Social Network Engineering for Secure Web Data and Services Luca Caviglione National Research Council of Italy, Italy Mauro Coccoli University of Genoa, Italy Alessio Merlo University of Genoa, Italy & Università Telematica E-Campus, Italy Managing Director: Lindsay Johnston Editorial Director: Joel Gamon Book Production Manager: Jennifer Yoder Publishing Systems Analyst: Adrienne Freeland Development Editor: Myla Merkel Assistant Acquisitions Editor: Kayla Wolfe Typesetter: Alyson Zerbe Cover Design: Jason Mull Published in the United States of America by Information Science Reference (an imprint of IGI Global) 701 E. Chocolate Avenue Hershey PA 17033 Tel: 717-533-8845 Fax: 717-533-8661 E-mail: [email protected] Web site: http://www.igi-global.com Copyright © 2013 by IGI Global. All rights reserved. No part of this publication may be reproduced, stored or distributed in any form or by any means, electronic or mechanical, including photocopying, without written permission from the publisher. Product or company names used in this set are for identification purposes only. Inclusion of the names of the products or companies does not indicate a claim of ownership by IGI Global of the trademark or registered trademark. Library of Congress Cataloging-in-Publication Data Social network engineering for secure web data and services / Luca Caviglione, Mauro Coccoli, and Alessio Merlo, editors. pages cm Includes bibliographical references and index. Summary: “This book provides empirical research on the engineering of social network infrastructures, the development of novel applications, and the impact of social network- based services over the internet”--Provided by publisher. ISBN 978-1-4666-3926-3 (hardcover) -- ISBN 978-1-4666-3927-0 (ebook) -- ISBN 978-1-4666-3928-7 (print & perpetual access) 1. Online social networks--Security measures. 2. Data protection. I. Caviglione, Luca II. Coccoli, Mauro, 1980- III. Merlo, Alessio, 1966- HM742.S6287 2013 302.3--dc23 2012051554 British Cataloguing in Publication Data A Cataloguing in Publication record for this book is available from the British Library. All work contributed to this book is new, previously-unpublished material. The views expressed in this book are those of the authors, but not necessarily of the publisher. 162 Chapter 8 Privacy Issues in Social Networks Alexandros Papanikolaou Technological Educational Institute of Larissa, Greece Vasileios Vlachos Technological Educational Institute of Larissa, Greece Periklis Chatzimisios Alexander Technological Educational Institute of Thessaloniki, Greece Christos Ilioudis Alexander Technological Educational Institute of Thessaloniki, Greece ABSTRACT The inherent human need for communication and socialization is the reason for the ever-increasing use of social networking services. Social networks are a very powerful communications tool that also has the ability of aggregating large volumes of information. However, if this user-related information is exploited in certain ways, it can have harmful consequences on user privacy. This chapter defines what privacy is in the context of social networks, demonstrates how user privacy can be violated, and supports these claims with examples of real incidents. Furthermore, it presents various countermeasures, as well as directions for future research with the common goal of the protection of user privacy. INTRODUCTION allows users to interact and collaborate, generate and/or publicize content or knowledge in a virtual The evolution of the Internet and the computer community. Given this social aspect of Web 2.0, technologies in general, have given birth to the it focuses on three main aspects: a) Information so-called Web 2.0, which features user-centered management, which deals with finding, evaluat- design, participatory information sharing, in- ing and administrating the content, b) relation- teroperability and collaboration, as well as a rich ship management that involves the creation and collection of web applications. A Web 2.0 site maintenance of contacts and c) self-management DOI: 10.4018/978-1-4666-3926-3.ch008 Copyright © 2013, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited. Privacy Issues in Social Networks that deals with the presentation of personal in- ing, privacy is directly related to the protection formation (Pekárek & Pötzsch, 2009). Generally of personal data, whereas confidentiality is the speaking, Web 2.0 follows the Web-as-a-Platform prevention of information disclosure to certain model, where a user requires only a web browser individuals or groups. Hence, privacy is a subset to access various web applications, regardless of of confidentiality. There are three main rights that Operating System type (e.g., Microsoft Windows, social network users should demand, in order to Linux, MacOS X), without the need of specific be able to protect their privacy (Opsahl, 2010): client software, thus loosening the dependency on a particular desktop computer. • The right to informed decision-making: Perhaps two of the most representative ex- That is, the users should have access to amples of Web 2.0 are social networks and col- a clear user interface that allows them to laborative workspaces. Social networks are virtual control who accesses their data and how societies where users create and manage their this data is used. In addition, they should profiles, communicate, interact and establish con- be able to see who and when accesses their nections with other users, view their connections’ data, as well as which parts of their data get profiles and traverse through their connections’ accessed, and not just control full access in contacts. Examples of the most popular social a “yes/no” manner. What is more, it would networks are Facebook, Twitter and LinkedIn. be desirable to have an alert raised when Collaborative workspaces provide the required legal or administrative processes have been infrastructure to facilitate collaboration and invoked, in order to acquire information knowledge sharing among users or user groups. about a given user. File-sharing systems, online collaborative editors, • The right to control: The social network wikis and so on are some examples; Google Docs, service (SNS) must ensure that users retain for instance, is a popular and free collaborative control over the way their data is used and workspace available to all Google subscribers. disclosed. For example, a third-party ap- Both of these communities feature some common plication should not be able to gather any functionality, such as the organization of contacts personal information about a user through in groups/workspaces, the ability to monitor a their friends, unless the user specifically user’s activity or be notified (usually via e-mail) allows it to do so. However, there are ad- when a certain event or user activity occurs. Ex- ditional difficulties in achieving this goal, amples of other communities that have emerged due to the basic functionality of the Web through Web 2.0 are Mobile Social Networks that facilitates copying, linking and distrib- (namely, social networks where the individuals uting any kind of information on a massive connect to each other through their mobile phones scale. Furthermore, sometimes this is al- and/or tablets) and cloud communities (such as most impossible to control, like in the case Dropbox for file storage and Amazon EC2 for of a digital photograph showing more than computational power). one person that is also possessed by some As the popularity of such online communities of them (e.g., a group of friends); it only increased, counting hundreds of thousands of us- suffices for one of them to disclose it to ers, privacy concerns arose. The notion of privacy the social network service, in order for the is rather polymorphic and depends heavily on the latter to be able to associate all the indi- context it is found in, as well as on the individual viduals with the depicted event or location himself (Nissenbaum, 2004). Generally speak- (e.g., through face recognition software). 163 Privacy Issues in Social Networks • The right to leave: The users must retain PRIVACY IN SOCIAL NETWORKS the right to be able to discontinue the use of a particular social network service and In the context of social networks, privacy is not have all of their profile-related data deleted only related to the information content a user (or exported in a usable format – data lib- creates through uploading and interacting with eration), rather than denying access to the other users. In order to explain this better, we first “deleted” data. This was actually one of need to acquire some more information about the the main criticisms of certain popular so- structure of a social network. A social network cial network services that caused quite a lot can be represented by a graph, the so-called social of discomfort among their users (Websites graph, where nodes (or vertices) represent users ‘keeping deleted photos’, 2009). and edges represent social relations/interactions/ information flows. A social graph may be undi- Moreover, since participation to such collab- rected, thus showing mutual interactions and/or orative environments is available to anyone, it may relationships (e.g., friendship) or directed, thus occur that certain actions of a given individual exhibiting sort of a one-way relationship (e.g., may damage other individuals’ reputation in an “following” someone in Twitter or “friending” irreversible manner. These