Bayesian Evaluation of User App Choices in the Presence of Risk Communication on Android Devices

TL;DR

This study investigates how real-time risk indicators influence user choices of Android apps, showing that risk-aware visual cues lead to more secure and privacy-conscious decisions in a naturalistic setting.

Contribution

It introduces a naturalistic experiment demonstrating the impact of risk indicators on user app selection and proposes practical interactions for informed, risk-aware decision-making.

Findings

Risk indicators lead to more risk-averse app choices

Participants made more privacy-conscious decisions with visual cues

Study highlights importance of human decision-making in app security

Abstract

In the age of ubiquitous technologies, security- and privacy-focused choices have turned out to be a significant concern for individuals and organizations. Risks of such pervasive technologies are extensive and often misaligned with user risk perception, thus failing to help users in taking privacy-aware decisions. Researchers usually try to find solutions for coherently extending trust into our often inscrutable electronic networked environment. To enable security- and privacy-focused decision-making, we mainly focused on the realm of the mobile marketplace, examining how risk indicators can help people choose more secure and privacy-preserving apps. We performed a naturalistic experiment with N=60 participants, where we asked them to select applications on Android tablets with accurate real-time marketplace data. We found that, in aggregate, app selections changed to be more risk-averse in the presence of user risk-perception-aligned visual indicators. Our study design and research propose practical and usable interactions that enable more informed, risk-aware comparisons for individuals during app selections. We include an explicit argument for the role of human decision-making during app selection, beyond the current trend of using machine learning to automate privacy preferences after selection during run-time.