Visualizing Privacy I
March 7, 2006
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
1
Outline
Visualizing privacy
Three examples of visualizing privacy (from
readings)
• Privacy policy and privacy preference
• Privacy Notice in Spyware applications
• Third party tracking cookies
Your turn
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
2
Motivating Quote
“privacy is the claim of individuals, groups, or
institutions to determine for themselves
when, how, and to what extent information
about them is communicated to others”
(Westin, 1967)
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
3
Motivation
Privacy is abstract and hard to articulate
unless one sees it
The potential harms to privacy are
uncertain and faraway
Some privacy invasive technologies are
hidden
Informed Consent model, if not informed,
there is not meaningful consent
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
4
Motivation Example 2
Benjamine Brunk, Understanding Privacy Space
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
5
What is visualizing privacy?
Visualize is “to make visible: as to see or
form a mental image of” (MerriamWebster's collegiate dictionary)
Visualizing privacy is to make privacy
visible, to make users form a mental image
of privacy.
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
6
Privacy Space Framework
Awareness
Detection
Prevention
Response
Recovery
Brunk, Figure 20-2 p. 414
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
7
Chapter 22 Privacy Policies and
Privacy Preferences
Lorrie Faith Cranor
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
8
Privacy Policies and preferences
Privacy Policies is a mechanism for
communicating about information collection
and use
Few people read privacy policies
• Time consuming to read and difficult to
understand
• Format not standardized
• Can change unexpectedly
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
9
P3P and P3P user agents
 What: machine readable privacy policy in XML
format.
 How does it work?
• website encode their privacy policies in P3P format
• User agents read the policy and parse it out
 Benefit: Offers an easy way for web sites to
communicate about their privacy policies in a
standard machine-readable format
 Privacy is visualized in the following ways:
• Summarize privacy policies
• Compare policies with user preferences
• Alert and advise users
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
10
P3P in IE6
Automatic processing of compact
policies only;
third-party cookies without compact
policies blocked by default
Privacy icon on status bar
indicates that a cookie has been
blocked – pop-up appears the
first time the privacy icon
appears
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
11
Users can click on
privacy icon for
list of cookies;
privacy summaries
are available at
sites that are
P3P-enabled
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
12
Privacy summary
report is
generated
automatically
from full P3P policy
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
13
P3P in Netscape 7
Preview version similar to IE6,
focusing, on cookies; cookies
without compact policies (both
first-party and third-party)
are “flagged” rather than
blocked by default
Indicates flagged cookie
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
14
Privacy Bird
 Free download of beta from
http://privacybird.com/
• Origninally developed at AT&T Labs
• Released as open source
 “Browser helper object” for IE6
 Reads P3P policies at all
P3P-enabled sites automatically
 Bird icon at top of browser window indicates whether site
matches user’s privacy preferences
 Clicking on bird icon gives more information
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
15
Chirping bird is privacy indicator
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
16
Red bird indicates mismatch
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
17
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
18
Discussion
Can you think of anything else?
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
19
Chapter 23 Privacy Analysis for the
Casual User Through Bugnosis
David Martin
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
20
Web bugs
Invisible elements on a web page used to
record the fact the face was visited, and
sometimes to communicate additional
information about the user or computer
doing the viewing
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
21
Bugnosis
A IE plug-in that watches for web bugs
Alerts the user of its presence, but do not
block web bugs
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
22
A demo
www.about.com
www.nytimes.com
www.doubleclick.com
http://freedownloadscenter.com/Utilities/
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
23
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
24
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
25
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
26
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
27
Stopping Spyware at the Gate
Nathaniel Good, Rachna Dhamija,
Jens Grossklags, et al.
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
28
User Study
Goal: How the form and content of notices
affect users’ decision to install Spyware
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
29
Study Design
31 participants
Ask the user to go through five programs:
Google toolbar, Edonkey, KaZaA,
WeatherScope, WebShots).
And install them if they feel appropriate
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
30
Notice Condition 1: EULA only
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
31
Notice Condition 2: Microsoft SP2 Warning
+ EULA
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
32
Notice Condition 3: Customized Short
Notice + EULA
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
33
Study Results
Participants ignore EULAs
• Although they know they were agreeing to a
contract
• Limited understanding of the content and little
desire to read length notice
Additional Notice had only marginal effect
on the total number of installations
• Improved Notice is not enough to inform user
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
34
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
35
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
36
Your turn
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
37
Group problems
EULA – a failed way to inform, what are
some of the ways we can better inform the
user when they install these software?
