Preference-based Location Sharing: Are More Privacy Options Really Better?

546 views

Published on

Paper presented at CHI 2013 in Paris

Published in: Education, Spiritual, Technology
1 Comment
0 Likes
Statistics
Notes
  • Be the first to like this

No Downloads
Views
Total views
546
On SlideShare
0
From Embeds
0
Number of Embeds
10
Actions
Shares
0
Downloads
13
Comments
1
Likes
0
Embeds 0
No embeds

No notes for slide

Preference-based Location Sharing: Are More Privacy Options Really Better?

  1. 1. Preference-based Location SharingAre More Privacy Options Really Better?Bart P. KnijnenburgDepartment of Informatics, UC IrvineAlfred KobsaDepartment of Informatics, UC IrvineHongxia JinSamsung R&D Research Center
  2. 2. INFORMATION AND COMPUTER SCIENCESOutlineShould sharing profiles be simple or complex?What happens when you add/remove sharing options?Users choose based of their perception of the optionsA method for designing better sharing options
  3. 3. INFORMATION AND COMPUTER SCIENCESProfile-based location sharingFigure 5 – Locaccino privacy settings pageWe address in detail the topic of privacy policies, presenting the necessary formalism insection 3.1.2.Who Can Locate MeThis page is intended to provide privacy awareness to the user, in the sense that the
  4. 4. INFORMATION AND COMPUTER SCIENCESWhy socomplex?
  5. 5. INFORMATION AND COMPUTER SCIENCESLocaccinoresearchers:-Users willotherwise err onthe safe sideDecision scientists:-Depends onperception ofthe options
  6. 6. (part 2/3)Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:Your friendsYour colleaguesBest friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue
  7. 7. (part 2/3)aring yourdst your sharing preferences forreferences, and on some pagestings for sharing with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue(part 2/3)aring yourdst your sharing preferences forreferences, and on some pagestings for sharing with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue(part 2/3)aring yourdst your sharing preferences forreferences, and on some pagestings for sharing with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue
  8. 8. Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:
  9. 9. Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:??1.removingthe Cityoption
  10. 10. Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:? ?2.introducingthe Exactoption
  11. 11. INFORMATION AND COMPUTER SCIENCESWithout Exact (−E) With Exact (+E)WithoutCity (−C)WithCity (+C)Main manipulationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationres Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationes Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevenFrankDuring work hrs: Outside work hrs:John, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevenFrankDuring work hrs:nothingOutside work hrs:nothingand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas,FrankDuring work hrs:ring with:John, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas,FrankDuring work hrs:nothingg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact location
  12. 12. INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusWe believe that peoplechoose based on theirperception of the optionsHow do people perceivethese options?Privacy calculus:Trade-off betweenprivacy and benefitEBNprivacy -->benefits-->C
  13. 13. INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->C
  14. 14. INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->C
  15. 15. INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->C
  16. 16. INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->CHigh privacy, low benefit
  17. 17. INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->CLow privacy, high benefit
  18. 18. Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:??1.removingthe Cityoption
  19. 19. INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:Three situations:1. City is subjectively distinctfrom Nothing and Block:-Luce’s Choice Axiomholds-The ratio N : B+E will staythe sameUsers will prefer both sidesproportionally when City isremovedEBNprivacy -->benefits-->Cprivacy -->
  20. 20. INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:2. City is subjectively closerto Nothing than to Block:-Tversky’s SubstitutionEffect holds-C is a substitute for N-When we remove C,N will increase morethan B+EUsers will err on the safe sideEBNprivacy -->benefits-->C
  21. 21. INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:3. City is subjectively closerto Block than to Nothing:-Tversky’s SubstitutionEffect holds-C is a substitute for B-When we remove C,B will increase morethan NUsers will prefer the morerevealing sideEBNprivacy -->benefits-->C
