"Tell me, how do you know it's me?" Expectations of security and personalization measures for smart speaker applications

TL;DR

This study explores user preferences for security and personalization measures in smart speaker applications, highlighting voice authentication and combined methods as promising solutions for enhancing security in sensitive app categories.

Contribution

It provides empirical insights into user preferences for security measures in smart speaker apps, emphasizing voice authentication and combined approaches for improved security and personalization.

Findings

Voice authentication is highly preferred but not yet widely used.

Users favor combining PIN and voice authentication for better security.

Participants prioritize security for finance, bills, and shopping apps.

Abstract

Voice-controlled smart speaker devices have gained a foothold in many modern households. Their prevalence combined with their intrusion into core private spheres of life has motivated research on security and privacy intrusions, especially those performed by third-party applications used on such devices. In this work, we take a closer look at such third-party applications from a less pessimistic angle: we consider their potential to provide personalized and secure capabilities and investigate measures to authenticate users (``PIN'', ``Voice authentication'', ``Notification'', and presence of ``Nearby devices''). To this end, we asked 100 participants to evaluate 15 application categories and 51 apps with a wide range of functions. The central questions we explored focused on: users' preferences for security and personalization for different categories of apps; the preferred security and personalization measures for different apps; and the preferred frequency of the respective measure. After an initial pilot study, we focused primarily on 7 categories of apps for which security and personalization are reported to be important; those include the three crucial categories finance, bills, and shopping. We found that ``Voice authentication'', while not currently employed by the apps we studied, is a highly popular measure to achieve security and personalization. Many participants were open to exploring combinations of security measures to increase the protection of highly relevant apps. Here, the combination of ``PIN'' and ``Voice authentication'' was clearly the most desired one. This finding indicates systems that seamlessly combine ``Voice authentication'' with other measures might be a good candidate for future work.