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
38
Backup Slides
These slides are from Lorrie’s
previous class presentation on
Privacy
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
39
Platform for Privacy Preferences Project (P3P)
 Developed by the World Wide Web Consortium
(W3C) http://www.w3.org/p3p/
• Final P3P1.0 Recommendation issued 16 April 2002
 Offers an easy way for web sites to communicate
about their privacy policies in a standard
machine-readable format
• Can be deployed using existing web servers
 Enables the development of tools (built into
browsers or separate applications) that
• Summarize privacy policies
• Compare policies with user preferences
• Alert and advise users
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
40
Basic components
 P3P provides a standard XML format that web
sites use to encode their privacy policies
 Sites also provide XML “policy reference files” to
indicate which policy applies to which part of the
site
 Sites can optionally provide a “compact policy” by
configuring their servers to issue a special P3P
header when cookies are set
 No special server software required
 User software to read P3P policies called a “P3P
user agent”
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
41
What’s in a P3P policy?
 Name and contact information for site
 The kind of access provided
 Mechanisms for resolving privacy disputes
 The kinds of data collected
 How collected data is used, and whether
individuals can opt-in or opt-out of any of these
uses
 Whether/when data may be shared and whether
there is opt-in or opt-out
 Data retention policy
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
42
A simple HTTP transaction
GET /index.html HTTP/1.1
Host: www.att.com
. . . Request web page
Web
Server
HTTP/1.1 200 OK
Content-Type: text/html
. . . Send web page
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
43
… with P3P 1.0 added
GET /w3c/p3p.xml HTTP/1.1
Host: www.att.com
Request Policy Reference File
Web
Server
Send Policy Reference File
Request P3P Policy
Send P3P Policy
GET /index.html HTTP/1.1
Host: www.att.com
. . . Request web page
HTTP/1.1 200 OK
Content-Type: text/html
. . . Send web page
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
44
P3P increases transparency
 P3P clients can check
a privacy policy each
time it changes
http://www.att.com/accessatt/
 P3P clients can check
privacy policies on all
objects in a web page,
including ads and
invisible images
http://adforce.imgis.com/?adlink|2|68523|1|146|ADFORCE
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
45
P3P in IE6
Automatic processing of compact
policies only;
third-party cookies without compact
policies blocked by default
Privacy icon on status bar
indicates that a cookie has been
blocked – pop-up appears the
first time the privacy icon
appears
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
46
Users can click on
privacy icon for
list of cookies;
privacy summaries
are available at
sites that are
P3P-enabled
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
47
Privacy summary
report is
generated
automatically
from full P3P policy
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
48
P3P in Netscape 7
Preview version similar to IE6,
focusing, on cookies; cookies
without compact policies (both
first-party and third-party)
are “flagged” rather than
blocked by default
Indicates flagged cookie
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
49
Privacy Bird
 Free download of beta from
http://privacybird.com/
• Origninally developed at AT&T Labs
• Released as open source
 “Browser helper object” for IE6
 Reads P3P policies at all
P3P-enabled sites automatically
 Bird icon at top of browser window indicates whether site
matches user’s privacy preferences
 Clicking on bird icon gives more information
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
50
Chirping bird is privacy indicator
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
51
Red bird indicates mismatch
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
52
Check embedded content too
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
53
Privacy settings
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
54
Capturing Privacy Preference
Most people have little experience
articulating their privacy preference
Privacy preferences are often complex and
nuanced
Most people are unfamiliar with much of the
terminology used by privacy experts
Most people do not understand the privacy
related consequences of their behavior
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
55
Difficulties in capturing preference
User want interface to be simple and yet do
not want to be reduced to preconfigured
preferences
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
56
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
57
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
58
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
59
Research question
How do we build tools to make people
aware of potential privacy issues?
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
60
What to visualize?
Websites’ privacy practices
Cookies
Spyware
Can you think of others?
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
61
Difficulties in visualizing privacy
Privacy is a hard and abstract concept
People sometimes do not know their
preferences
Usable Privacy and Security • Carnegie Mellon University • Spring 2006 • Cranor/Hong/Reiter • http://cups.cs.cmu.edu/courses/ups-sp06/
62