Explore
For Enterprise
Join for Free
Log In

Arts and Humanities
Business
Computer Science
Data Science
Information Technology
Health
Math and Logic
Personal Development
Physical Science and Engineering
Social Sciences
Language Learning
Degrees and Certificates

Explore all of Coursera

Browse
Search
For Enterprise
Log In
Join for Free

5 Pitfalls of Privacy

Loading...

Usable Security

University of Maryland, College Park

4.5 (1,462 ratings) | 36K Students Enrolled

Course 1 of 5 in the Cybersecurity Specialization

This course focuses on how to design and build secure systems with a human-centric focus. We will look at basic principles of human-computer interaction, and apply these insights to the design of secure systems with the goal of developing security measures that respect human performance and their goals within a system.

Skills You'll Learn

Cybersecurity, Usability, Privacy, User Interface

Reviews

4.5 (1,462 ratings)

5 stars
955 ratings
4 stars
380 ratings
3 stars
77 ratings
2 stars
23 ratings
1 star
27 ratings

MM

Sep 22, 2017

I am really happy to join this perfect course . i want to continue in this course and i will every time of my life to learn many things . specially from the Coursera community thank you very much.

KM

Jul 15, 2018

It gave me a broader scope in terms of developing a process or a system. It taught me that designing usability and security must come during the early stages of design instead of an after thought.

From the lesson

Week 6

Usable Privacy: privacy settings, personal data sharing, data inference

Usable Privacy Basics8:39

Privacy Policies and User Understanding9:50

Informed Consent for Privacy13:56

5 Pitfalls of Privacy9:35

Inferring Personal Data and Policy 10:51

Taught By

Jennifer Golbeck
Director

[SOUND] In this lecture we're going to be

looking at five pitfalls in designing for privacy.

The lessons in here are discussed much more in-depth in this paper which is

linked in the readings, and which you should take a look at.

The five pitfalls for designing for privacy can be broken into two categories.

The first is understanding.

And in this category, we have two main pitfalls,

obscuring potential information flow, and obscuring actual information flow.

And we'll get to the details of what these actually mean in a minute.

The second category of pitfalls is action.

And there's three additional pitfalls in this category.

Emphasizing configuration over action, lacking coarse-grained control, and

inhibiting established practice.

What we are going to do in the rest of this video is look at each of

these five pitfalls along with examples of each, when they're done poorly,

and when they're done well.

So, let's take those first two,

obscuring potential information flow and obscuring actual information flow.

Both of these require us to understand what information flow is.

So, let's look at that.

Information flow talks about when people are sharing information.

Who is it shared with?

What kind of information is it?

Who are the kind of observers, who are the people who will see that information?

The media through which it's conveyed.

The length of the retention of the information.

The potential for unintended disclosure of the information.

Collection of metadata, and other things that fall in these categories.

Essentially, users are creating a lot of information, and

they should know what's done with it, and where it's going after it's created.

If we're talking about obscuring potential information flow.

That means that there's a possible way information can be shared, but

it's not made clear to the users how that's actually going to happen.

So here is an example of a Gmail account and though there's no messages in

the inbox, you can see that there's ads across the top.

People have been upset, and

there's actually been a lot of press over the fact that, these ads can be targeted

based on the content of the messages that you send and receive on gmail.

Google doesn't actually show anyone the content of your messages.

They automatically analyze them on their servers and

take ads where the advertisers have expressed key words, and

matched those to the things they've analyzed in your messages.

But people were very concerned that the content of their messages were

being shared with advertisers, it was just unclear what Google was doing on Gmail,

and that made a lot of people concerned.

When we're talking about obscuring actual information flow,

that means that information is being shared in a specific way, but

that's being hidden from the users.

Here's an example of that.

So here we're looking at the settings section of the iPhone, and

if we go to privacy, and then location services,

if we scroll all the way to the bottom of this window, you can see system services.

System services brings up a long list, and

if we scroll down there, we find a section called frequent locations.

This is a list of places that I go frequently.

It's automatically pulled up the names of these places, I haven't entered it.

And if we were to click the first one, College Park, Maryland.

You can see it actually has a map, and addresses of places that I go a lot.

The three dots on here are the computer science building,

the information studies building where my office is, and

the Potbelly, where I go for lunch all the time.

I haven't checked into these places.

I haven't entered it.

This is just something that the iPhone picks up because it's constantly tracking

location, and it's an example of where information is being sent.

And privacy isn't really controlled by the user,

because I haven't consented to this kind of information being collected.

I wouldn't consent to it if I had control over it.

But there's also no obvious way for me to change those privacy settings.

Essentially, this kind of data collection and this lack of

privacy is concealed by Apple and iPhone, and users don't have any control over it.

