Preference-based Location Sharing: Are More Privacy Options Really Better?
Upcoming SlideShare
Loading in...5
×
 

Preference-based Location Sharing: Are More Privacy Options Really Better?

on

  • 315 views

Paper presented at CHI 2013 in Paris

Paper presented at CHI 2013 in Paris

Statistics

Views

Total Views
315
Views on SlideShare
315
Embed Views
0

Actions

Likes
0
Downloads
10
Comments
1

0 Embeds 0

No embeds

Accessibility

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Preference-based Location Sharing: Are More Privacy Options Really Better? Preference-based Location Sharing: Are More Privacy Options Really Better? Presentation Transcript

  • Preference-based Location SharingAre More Privacy Options Really Better?Bart P. KnijnenburgDepartment of Informatics, UC IrvineAlfred KobsaDepartment of Informatics, UC IrvineHongxia JinSamsung R&D Research Center
  • INFORMATION AND COMPUTER SCIENCESOutlineShould sharing profiles be simple or complex?What happens when you add/remove sharing options?Users choose based of their perception of the optionsA method for designing better sharing options
  • INFORMATION AND COMPUTER SCIENCESProfile-based location sharingFigure 5 – Locaccino privacy settings pageWe address in detail the topic of privacy policies, presenting the necessary formalism insection 3.1.2.Who Can Locate MeThis page is intended to provide privacy awareness to the user, in the sense that the
  • INFORMATION AND COMPUTER SCIENCESWhy socomplex?
  • INFORMATION AND COMPUTER SCIENCESLocaccinoresearchers:-Users willotherwise err onthe safe sideDecision scientists:-Depends onperception ofthe options
  • (part 2/3)Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:Your friendsYour colleaguesBest friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue
  • (part 2/3)aring yourdst your sharing preferences forreferences, and on some pagestings for sharing with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue(part 2/3)aring yourdst your sharing preferences forreferences, and on some pagestings for sharing with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue(part 2/3)aring yourdst your sharing preferences forreferences, and on some pagestings for sharing with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, Steven,FrankDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationContinue
  • Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:
  • Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:??1.removingthe Cityoption
  • Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:? ?2.introducingthe Exactoption
  • INFORMATION AND COMPUTER SCIENCESWithout Exact (−E) With Exact (+E)WithoutCity (−C)WithCity (+C)Main manipulationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationres Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationes Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevenFrankDuring work hrs: Outside work hrs:John, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevenFrankDuring work hrs:nothingOutside work hrs:nothingand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas,FrankDuring work hrs:ring with:John, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas,FrankDuring work hrs:nothingg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationg preferences forand on some pagesring with:Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact location
  • INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusWe believe that peoplechoose based on theirperception of the optionsHow do people perceivethese options?Privacy calculus:Trade-off betweenprivacy and benefitEBNprivacy -->benefits-->C
  • INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->C
  • INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->C
  • INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->C
  • INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->CHigh privacy, low benefit
  • INFORMATION AND COMPUTER SCIENCESPlotting the privacy calculusFor each recipient, rateprivacy and benefit (-3 to 3):“I do not want [recipient] toknow where I am” (Privacy)“My location could be usefulfor [recipient]” (Benefit)- For apps/coupons: “I couldbenefit from [recipient]”Plot the average Privacy andBenefit of each option on aplaneEBNprivacy -->benefits-->CLow privacy, high benefit
  • Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:??1.removingthe Cityoption
  • INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:Three situations:1. City is subjectively distinctfrom Nothing and Block:-Luce’s Choice Axiomholds-The ratio N : B+E will staythe sameUsers will prefer both sidesproportionally when City isremovedEBNprivacy -->benefits-->Cprivacy -->
  • INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:2. City is subjectively closerto Nothing than to Block:-Tversky’s SubstitutionEffect holds-C is a substitute for N-When we remove C,N will increase morethan B+EUsers will err on the safe sideEBNprivacy -->benefits-->C
  • INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:3. City is subjectively closerto Block than to Nothing:-Tversky’s SubstitutionEffect holds-C is a substitute for B-When we remove C,B will increase morethan NUsers will prefer the morerevealing sideEBNprivacy -->benefits-->C
  • ResultsWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingWithout Exact (−E) With exact (+E)Withoutcity(−C)y(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->26.729.918.624.8Benefit-->ExactBlockCityNothing
  • Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingResultsSize:percentageof peoplechoosingthis option
  • ResultsWWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)Privacy --> Privacy -->48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->Position:perceptionin terms ofprivacy andbenefit
  • ResultsWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingleft vs.right:comparisonof withoutvs. withExact
  • ResultsWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothingbottomvs. top:comparisonof with vs.withoutCity
  • Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsCity is closer to Block(0.45pts) than to Nothing(2.25pts)Substitution effect!Only the share of Blockdiffers significantlybetween –C and +C(24.2pp)ExactBlockCityNothing
  • Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsDistance from City toNothing and Block is moreequalLuce’s choice axiom!Both Nothing (14.3pp)and Block (9.1pp) differbetween –C and +CEffect on Nothing islarger, because City issomewhat closer toNothingWithout Exact (−E) With exact (+E)Withoutcity(−C)y(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->26.729.918.624.8Benefit-->ExactBlockCityNothing
  • Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:ages Best friendsJohn, Dave, EthanDuring work hrs:nothingcitycity blockexact locationOutside work hrs:nothingcitycity blockexact locationOther friendsBen, Robert, Thomas, Mike, Paul, StevFrankDuring work hrs: Outside work hrs:? ?2.introducingthe Exactoption
  • INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:Two situations:1. Exact is subjectively closeto Block:-Tversky’s SubstitutionEffect holds-E is a substitute for BOnly B will decrease whenE is introducedEBNprivacy -->benefits-->C
  • INFORMATION AND COMPUTER SCIENCESDecision theory hypotheses:2. Exact is more distant:-Simonson’s CompromiseEffect holds-B is no longer an extreme,but a compromise-B attracts some from Cand N-Still some Substitution ofB to EIn sum: Sharing increasesacross the boardBNprivacy -->benefits-->CE
  • INFORMATION AND COMPUTER SCIENCESWWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)Privacy --> Privacy -->48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsExact is subjectively closeto BlockSubstitution effect!the availability of Exactmainly affects the share ofBlock (21.5pp)Without Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ExactBlockCityNothing
  • INFORMATION AND COMPUTER SCIENCESWWithout Exact (−E) With exact (+E)Withoutcity(−C)Withcity(+C)Privacy --> Privacy -->48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->40.432.626.9Benefit-->Privacy -->26.729.918.624.8Benefit-->Privacy -->ResultsExact is further awayfrom BlockCompromise effect!Block is only reduced by8.3pp, as it regains someshare from Nothing(reduced by 13.7pp)Without Exact (−E) With exact (+E)Withoutcity(−C)48.851.2Benefit-->Privacy -->41.029.729.3Benefit-->Privacy -->ExactBlockCityNothing
  • INFORMATION AND COMPUTER SCIENCESTwo conclusions1. With fewer options, users do not just “err on the safe side”Instead, they deliberately choose the subjectively closestremaining option2. An extreme option does not just increase sharing amongthose who already share a lotInstead, it increases sharing across the board
  • INFORMATION AND COMPUTER SCIENCESApplying these resultsProblem: when designing the ‘optimal’ set of options, users’choice depends on the available optionsProblem for user tests!Combinatorial explosion of the experimental conditionsMore efficient approach:-Ask a sample of users about the perceived Privacy andBenefit of the options-Map them on a plane
  • INFORMATION AND COMPUTER SCIENCESApplying these resultsBenefit-->Privacy -->6. Introduce to increase overall sharing2. Remove one redundant option1. Remove this dominated option3. Introduce an option toclose this gap4. If desired, remove the left optionto increase the right option5. If desired, replace this optionwith one that is perceptually close
  • INFORMATION AND COMPUTER SCIENCESTake-home messageDo you want to design an optimal list of(location-sharing) options?Measure the subjective perceptions ofthe options, and apply decision theoriesto decide which are best!Paper draft: http://bit.ly/chi2013privacyMore papers: www.usabart.nlFollow me on Twitter: @usabart
  • INFORMATION AND COMPUTER SCIENCESGuide for questions:1. With fewer options, users do not just “err on the safe side”Instead, they deliberately choose the subjectively closestremaining option2. An extreme option does not just increase sharing amongthose who already share a lotInstead, it increases sharing across the board3. If you want to design the optimal set of options, measurethe perception of the optionsAnd apply decision theories to argue which are best