Volume 58, Issue 5 - Usable privacy and security / Guest Editors: Alexander De Luca and Emanuel von Zezschwitz

We present the results of a survey study ( n  = 1,200) investigating online users' privacy sensitivity towards exposing specific data items to service providers of the three most prominent online services in the UK: online retail, social networking and information search. The study, representative of the online population of the UK, presents proof for the context-dependence of privacy sensitivity and provides concrete quantitative results for specific data items (like full name or mobile phone number). One of the key results is that data that is considered essential in order for a service to work is seldomly rated as sensitive. We could also show that passively collected data is in general more sensitive than concrete data provided by the users. However, specific conditions like control and transparency can have positive/negative effects on the sensitivity of data in a specific context.

Privacy policies are supposed to provide transparency about a service's data practices and help consumers make informed choices about which services to entrust with their personal information. In practice, those privacy policies are typically long and complex documents that are largely ignored by consumers. Even for regulators and data protection authorities privacy policies are difficult to assess at scale. Crowdsourcing offers the potential to scale the analysis of privacy policies with microtasks, for instance by assessing how specific data practices are addressed in privacy policies or extracting information about data practices of interest, which can then facilitate further analysis or be provided to users in more effective notice formats. Crowdsourcing the analysis of complex privacy policy documents to non-expert crowdworkers poses particular challenges. We discuss best practices, lessons learned and research challenges for crowdsourcing privacy policy analysis.

Despite substantial improvements made by the usable security community at raising lay people's awareness of, motivation to use, and knowledge of how to use security and privacy tools (i.e., their security sensitivity ), much security advice remains ignored and many security tools remain underutilized. I argue that this low security sensitivity can be at least partially explained by the fact that security and privacy behaviors can have myriad social consequences. For example, by using two-factor authentication, one might also be perceived as paranoid or as someone with something to hide. To that end, in this article, I will describe some recent work that introduces and establishes a theoretical foundation for a new genre of usable security research: social cybersecurity .

This essay contributes an extended view on user information inferred by personal devices to motivate applications of biometrics beyond user identification. We unfold a new design space in two parts: First, we take inspiration from the shared focus on individuality in both biometrics and Belk's Extended Self (ES Belk, R. W., Possessions and the extended self . Journal of Consumer Research, 15(2), 139–168, 1988; Belk, R. W., Extended self in a digital world . Journal of Consumer Research, 40(3), 477–500, 2013. ). ES describes that people use (digital) objects to define and reflect on their identities. Following this, we propose that personal devices can use biometrics to assess individual user attributes and behaviour for three application areas related to the core aspects of ES: privacy and security (Having), UI personalisation (Doing), digital self-presentation (Being). Second, we propose to view biometrics as part of a larger class of Implicit Information . Such information is inferred from interactions and sensors to be used across these application domains. We discuss implications and limitations of this view.

Wearables are a rapidly emerging device category with wide-reaching use scenarios. The novel form factors and broad potential of this technology pose new security challenges: devices are typically on and close to a user. Furthermore, while they possess limited input and output channels, they often feature rich sensing, computing and communication capabilities. Due to this novel context, this paper argues that researchers need to reconsider the functional, technical and social aspects of authenticating, or securely establishing a user's identity, for wearable devices. This paper contributes to ongoing work on this topic by reviewing wearable authentication schemes according to the traditional classification of authentication via tokens, passwords or biometrics. The goal of this review is to provide an illustrated overview of key advances in the area over the past decade that covers a variety of form factors (wristbands, glasses, jewelry, etc) and modes of operation (single or multi-factor authentication, on one or multiple devices). Finally, we tie the review together by identifying four key themes that will drive future research: the raise of implicit authentication that requires no dedicated user action; the use of wearable devices for authentication in conjunction with other systems; the potential and richness of current available technology and tools for wearable devices and; the importance and challenges of maintaining privacy and security in wearable contexts.