The next pitfall is emphasizing configuration over action.

This is something that happens when privacy management gets all caught up in

privacy tools, and users have to control lots of settings.

Instead of privacy being just a natural part of workflow,

the guideline here is that privacy management should be integrated into

the natural workflow of users so that they don't have to think about it.

And, remember that this ties back to a guideline that we had for

usable security, that security should be built into the natural workflow of users.

Privacy and security are really two parts of the same issue,

and so it's not surprising that we see that same guideline here.

Our next pitfall is lacking coarse-grained control.

Lots of systems have fine-grained control, where you can get in and

set a lot of preferences, and really do some detailed things with privacy.

But it's also really useful to have a high level,

obvious control where you can turn sharing on and off.

This is useful if, for

example on social media, you want to share a post publicly or with friends.

There's all kinds of intense control that you can get in to on social media, but

having one control where you can just easily switch that privacy level,

makes control a lot easier.

Similarly, there may be times when you're interacting in a system, and

you just want to turn off data collection from yourself.

Imagine this like an airplane mode on your phone, but for privacy.

Let's look first at an example on Amazon, where it

would be really useful to have this kind of control, but is not available.

So here's an example of Amazon.

Say I want to buy a copy of Harry Potter for my niece.

I can search for that, I can click on the book, and then I can either buy it or

maybe I change my mind, but when I go back to the Amazon main page.

Now I have all of these recommended items for Harry Potter,

which I have no interest in actually buying for myself.

It would be great to have some sort of control where I can turn off

the system here that keeps track of what I'm looking at.

In a sense it's a privacy setting and

I can use it to improve the way the system interacts with me.

But, while you can go in and turn off some things that it has looked at in the past,

there's no easy way to simply browse or

click a button to turn off tracking of my searches.

And thus, I end up often with a lot of irrelevant items being recommended to me.

On the other hand, Facebook actually does have some of

these coarse-grained top level controls, in addition to the more detailed controls.

And we can take a look at that example too.

Here's an example user's Facebook profile.

If he tries to type a status update,

you can see that explicit privacy controls appear to let him change who can see it.

This is pretty fine-grained.

There's public friends, and if he wants to do something that's more fine-grained,

there's more options including a custom options,

which brings up a lot of controls.

However, as a high-level way of controlling privacy,

this switch is pretty easy to deal with.

You don't have to do any complicated settings.

You don't need to go in and do some system level settings.

You're typing a post.

It has a default value, but you can always change it in a quick and easy way.

Our final pitfall is inhibiting established practice.

Essentially this means that we want to ask what do users expect from

other experiences.

And then we want to let them expect that here too.

This ties into mental models, conventions, and

other expectations that we talked about in the first week of class.

Basically if a user expects and

is used to things working in a certain from other systems.

Your system should work the same way when it comes to protecting your privacy.

For example, when we make phone calls they don't actually identify the location of

where we're making a call.

But new technology on cell phones that can pinpoint your

exact location could share that data.

Now is it a good idea to share that information or not?

Well, users might expect from their other experiences making calls,

that their location isn't shared.

And so it can come as quite a shock and

feel like a privacy violation if that data is shared.

Let's look at a quick sketch that we call Frankie and Nancy to see what this means.

>> Hello.

>> Frankie?

>> Oh, Hi Nancy.

>> Where are you?

>> I'm at Bob's house.

>> No, you're not.

Your phone says you are in Paris.

>> So, remember, privacy system designers, don't share information like location data

or other potentially private information, just because you can.

Make sure it's something users would expect to be shared.

And if they wouldn't expect it, don't share it.

In conclusion what we can take away from these five pitfalls are three really

high level rules.

First we should make it clear to users how information is being shared.

There shouldn't be any ambiguity and

we shouldn't try to cloak information sharing that's actually going on.

Second, we should make it easy and natural for users to control privacy at all

levels as part of their normal workflow, and in both coarse and fine-grained ways.

And finally, you should make the default practice match users' expectations.

Explore our Catalog

Join for free and get personalized recommendations, updates and offers.

Coursera provides universal access to the world’s best education, partnering with top universities and organizations to offer courses online.

© 2019 Coursera Inc. All rights reserved.

Download on the App Store

Get it on Google Play

Coursera
About
Leadership
Careers
Catalog
Certificates
MasterTrack™ Certificates
Degrees
For Enterprise
For Government

Community
Learners
Partners
Developers
Beta Testers
Translators

Connect
Blog
Facebook
LinkedIn
Twitter
Instagram
YouTube
Tech Blog

More
Terms
Privacy
Help
Accessibility
Press
Contact
Directory
Affiliates