparency and individual control, apps distribution platforms which do not currently make raw permission description accessible for analysis could change their design and operating policies to make this data available prior to installation.