Reducing Permission Requests in Mobile Apps

Proceedings of the Internet Measurement Conference 2018 Pub Date : 2019-10-21 DOI:10.1145/3355369.3355584

Sai Teja Peddinti, Igor Bilogrevic, N. Taft, M. Pelikán, Ú. Erlingsson, Pauline Anthonysamy, G. Hogben

{"title":"Reducing Permission Requests in Mobile Apps","authors":"Sai Teja Peddinti, Igor Bilogrevic, N. Taft, M. Pelikán, Ú. Erlingsson, Pauline Anthonysamy, G. Hogben","doi":"10.1145/3355369.3355584","DOIUrl":null,"url":null,"abstract":"Users of mobile apps sometimes express discomfort or concerns with what they see as unnecessary or intrusive permission requests by certain apps. However encouraging mobile app developers to request fewer permissions is challenging because there are many reasons why permissions are requested; furthermore, prior work [25] has shown it is hard to disambiguate the purpose of a particular permission with high certainty. In this work we describe a novel, algorithmic mechanism intended to discourage mobile-app developers from asking for unnecessary permissions. Developers are incentivized by an automated alert, or \"nudge\", shown in the Google Play Console when their apps ask for permissions that are requested by very few functionally-similar apps---in other words, by their competition. Empirically, this incentive is effective, with significant developer response since its deployment. Permissions have been redacted by 59% of apps that were warned, and this attenuation has occurred broadly across both app categories and app popularity levels. Importantly, billions of users' app installs from the Google Play have benefited from these redactions.","PeriodicalId":20640,"journal":{"name":"Proceedings of the Internet Measurement Conference 2018","volume":"19 6","pages":""},"PeriodicalIF":0.0000,"publicationDate":"2019-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"26","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Proceedings of the Internet Measurement Conference 2018","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/3355369.3355584","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 26

Abstract

Users of mobile apps sometimes express discomfort or concerns with what they see as unnecessary or intrusive permission requests by certain apps. However encouraging mobile app developers to request fewer permissions is challenging because there are many reasons why permissions are requested; furthermore, prior work [25] has shown it is hard to disambiguate the purpose of a particular permission with high certainty. In this work we describe a novel, algorithmic mechanism intended to discourage mobile-app developers from asking for unnecessary permissions. Developers are incentivized by an automated alert, or "nudge", shown in the Google Play Console when their apps ask for permissions that are requested by very few functionally-similar apps---in other words, by their competition. Empirically, this incentive is effective, with significant developer response since its deployment. Permissions have been redacted by 59% of apps that were warned, and this attenuation has occurred broadly across both app categories and app popularity levels. Importantly, billions of users' app installs from the Google Play have benefited from these redactions.

查看原文

微信好友朋友圈 QQ好友复制链接

本刊更多论文

减少移动应用中的权限请求

移动应用程序的用户有时会对某些应用程序提出的不必要或侵入性的许可请求表示不适或担忧。然而，鼓励手机应用开发者请求更少的权限是一项挑战，因为请求权限的原因有很多;此外，先前的研究[25]表明，很难高度确定地消除特定许可的目的歧义。在这项工作中，我们描述了一种新颖的算法机制，旨在阻止移动应用程序开发人员请求不必要的许可。当开发者的应用请求很少有功能相似的应用请求权限(换句话说，是他们的竞争对手)时，谷歌Play控制台就会显示自动提醒或“提示”，以此激励开发者。从经验上看，这种激励是有效的，自部署以来开发人员的反应很大。在收到警告的应用中，有59%的应用修改了权限，这种减少在应用类别和应用受欢迎程度上都广泛发生。重要的是，从Google Play安装应用的数十亿用户都受益于这些修订。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文去求助

来源期刊

Proceedings of the Internet Measurement Conference 2018

自引率

0.00%

发文量

期刊最新文献

Reducing Permission Requests in Mobile Apps A Look at the ECS Behavior of DNS Resolvers RPKI is Coming of Age: A Longitudinal Study of RPKI Deployment and Invalid Route Origins Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope Learning Regexes to Extract Router Names from Hostnames