Toward De Designing Pri rivacy and Security La Label for or IoT - - PowerPoint PPT Presentation

Toward De Designing Pri rivacy and Security La Label for

• r IoT

IoT De Devices

Pardis Emami-Naeini, Henry Dixon, Yuvraj Agarwal, Lorrie Cranor, Hanan Hibshi pardis@cmu.edu

Roa

• admap to
• de

design IoT IoT Priv rivacy and and Sec ecurit ity Labe abel

• Interviewing average consumers about their IoT-related purchase

behavior

• Conducting expert elicitation study with privacy and security experts
• Going back to average consumers to test the usability and effectiveness
• f IoT privacy and security label
• Incentivizing IoT companies to adopt labeling

2

Exp xploring Ho How Priv rivacy and Secu curity Fact ctor in into IoT IoT De Device Purchase Be Behavior

Pardis Emami-Naeini, Henry Dixon, Yuvraj Agarwal, Lorrie Cranor

4

5

6

7

8

privacy? security?

9

no privacy or security information is available

10

11

12

13

14

no privacy or security information is available

Pol

• lic

icymakers cal alled for

• r IoT

IoT lab labels

15

Pol

• lic

icymakers cal alled for

• r IoT

IoT lab labels

16

but no specific guidelines

Rese esearch qu questio ions

• How much do consumers know about the privacy and security of

their IoT devices?

• In what way would consumers like to consider privacy and security

when making IoT-related purchase decisions?

• How useful and effective would privacy and security labels be for

consumers when purchasing IoT devices?

17

We e recr ecruit ited 24 par partic icip ipants to

• in

interv rvie iew

• One hour semi-structured interview
• 14 female and 10 male
• 8 with technical backgrounds
• Average age: 36
• Compensated with $25 Amazon gift card

18

most common devices our participants had

In Interviews wit ith IoT IoT de devic ice owners

• Pre-purchase behavior
• Post-purchase behavior
• IoT device privacy and security
• Value of privacy and security in purchase decisions
• Privacy and security label evaluation

19

We e de desig igned pr priv ivacy an and sec security ty lab labels ls for

• r 3

hypothetic ical l IoT IoT de devic ices

20

Our ur in inspir iratio ion

21

Kelley, Patrick Gage, Joanna Bresee, Lorrie Faith Cranor, and Robert W. Reeder. "A nutrition label for privacy." In Proceedings of the 5th Symposium on Usable Privacy and Security, ACM 2009.

Labe abel for

• r a

a sm smar art sec securit ity cam amera

22

general information privacy information security information general information

Factors are from our SOUPS’17 paper: Naeini, Pardis Emami, et al. "Privacy expectations and preferences in an IoT world."

Gen eneral in informatio ion

23

Priv rivacy in informatio ion

24

Sec ecurit ity in informatio ion

25

Ter ermin inolo logy to

• rep

eport sm small ll nu numbers

a few some about half most almost all half all none

50% 100% 0% 25% 45% 55% 75%

26

Ter ermin inolo logy to

• rep

eport sm small ll nu numbers

a few some about half most almost all half all none

50% 100% 0% 25% 45% 55% 75%

27

Ter ermin inolo logy to

• rep

eport sm small ll nu numbers

a few some about half most almost all half all none

50% 100% 0% 25% 45% 55% 75%

28

Priv rivacy an and sec securit ity kno nowledge was as li limit ited

• Privacy defined as having control over personal data
• Security was defined as device getting hacked
• About half were unable to differentiate between privacy and security
• Most with pre-purchase or post-purchase concerns were better able to

differentiate between privacy and security

29

active passive

Priv rivacy an and sec securit ity ar are e val alued

• Almost all wanted to know about privacy and security before the

purchase

• Almost all were willing to pay a premium for such info (10%-30%)
• Assurance of being protected
• Peace of mind

30

Pos

• sit

itiv ive attit titude toward lab labels ls

• Interviewees found the labels
• Understandable
• Easy to read
• Useful
• Almost all liked the label concept
• Independent privacy and security ratings
• Choices to control privacy and security

31

Mor

• re focus on
• n convenience tha

than sec securit ity

• Almost all liked automatic

security updates

• Almost all preferred fingerprints
• ver passwords
• Almost all favored optional

Internet connectivity over required connectivity

32

takeaway: align security with convenience

Priv rivacy an and sec securit ity ar are e la latent concerns

• About half had unprompted privacy and security concerns
• Almost all had prompted privacy and security concerns,

mostly caused by:

• Media reports
• Friends’ opinions
• Devices acting weird

33

HAHA

Desi esign gui uideli line: la layered lab label

• Participants requested more

information on some factors

• Definition of some of the terms

(e.g., identifiable data)

• Encryption protocols
• Privacy and security star ratings

34

Labe abels ar are e pr promis ising, but but ar are e no not en enough

• Readily available information at

the point of sale

• Labels need to be adopted
• Mandated by regulations
• Voluntary adoption
• The default should always be

safe

35

Labe abel de desig ign in in pr prog

• gress
• Consumers have limited privacy

and security knowledge

• All want to know about privacy

and security at the point of sale

• All found our labels to be usable

and informing

• Most liked the ratings
• Most liked the choices
• Currently conducting expert

elicitation study (under submission)

• Next to conduct user study with

average consumers

36