Characterizing security and privacy practices in emerging digital credit applications
Characterizing security and privacy practices in emerging digital credit applications
复制标题
描述新兴数字信贷应用中的安全和隐私实践
DOI：
10.1145/3317549.3319723
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Patrick Traynor
中科院分区：
文献类型：
--
作者：
Jasmine Bowers;Imani N. Sherman;Kevin R. B. Butler;Patrick Traynor
获得信贷可以提供对企业和个人至关重要的资本。不幸的是，对于发展中世界的大部分地区来说，无法获得信贷，因为客户往往缺乏放款人用于做出此类决定的传统数据（例如，可核实的工资单、财产所有权文件）。新兴的在线信贷服务通过使用非传统的信誉数据来满足这一需求，许多人认为这些数据包括用户的地理位置和社交网络信息。虽然这些系统都有可能通过即时评估来扩大信贷可用性并提高可用性，但它们的安全和隐私做法仍然不透明。在本文中，我们首次对新兴的在线信贷空间进行了全面的安全分析。为了提高透明度，我们选择了51家具有代表性的公司，分析了他们的隐私政策，并将其与移动的应用程序实际收集的敏感数据类型进行了比较。然后，我们评估移动的应用程序与其支持服务器之间的连接配置，以确定它们是否安全地处理此类数据。我们的分析表明，这个新兴行业存在重大的安全和隐私问题，包括收集以前未公开的数据类型和广泛的加密错误配置。最后，我们讨论了我们与行业内和行业周围的合作伙伴合作以改善这些问题的努力。
Access to credit can provide capital crucial to both businesses and individuals. Unfortunately, for large parts of the developing world, access to credit is not available because customers often lack the traditional data used by lenders to make such decisions (e.g., verifiable payroll statements, property ownership documents). Emerging online credit services address this need through the use of non-traditional creditworthiness data, which many believe to include user geolocation and social network information. While such systems both potentially expand credit availability and improve usability through instant evaluation, their security and privacy practices remain opaque. In this paper, we perform the first comprehensive security analysis of the emerging online credit space. To provide improved transparency, we select 51 representative companies across the industry, analyze their privacy policies and compare them to the sensitive data types mobile applications actually gather. We then evaluate the configuration of connections between mobile apps and their supporting servers to determine whether they securely handle such data. Our analysis demonstrates significant security and privacy issues across this burgeoning industry, including the gathering of previously undisclosed data types and widespread mis-configuration of encryption. We conclude by discussing our efforts to work with partners in and around the industry to improve these issues.