Gluten Is My Bitch: Rants, Recipes, and Ridiculousness for the Gluten-Free
Panel: Prototyping and Building Systems Four Rants on Privacy and Ubicomp Jason I. Hong jasonh at cs...
-
Upload
harry-dalton -
Category
Documents
-
view
217 -
download
1
Transcript of Panel: Prototyping and Building Systems Four Rants on Privacy and Ubicomp Jason I. Hong jasonh at cs...
Panel: Prototyping and Building Systems Four Rants on Privacy and Ubicomp
Jason I. Hong
jasonh at cs cmu edu
Intel Usable Privacy Forum
Rant Overview
• We should push client-centered ubicomp more• We should examine how people already manage
their privacy today• We need to develop better privacy risk models• We need better ways of aligning all stakeholders
Rant #1
We should push client-centered ubicomp more
• Find nearby “interesting” events– Notify me whenever Yo-Yo Ma is in town
– Pull out in a bar to find next thing to go to
• How Whisper works– Crawls web for events
– Every morning, download all events in “Portland” onto PDA
– Calculate location locally (ex. Place Lab)
– Filter events locally based on interests and location
– Whisper only knows you are in “Portland”
Whisper Event Service
• Useful location-based service in privacy-sensitive way
• Basic idea:– Local sensing, local storage, local processing
– Provide better control and feedback over sharing
• Examples:– Sensing: GPS, Cricket, Place Lab
– Storage: Occasionally Connected Computing• Sync up lots of potentially useful info beforehand
– Anonymous Broadcast• Satellites (GPS, Sirius or XM), Radio (AM / FM)
• Research issues:– Range of services possible? Tradeoffs?
– What kinds of mental models? User interfaces?
– Client-centered arch is structural, combine with algorithmic?
Client- Centered Architectures
Rant #2
We should examine how people already
manage their privacy today
Projecting Personas
How Do People Manage Privacy Today?
• What we wear, how we talk, who we eat with, etc– Not just secrecy
– Not just control and feedback
– Not just informed consent
Interaction is a “performance” shaped by environment and audience, constructed to project an “impression” consonant with desired goals of the actor
How Do We Manage Impressions?
• Spatial boundaries– Ex. closing door, seeing who else is around
– Leverages our understanding of physics
• Temporal boundaries– Ex. Big Hair in the 80s
• Social and Organizational boundaries– Ex. student and advisor, student and peers
– Leverages our understanding of social roles and power
• “Place / Activity” boundaries– Ex. “at work”, “at home”, “in the car”, “on my way”
But Ubicomp Disrupts Our Understanding
• You think you are in one context, actually overlapped in many others
• Without this understanding, cannot act appropriately and project desired persona
Possible Research Directions
• Foster better mental models– Sensor notifications, ex. beeps at new people to see– Make sensing viscerally clear at the physical layer
• Match people’s existing mental models– Be mostly harmless, ex. reduce identifiability– Locality, ex. limit queries or broadcast by location– Minimize boundary crossings at deploy-time– Sense bounds and adapt (possible??)
• Leverage other existing techniques– Plausible deniability, ex. missed cell phone call
• Ex. How good / reliable do we want infrastructure to be?– Incremental steps with familiar tech, ex. web browser or IM– Make risky things look scary, “hair standing on back of neck”
But a Word of Caution…
Lederer, MS Thesis, UC Berkeley, 2004
Rant #3
We need to develop better privacy risk models
Privacy Risk Model AnalogySecurity Threat Model
“[T]he first rule of security analysis is this: understand your threat model. Experience teaches that if you don’t have a clear threat model – a clear idea of what you are trying to prevent and what technical capabilities your adversaries have – then you won’t be able to think analytically about how to proceed. The threat model is the starting point of any security analysis.”
- Ed Felten
• Example privacy risks– Overzealous parents, “friendly stalkers”
– Undesired social obligations
– Location-based spam
– Employer monitoring
– Identity theft, spyware, viruses, phishing
– Muggers, domestic abusers, not-so-friendly stalkers
– 1984 governments
• No system can account for every conceivable risk• Need methods and tools for assessing and prioritizing
risks to provide a reasonable level of privacy against foreseeable risks
Why Privacy Risk Models?
• Getting it right the first time is hard• Need better support for going quickly around this loop
Iterative Design for Assessing Risks
Design
Prototype
Evaluate
• Basic Idea:– Get feedback from real users early on
– Go thru multiple iterations quickly and easily before actually building and deploying apps
– Involve people beyond application developers• Ex. Interaction designers, sociologists, lawyers, etc
• Examples:– Topiary
Li, Hong, Landay, UIST2005
Idea #1: Rapid Prototyping Tools
• Basic Idea:– Get feedback from real users early on
– Go thru multiple iterations quickly and easily before actually building and deploying apps
– Involve people beyond application developers• Ex. Interaction designers, sociologists, lawyers, etc
• Examples:– Topiary
• Research issues:– How far can we go with prototyping tools for ubicomp?
