X hits on this document





41 / 100

of location-based applications, ones that focus on places rather than on individuals. For example, a count of the number of wireless devices in a space could indicate how busy a coffee shop is.

More recent work has investigated how a caller can assess the receiving party’s availability to communicate, by providing information about the context of the called party. See, for example, Schmandt et al.’s Garblephone [259], Nagel’s Family Intercom [219], Avrahami et al.’s context cell phone protocol [32]. Milewski and Smith included availability information in shared address books [210]. Schilit provides a survey of these kinds of context-aware communication, observing that increased awareness can be useful, though at the cost of privacy [258]. In fact, these systems have contradictory effects on privacy perceptions (Section 2.3.1). On the one hand, they can increase environmental privacy because the caller can choose not to disturb the recipient if she is busy. On the other hand, these awareness systems cause information about individuals to be communicated automatically and reduce plausible deniability.

More recently, Davis and Gutwin surveyed disclosure preferences of awareness information. They asked individuals what types of awareness information they would disclose to seven different relationship types and found that most individuals would allow decreasing amounts of information to weaker relationships [81]. Yet, Nagel observed, based on extensive user studies, that individuals may not want to share availability information due to a perceived lack of usefulness of having the caller such information [217]. Nagel’s results suggest that the utility and privacy costs of these systems are yet unclear.

3.3.7 Shared Displays: Incidental Information and Blinding

A common problem encountered when several individuals are viewing the same computer screen is that potentially private information, such as bookmarks or financial information, may be accidentally disclosed. This issue may arise due to multiple people using the same computer, when projecting a laptop onto a larger screen, or “shoulder surfing” in which a bystander happens to see someone else’s screen. Some on-the-road professionals apply a physical filter on their laptop screens. Blinding may help in these cases. Blinders are GUI artifacts that hide parts of the user interface to block view of sensitive information. Tarasewich and Campbell proposed using automatic blinders to protect personal data in web browsers [282]. Sensitive information is first identified using pattern recognition. This information can be redacted with black rectangular blocks or encoded using a set of secret colors. Experimental results suggest that these techniques are surprisingly usable in everyday tasks.

Similarly, Miller and Stasko used coded displays for sensitive information shown in semi-public peripheral displays [275]. In their Infocanvas system, sensitive information such as stock quotes is depicted in a graphical, artful way (e.g., by a cloud hovering over a landscape), using a secret code. While not “strong” from a security standpoint, this technique may be acceptable for many deployment settings.

Schoemaker and Inkpen developed an alternative approach for displaying private information on shared displays using blinding goggles typically used for achieving stereoscopic 3D vision on traditional computer screens [264]. The display shows

end-user-privacy-in-human-computer-interaction-v57.docPage 41 of 85

Document info
Document views120
Page views120
Page last viewedSun Oct 23 01:23:54 UTC 2016