Visualizing Risk by Example: Demonstrating Threats Arising From Android Apps

Previous research has shown that only 17 % of Android smartphone users are consciously aware of the specific permissions an app demands during installation [2]. While this result is hardly surprising, it still puts the majority of smartphone users at risk. Kelley et al. recently argued that since permissions are not shown until after the installation button has already been pressed, the risks potentially arising from excessive app privileges are not part of the user’s decision process anymore [3]. They introduced a modified app information screen and showed that users became more reluctant to install apps requesting too many permissions. While they were able to increase the awareness of requested permissions, participants still reported that they were unsure about the threats arising from apps requesting too many permissions. We can conclude that users currently show limited awareness of threats and risks during the selection and installation of a new app and that the safety of their personal data is at stake. We believe that this situation can be improved by emphasizing the risks associated with an app’s installation. Thus, we evaluated a novel presentation of app permissions: our prototype illustrates risks arising from app permissions in the form of worst-case examples to demonstrate potential attack scenarios resulting from the malicious use of the requested permissions. In related work, Rader et al. [4] showed that many users learn about security from informal stories told by family and friends. Hence, in the terms of their work, we try to let the app market tell the user small stories about how private information may be at risk. In this position paper, we suggest to assist users in understanding permissions by using examples to communicate risk. We present results from a pilot study that evaluate the effectiveness of this approach. We compare app installation counts of the original Android market with our improved display. Our results show that making threats graspable