• Ex. How much sensing can we fake? Range of apps? Space and time issues?
– How to support larger-scale prototypes?
Idea #1: Rapid Prototyping Tools
• More dissemination of risks with specific data types– Case studies
– Design patterns
• Task analysis / Checklist analogy– Social: Relationship between people?
– Tech: Where is data stored? – Interaction: Optimistic / Interactive / Pessimistic (Povey
2002)
(Hong, Ng, Lederer, Landay, DIS2004)
• Extreme programming analogy– One team builds, another attacks or subverts
Idea #2: Methods for Analyzing Risks
• Can we measure a system’s level of privacy?– Could compare designs systematically
– Crystallize idea of privacy in app developer minds
– Hopefully lead to an “arms race” (MHz, GB, and “Westins”)
• Example: location data– How precisely / how often can a service ID your location?
– Privacy vs. bandwidth (ex. requesting chunks of data)
– Privacy vs. timeliness (ex. use cached data)
– Defend vs specific scenarios (ex. price discrimination)
• Possible approaches:– TREC bakeoffs on corpus of location data
– TREC bakeoffs on architectures
Idea #3: Information Privacy Metrics
Rant #4
We need better ways of aligning all stakeholders
• Aligning stakeholder interests– Government – homeland security / accountability
– Market – making money
– App developers – scalable, robust, and “cool”
– …
• Few incentives for doing the right thing– Why make sensors obvious? Extra cost in manufacturing
– Why program it that way? Extra cost in learning and programming for app developers
– Why not collect info? Lowers opportunities for marketing
Hardest Part of Ubicomp Privacy
• Service: payment support for ubicomp– Cross-subsidization, ex. mall tour guide
– Ad-based, ex. radio
– Public service, ex. GPS
– Service per use, ex. credit card, micropayments
• Third parties for managing your privacy?– Only disclose your location info in emergencies (MedicAlert)
– Warn you about bad services
– You’ve already disclosed A and B, don’t disclose C
– Privacy Angel, Private Computation
Idea #1: Figure out sustainable biz models
(Boddupalli et al. WMCSA2003)
• Develop better toolkits, infrastructures, etc• Market them to app developers
– Easy to learn (leverage existing tech, ex. http?)
– Easy to create cool apps
– Scalable, robust
– Oh yeah, and privacy too (for free)
• Probably not best approach, but might get us 80% of the way there– Surreptitiously sneak privacy into the core ubicomp fabric
– Popularize it to become the de facto standard
Idea #2: Bottom-up with App Developers
Rant Summary
• Push client-centered ubicomp first– Local sensing, local storage, local processing
– Better user interfaces when sharing personal info
• How people already manage their privacy today– Projecting personas
– Plausible deniability
• Better privacy risk models– Rapid prototyping tools
– Analysis methods
– Metrics
• Better ways of aligning all stakeholders– Biz models
– App developers
• Payment Support in Ubiquitous Computing Environments, by Boddupalli et al. (WMCSA2003)
• Privacy Risk Models for Designing Privacy-Sensitive Ubiquitous Computing Systems, by Hong et al. Designing Interactive Systems (DIS2004).
• Topiary: A Tool for Prototyping Location-Enhanced Applications, by Li, Hong, and Landay. (UIST2004)
Some Relevant Papers
Bonus Slides
• Scope and scale– Everywhere, any time
• Easier to collect and share info– Location, activities, habits, hobbies, people with
• Breaks existing notions of space and time– Close the door
– Whisper to people
• Machine readable and searchable
How Ubicomp Changes the Landscape
• Basic Idea:
• Examples:
• Research Issues
Privacy-Sensitive Ubicomp ArchitecturesMultiple Layers of Privacy
Physical / Sensor
Infrastructure
Presentation
Cricket Location Beacons, Active Bats
P3P, Privacy Mirrors
ParcTab System, Context Toolkit
Privacy Perspective #1Control and Feedback
“The problem, while often couched in terms of privacy, is really one of control. If the computational system is invisible as well as extensive, it becomes hard to know:
– what is controlling what
– what is connected to what
– where information is flowing
– how it is being used
The Origins of Ubiquitous Computing Research at PARC in the Late 1980s
Weiser, Gold, Brown
Empower people so they can choose to share:
• the right information• with the right people or services• at the right time
• Make it easy for organizations to do the right thing– Detecting abuse (ex. honeypots, audits)
– Better database aggregation and anonymization
– Better org-wide policies and enforcement
• Make it easy for organizations to do the right thing– Detecting abuse (ex. honeypots, audits)
– Better database aggregation and anonymization
– Better org-wide policies and enforcement
Challenges
• Basic idea:– Local sensing, local storage, local processing
– Provide better control and feedback over sharing
• Examples:– Sensing: GPS, Cricket, Place Lab
Client- Centered Architectures
A B
C