Developer-centered privacy

Talk at the University of Waterloo Cybersecurity Privacy Institute 6th Annual Conference. The talk covers issues around how develoeprs are learning about what privacy entails and how the documents that claim to support them are sometimes used to influence behavior.

Reliably recruiting participants with programming skills is an ongoing challenge for empirical studies involving software development technologies, often leading to the use of crowdsourcing platforms and computer science (CS) students. In this work, we use five existing survey instruments to explore the programming skills, privacy and security attitudes, and secure development self-efficacy of participants from a CS student mailing list and four crowdsourcing platforms (Appen, Clickworker, MTurk, and Prolific).

Choice framing impacts app developers’ decisions about the settings of mobile advertisements which in turn impacts their users’ privacy. We anticipate that framing and nudging have an impact on choices made by developers. We conducted a survey-based online experiment with 400 participants with experience in mobile app development to find out.

Avertising networks enable developers to create revenue, but using them potentially impacts user privacy and requires developers to make legal decisions. To understand what privacy information ad networks give developers, we did a walkthrough of four popular ad network guidance pages with a senior Android developer by looking at the privacy-related information presented to developers. We found that information is focused on complying with legal regulations, and puts the responsibility for such decisions on the developer.

We analyse Stack Overflow to understand challenges and confusions developers face while dealing with privacy-related topics. Identified topics include privacy policies, privacy concerns, access control, and version changes. Results show that developers do ask Stack Overflow for support on privacy-related issues. We also find that platforms such as Apple and Google are defining privacy requirements for developers by specifying what “sensitive” information is.

Software developers are key players in the security ecosystem as they produce code that runs on millions of devices. Yet we continue to …