Hi, my name is Tianshi Li. I'm a PhD student from Carnegie Mellon University.
It's my pleasure to present the paper Honeysuckle, annotation-guided code generation of in-app privacy notices on behalf of my colleagues.
To improve the transparency of how personal data is collected and used.
It is recommended for mobile apps to embed concise privacy notices within the app and show these in-app notices in proper context.
These in-app privacy notices have been advocated by academia, promoted by industry, and even required by some privacy laws and regulations.
However, in-app privacy notices are rarely used in today's mobile apps.
And we argue that the key problems are in the people who create these apps, namely the app developer.
Prior literature has already identified multiple challenges that may account for the low adoption of in-app privacy notices.
First, developer may lack the awareness, knowledge and incentives to comply with best practices.
Second, although certain App Store developer policies and privacy laws have requirements for in-app privacy notices,
they do not provide a concrete design or Implementation guide, which makes it difficult to operationalize these requirements.
Lastly, different platforms and privacy laws may release different requirements for in-app privacy notices.
And these requirements may constantly change, which can cause a lot of headaches for maintenance.
To tackle these challenges, we propose a new approach to create in-app privacy notices,
and we present Honeysuckle, an Android developer tool to support this approach.
Basically, Honeysuckle only requests developers to annotate the code to specify how data is collected, stored and sent out of the device.
And it automatically generates privacy notices at compile time, based on code analysis results and the annotation information.
Currently, our system supports generating multiple types of privacy notices that show up at different timings,
such as before permission request, right after data collection or transmission, or upon user request.
This idea is an extension of our earlier work Coconut, which also leverages privacy annotations
to give developers privacy feedback while programming
On a high level, we envision that if developers only need to provide privacy annotations once and obtain multiple benefits based on these annotations,
it can make privacy a much easier task for developers.
The Honeysuckle system consists of three components during programming time, the IDE plugin facilitate developers to annotate their code;
during compile time build system plugin modifies the codebase to insert the generated code;
and during runtime, APIs from an auxiliary library are called to show privacy notices.
Among the three stages, only the first one requires active developer interaction.
And the last two are transparent to developers.
Because the main goal of privacy notices is to convey how sensitive data flows across the app.
Developers only need to annotate
sources, which are API calls that collect personal data;
and sinks, which are API calls to send it off the device or store the data.
At the project startup time, Honeysuckle scans the project
and lists all the detected sources and sinks in this panel, the developer will first annotate all the sources.
She can browse this list and click on each item to navigate to the corresponding line of code.
And then she can use quick fixes to generate and insert an annotation template at the proper position.
In the generated template, the data type is automatically filled based on the API type.
And the developer needs to create a resource string to describe the purpose of collecting the data.
The process of annotating sinks is similar, so we will skip it for the sake of time.
We want to highlight how we handle a common scenario
when developers create utility functions that may be called in different contexts with different purposes.
And this example, Honeysuckle detects this system API call, which is used in an app level utility function named writeToFile,
the developer should first use the @NoSpecificUseCase annotation to let the IDE know that they have written here may serve multiple purposes.
And then she can add different sink annotations to differentiate the two contexts of calling writeToFile.
Finally, the developer may want to adjust the UI configuration file to gain more granular control over how the generated notices are displayed to users.
This can help highlight data practices that are more sensitive and unexpected to users and address the notification overloading issue.
The configuration file is automatically generated based on the source and sink annotations.
In this example, developer uses auto-completion to change the frequency of just-in-time notification to only display at first use.
To evaluate Honeysuckle, we conducted lab studies with 12 experienced Android developers following a within subjects design.
During the study the developers modified two real word open-source apps to implement in-app privacy notices using annotations,
and using the direct implementation method as the baseline.
We found all twelves developers preferred the annotation method.
And the annotation method achieved better time performance, significantly lower cognitive load, and significantly better perceived usefulness and usability.
To sum up, we present Honeysuckle, which is a programming tool for generating in-app privacy notices using developer-provided annotations.
We showed in a lab study that our annotation-guided generation method can help developers improve data transparency, with substantially less work.
Honeysuckle was built on top of our earlier work, Coconut (IMWUT'18),
and we aim to use annotations to provide a different type of privacy development support, than Coconut.
We envision that by offering multiple benefits using the same annotations.
We can make privacy a lot easier for developers and address the awareness, knowledge and incentive barriers for adopting best privacy practices. Thanks for watching.