X hits on this document





42 / 100

public data to all viewers and private data only to the users whose goggles are currently transparent. Ideally, a system would be able to quickly multiplex all these views on the same display. Schoemaker and Inkpen evaluated the system using a collaborative game and found it to be usable by the participants. They also claim that mixed shared/public displays could provide opportunities for enhanced collaboration, supporting both shared data and individual exploration and elaboration of the data.

The proliferation of personal, semi-public and public displays suggests that blinding and coding may become common techniques in the HCI privacy landscape.

3.3.8 Plausible Deniability, Ambiguity, and Social Translucency

Past work by Hindus et al. in the home [146] and by Hong for location-based services [149] suggested a social need to avoid potentially embarrassing situations, undesired intrusions, and unwanted social obligations. Plausible deniability has been recognized as a way of achieving a desired level of environmental and personal privacy in a socially acceptable way [295].

This ambiguity is the basis for plausible deniability in many communication systems. For example, Nardi et al. observed that people could ignore incoming instant messages without offending the sender, because the sender does not know for certain whether the intended recipient is there or not [220]. Consequently, failing to respond is not interpreted as rude or unresponsive. Traditionally, ambiguity has been considered a negative side-effect of the interaction between humans and computers. Recently, however, researchers have recognized that ambiguity can be a resource for design instead of a roadblock. Gaver et al. claim that ambiguity not only provides a concrete framework for achieving plausible deniability, but also a way of enriching interpersonal communications and even games [117].

Several accounts of ambiguity in voice-based communication systems have been documented [28]. For example, the affordances of cell phones enable a social protocol that allows individuals sufficient leeway to claim not having heard the phone ringing. Successful communication tools often incorporate features that support plausible deniability practices [139].

Researchers have attempted to build on the privacy features of traditional Instant Messaging by adding explicit controls on the availability status of the user, though with varying success. For example, Fogarty et al. [109] examined the use of contextual information, such as sound and location information, to provide availability cues in MyVine, a client that integrates phone, instant messaging, and email. Fogarty et al. discovered that users sent Instant Messages to their communication partners even if they were sensed as “busy” by the system. Fogarty attributes this behavior to a lack of accountability, in that telling senders that they should not have sent the message may be considered more impolite than the interruption itself.

When plausible deniability mechanisms become explicit, they can lose much of their value. For example, the Lilsys system by Begole et al. uses a traffic sign metaphor to warn others of one’s unavailability for communication [40]. Begole et al. report that the traffic signs metaphor was not well liked by participants in a user study. More importantly, users “expressed discomfort at being portrayed as unavailable.” Begole et

end-user-privacy-in-human-computer-interaction-v57.docPage 42 of 85

Document info
Document views152
Page views152
Page last viewedTue Oct 25 04:00:39 UTC 2016