Late-Breaking Work CHI 2017, May 6–11, 2017, Denver, CO, USA
APRIM: An Account and PeRsonal Information Manager
Christian Hartlage Delphine Reinhardt Abstract Fraunhofer FKIE University of Bonn and Most online services require the creation of a user account Friedrich-Ebert-Allee 144 Fraunhofer FKIE and the disclosure of personal data, such as addresses or 53113 Bonn, Germany Friedrich-Ebert-Allee 144 phone numbers. With the multiplication of these services, [email protected] 53113 Bonn, Germany the digital footprint left by the users rapidly grows. In order [email protected] to increase the users’ awareness and support them in the bonn.de management of these data, we propose a new account and personal information manager called APRIM. Our solution logs disclosed personal information and presents it to the users in the form of a matrix. We have designed and imple- mented a proof-of-concept and evaluated the concepts and the usability of APRIM by means of a user study involving 18 participants. The results confirm that APRIM is a usable solution to keep track of users’ digital footprint.
Author Keywords Privacy; Digital Footprint; Transparency; Usability; User study
ACM Classification Keywords Permission to make digital or hard copies of part or all of this work for personal or H.5.m [Information interfaces and presentation (e.g., HCI)]: classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation Miscellaneous on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). Copyright is held by the Introduction author/owner(s). CHI’17 Extended Abstracts, May 6–11, 2017, Denver, CO, USA. Many existing websites require users to create an account ACM ISBN 978-1-4503-4656-6/17/05. prior to fully access their online services. To create such http://dx.doi.org/10.1145/3027063.3053125 an account, users usually have to at least provide an e-
1671 Late-Breaking Work CHI 2017, May 6–11, 2017, Denver, CO, USA
mail address and/or a username and choose a password. it to a local database. Users can access the stored informa- Depending on the nature of the services provided by the tion via an interface to get an overview about the personal website, additional personal information must sometimes information of their online accounts. be disclosed, such as a users’ date of birth or credit card number. Consequently, users increase their digital footprint, In addition to presenting APRIM, we evaluate it by conduct- i.e., the amount of personal information disclosed to these ing a user study with 18 participants in a lab setting. In our parties which each newly created account. study, the participants tested a mock-up of APRIM and an- swered two questionnaires. The first one aims at analyzing In order to help users in managing their account informa- their experience with existing solutions, while the second tion and hence protect their personal information, differ- one focuses on their experience with APRIM and the evalu- ent approaches including password managers have been ation of its usability. The results show that most participants proposed and adopted by the users [4]. In this paper, we do not have a good overview of their current digital footprint therefore build on the concept of password managers to al- and that APRIM would help them to have both a better con- low users not only to manage their account information, but trol over it. Overall, the participants rated the usability of also their personal information. By doing so, we aim at re- APRIM as good. ducing the memorization efforts demanded from the users, while simultaneously catering for transparency and aware- Related Work ness of their digital footprint. To this end, our contributions Our solution bridges the gap between existing password can be summarized as follows. managers and auditing tools. By utilizing a combination of a browser extension and a local database, it benefits from We present the design of a new account and personal in- the advantages of both online and offline password man- formation manager called APRIM. Our solution builds on agers in terms of user experience and exposure to online an existing open source password manager FPM2 [9] and threats. Moreover, APRIM integrates a temporal component extends it in two dimensions. In addition to store login in- and proposes a novel compact visualization of disclosed formation, APRIM includes (1) the personal information information. disclosed by the users when creating the corresponding ac- count and (2) temporal information about the creation and Existing password managers can be divided into two cate- the last access of each account as well as the last pass- gories: online and offline password managers. In the former word update. The latter dimension aims at helping users in category, password managers, such as Lastpass [11], or identifying unused accounts, so that they can delete their 1Password [1], directly save and retrieve passwords via the account and linked personal information to reduce their dig- users’ web browsers. By doing so, users do not need to ital footprint. Additionally, it allows users to easily recognize manually enter them during log-in. In these solutions, the passwords which may need to be updated. In order to re- login information is however stored online by the service duce the users’ interactions to the minimum, APRIM is fur- providers. This means that the security of these passwords ther based on a browser extension that seamlessly gathers can be threatened by potential vulnerabilities as demon- the personal information entered by the users and transmits strated in [12] for five well-established password managers.
1672 Late-Breaking Work CHI 2017, May 6–11, 2017, Denver, CO, USA
In addition to passwords, 1Password [1] also manages their analysis and visualization to the users. In contrast, Requirements: users’ identities, shipping details, or credit cards, and syn- Data Disclosure Log offers different graph-based visualiza- chronizes them between devices for a monthly subscription tions. Additionally, Data Track [2] has similar visualization Reduction of memorization fee. As compared to APRIM, the underlying motivation of options, but relies on a larger framework for collecting and efforts: Our solution should 1Password is different. In 1Password, personal data are processing personal data. However, the collaboration of support users in remember- collected to prevent users from manually fulfilling the same the providers of the web services is required to enable its ing login credentials and the web forms, so that the associated overhead is reduced. By full functionality. In the latest version of Data Track, the dis- associated personal data. doing so, the disclosure of personal information is eased, closed information is presented in strace view, which con- Transparency: It should as users can do it in just one click. As shown in [13], auto- nects the different services sharing the same information further allow users in visual- mated entry functions can lead to over-disclosure of per- item based on colored lines. izing and auditing previously sonal information in web forms since optional fields may be disclosed personal data. automatically completed. As a result, APRIM and 1Pass- Requirements word follow two opposite goals, as we aim at raising the Based on our analysis of related work, we identify the re- Non-disruptiveness: It users’ awareness about their digital fingerprint and helping quirements listed in the left margin, which guide the design should not interrupt users’ them to manage it. of our solution. primary tasks, i.e., login or creating a new account. In contrast to online password managers, users’ account Design and Implementation Versatility: It should be ap- information is locally stored in offline password managers In order to meet the aforementioned requirements, our so- plicable independently of like, e.g., Keepass [17]. Users hence avoid exposing their lution relies on a browser extension and a local database the used operating systems, login information and thus personal data to online threats. completed by a GUI. browsers, and websites. Simultaneously, offline managers do not support synchro- nization between devices, and thus require more efforts Browser Extension Autonomous: It should not from the users, as these still need to memorize or manu- It automatically detects the creation of a new account by require the collaboration of ally report them when used with other devices. To address searching for