"When I am on Wi-Fi, I am fearless": privacy concerns & practices in eeryday Wi-Fi use

ABSTRACT

Increasingly, users access online services such as email, e-commerce, and social networking sites via 802.11-based wireless networks. As they do so, they expose a range of personal information such as their names, email addresses, and ZIP codes to anyone within broadcast range of the network. This paper presents results from an exploratory study that examined how users from the general public understand Wi-Fi, what their concerns are related to Wi-Fi use, and which practices they follow to counter perceived threats. Our results reveal that while users understand the practical details of Wi-Fi use reasonably well, they lack understanding of important privacy risks. In addition, users employ incomplete protective practices which results in a false sense of security and lack of concern while on Wi-Fi. Based on our results, we outline opportunities for technology to help address these problems.

REFERENCES

• 1: Anonymous. Wigle.net, http://wigle.net.
• 2: Lorrie Faith Cranor, 'I didn't buy it for myself' privacy and ecommerce personalization, Proceedings of the 2003 ACM workshop on Privacy in the electronic society, October 30, 2003, Washington, DC [doi>10.1145/1005140.1005158]
• 3: Csikszentmihalyi, M. and Larson, R. Validity and reliability of the Experience Sampling Method. Journal of Nervous and Mental Disease, 175, 9, (1987), 526--536.
• 4: Rachna Dhamija , J. D. Tygar , Marti Hearst, Why phishing works, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124861]
• 5: Paul Dourish , E. Grinter , Jessica Delgado de la Flor , Melissa Joseph, Security in the wild: user strategies for managing security as an everyday, practical problem, Personal and Ubiquitous Computing, v.8 n.6, p.391-401, November 2004 [doi>10.1007/s00779-004-0308-5]
• 6: B. Friedman , D. Howe , E. Felten, Informed Consent in the Mozilla Browser: Implementing Value Sensitive Design, Proceedings of the 35th Annual Hawaii International Conference on System Sciences (HICSS'02)-Volume 8, p.247, January 07-10, 2002
• 7: Batya Friedman , David Hurley , Daniel C. Howe , Edward Felten , Helen Nissenbaum, Users' conceptions of web security: a comparative study, CHI '02 extended abstracts on Human factors in computing systems, April 20-25, 2002, Minneapolis, Minnesota, USA [doi>10.1145/506443.506577]
• 8: Julia Gideon , Lorrie Cranor , Serge Egelman , Alessandro Acquisti, Power strips, prophylactics, and privacy, oh my!, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania [doi>10.1145/1143120.1143137]
• 9: Goffman, E. The presentation of self in everyday life. Doubleday, Garden City, NY, 1959.
• 10: Ben Greenstein , Damon McCoy , Jeffrey Pang , Tadayoshi Kohno , Srinivasan Seshan , David Wetherall, Improving wireless privacy with an identifier-free link layer protocol, Proceeding of the 6th international conference on Mobile systems, applications, and services, June 17-20, 2008, Breckenridge, CO, USA [doi>10.1145/1378600.1378607]
• 11: Horrigan, J.B. Home broadband adoption 2008, Pew Internet&American Life Project, Washington, DC, 2008, http://www.pewinternet.org/pdfs/PIP_Broadband_2008.pdf.
• 12: Carlos Jensen , Colin Potts , Christian Jensen, Privacy practices of Internet users: self-reports versus observed behavior, International Journal of Human-Computer Studies, v.63 n.1-2, p.203-227, July 2005 [doi>10.1016/j.ijhcs.2005.04.019]
• 13: Jaeyeon Jung , Anmol Sheth , Ben Greenstein , David Wetherall , Gabriel Maganis , Tadayoshi Kohno, Privacy oracle: a system for finding application leaks with black box differential testing, Proceedings of the 15th ACM conference on Computer and communications security, October 27-31, 2008, Alexandria, Virginia, USA [doi>10.1145/1455770.1455806]
• 14: Tim Kindberg , Eamonn O'Neill , Chris Bevan , Vassilis Kostakos , Danaë Stanton Fraser , Tim Jay, Measuring trust in wi-fi hotspots, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357084]
• 15: Jennifer King , Andrew McDiarmid, Where's the beep?: security, privacy, and user misunderstandings of RFID, Proceedings of the 1st Conference on Usability, Psychology, and Security, p.1-8, April 14-14, 2008, San Francisco, California
• 16: Braden Kowitz , Lorrie Cranor, Peripheral privacy notifications for wireless networks, Proceedings of the 2005 ACM workshop on Privacy in the electronic society, November 07-07, 2005, Alexandria, VA, USA [doi>10.1145/1102199.1102217]
• 17: Owyang, J. Social network stats: Facebook, MySpace reunion (Jan, 2008), 2008, http://tinyurl.com/ywnsgv.
• 18: Erika Shehan Poole , Marshini Chetty , Rebecca E. Grinter , W. Keith Edwards, More than meets the eye: transforming the user experience of home network management, Proceedings of the 7th ACM conference on Designing interactive systems, p.455-464, February 25-27, 2008, Cape Town, South Africa [doi>10.1145/1394445.1394494]
• 19: Jennifer Stoll , Craig S. Tashman , W. Keith Edwards , Kyle Spafford, Sesame: informing user security decisions with system visualization, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357217]
• 20: Strauss, A. and Corbin, J. Basics of qualitative research: Techniques and procedures for developing grounded theory. SAGE, Thousand Oaks, 1998.
• 21: Min Wu , Robert C. Miller , Simson L. Garfinkel, Do security toolbars actually prevent phishing attacks?, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124863]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.0 General

General Terms:
Security

Keywords:
Wi-Fi, privacy, security, user study, wireless networks