Difference between revisions of "Mobile Privacy Experience"

Revision as of 14:52, 21 June 2023

As more of our interactions with networked applications and data increases, the need for user's to understand the impact of the choices they make during their interactions.

Context

Current User Experiences with privacy notifications is demonstrably inadequate to the problems created.^[1] Mobile Phones began a campaign to label apps with consumer-friendly labels. The result was panned in papers like the New York Times and Washington Post. Which called the labels confusing and had to identify as to their purpose.

Problems

1. User's requests for more privacy and seldom followed up by any significant change in user behavior. This makes it easy from companies to claim that they offer privacy options that the user can enable but not ensuring that the user has any real choice.
2. Generally attempts to legislate privacy attract lawyers who encourage the legislature to give the lawyers a means to extract settlements from offending companies, without otherwise making any effort to actually improve the user's experience. For one example see the wiki page on GDPR is a scam. This leads to mitigations that are not at all related to user privacy concerns.
3. Tracking of user's or their devices either in physical space or digital space can expose the full identity is a short time.
4. Aggregation of user's attributes or behaviors will expose a user's full identity in an amazingly short time online.
5. Developers that create privacy notices are typically unaware (or unconcerned) about privacy threats.

Taxonomy

1. mobile credential = this can be called many things beside credential including: certificate, registration, membership, access ticket, etc. but it must be included in a network enabled portable device.
2. holder
3. holder wallet (provider) includes all of the components include the mobile device, operating system, key storage facility, network accessibility, wallet software, wallet network support infrastructure, etc.
4. issuer
5. issuer provider
6. verifier
7. verifier provider

Modes of operation:

1. Issuer on-line = can or must the verifier check the current status of the credential.

Solutions

1. Focus on the single page where a user has a choice about release of data. The only interesting test to to ask user's in the field to evaluate what that page ;meant to them.
2. Legal requirements are seldom helpful in establishing the user consent page, but are critical in what data is available to user's if they are one of the very few that chose to followup on their concerns.

References

1. ↑ Lorrie Faith Cranor, Mobile-App Privacy Nutrtion Lables Missing Key Ingredients for Success CACM 65 No. 11 (2022-11)