  22. 22. ResultsWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingWithout Exact (−E) With exact (+E)Withoutcity(−C)y(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->26.729.918.624.8Benefit-->ExactBlockCityNothing
  23. 23. Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingResultsSize:percentageof peoplechoosingthis option
  24. 24. ResultsWWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)Privacy --> Privacy -->48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->Position:perceptionin terms ofprivacy andbenefit
  25. 25. ResultsWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingleft vs.right:comparisonof withoutvs. withExact
  26. 26. ResultsWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingbottomvs. top:comparisonof with vs.withoutCity
  27. 27. Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsCity is closer to Block(0.45pts) than to Nothing(2.25pts)Substitution effect!Only the share of Blockdiffers significantlybetween –C and +C(24.2pp)ExactBlockCityNothing
  28. 28. Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsDistance from City toNothing and Block is moreequalLuce’s choice axiom!Both Nothing (14.3pp)and Block (9.1pp) differbetween –C and +CEffect on Nothing islarger, because City issomewhat closer toNothingWithout Exact (−E) With exact (+E)Withoutcity(−C)y(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->26.729.918.624.8Benefit-->ExactBlockCityNothing
  29. 29. Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:? ?2.introducingthe Exactoption
  30. 30. INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:Two situations:1. Exact is subjectively closeto Block:-Tversky’s SubstitutionEffect holds-E is a substitute for BOnly B will decrease whenE is introducedEBNprivacy -->benefits-->C
  31. 31. INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:2. Exact is more distant:-Simonson’s CompromiseEffect holds-B is no longer an extreme,but a compromise-B attracts some from Cand N-Still some Substitution ofB to EIn sum: Sharing increasesacross the boardBNprivacy -->benefits-->CE
  32. 32. INFORMATION AND COMPUTER SCIENCESWWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)Privacy --> Privacy -->48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsExact is subjectively closeto BlockSubstitution effect!the availability of Exactmainly affects the share ofBlock (21.5pp)Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothing
  33. 33. INFORMATION AND COMPUTER SCIENCESWWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)Privacy --> Privacy -->48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsExact is further awayfrom BlockCompromise effect!Block is only reduced by8.3pp, as it regains someshare from Nothing(reduced by 13.7pp)Without Exact (−E) With exact (+E)Withoutcity(−C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->ExactBlockCityNothing
  34. 34. INFORMATION AND COMPUTER SCIENCESTwo conclusions1. With fewer options, users do not just “err on the safe side”Instead, they deliberately choose the subjectively closestremaining option2. An extreme option does not just increase sharing amongthose who already share a lotInstead, it increases sharing across the board
  35. 35. INFORMATION AND COMPUTER SCIENCESApplying these resultsProblem: when designing the ‘optimal’ set of options, users’choice depends on the available optionsProblem for user tests!Combinatorial explosion of the experimental conditionsMore efficient approach:-Ask a sample of users about the perceived Privacy andBenefit of the options-Map them on a plane
  36. 36. INFORMATION AND COMPUTER SCIENCESApplying these resultsBenefit-->Privacy -->6. Introduce to increase overall sharing2. Remove one redundant option1. Remove this dominated option3. Introduce an option toclose this gap4. If desired, remove the left optionto increase the right option5. If desired, replace this optionwith one that is perceptually close
  37. 37. INFORMATION AND COMPUTER SCIENCESTake-home messageDo you want to design an optimal list of(location-sharing) options?Measure the subjective perceptions ofthe options, and apply decision theoriesto decide which are best!Paper draft: http://bit.ly/chi2013privacyMore papers: www.usabart.nlFollow me on Twitter: @usabart
  38. 38. INFORMATION AND COMPUTER SCIENCESGuide for questions:1. With fewer options, users do not just “err on the safe side”Instead, they deliberately choose the subjectively closestremaining option2. An extreme option does not just increase sharing amongthose who already share a lotInstead, it increases sharing across the board3. If you want to design the optimal set of options, measurethe perception of the optionsAnd apply decision theories to argue which are best

×