Smartphones have become a primary form of computing. As a result, nearly every consumer, company, and organization provides an "app" for the popular smartphone platforms. Many of these apps are little more than a WebView widget that renders downloaded HTML and JavaScript content. In this paper, we argue that separating Web applications into separate OS principals has valuable security and privacy advantages. However, in the current smartphone application ecosystem, many such apps are fraught with privacy concerns. To this end, we propose NativeWrap as an alternative model for security and privacy conscious consumers to access Web content. NativeWrap "wraps" the domain for given URL into a native platform app, applying best practices for security configuration. We describe the design of a prototype of NativeWrap for the Android platform and test compatibility on the top 250 Alexa Websites. By using NativeWrap, third-party developers are removed from platform code, and users are placed in control of privacy sensitive operation.

Today’s smartphone operating systems frequently fail to provide users with visibility into how third-party applications collect and share their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid enables realtime analysis by leveraging Android’s virtualized execution environment. TaintDroid incurs only 32% performance overhead on a CPU-bound microbenchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, in our 2010 study we found 20 applications potentially misused users’ private information; so did a similar fraction of the tested applications in our 2012 study. Monitoring the flow of privacy-sensitive data with TaintDroid provides valuable input for smartphone users and security service firms seeking to identify misbehaving applications.

Cloud services have become a cheap and popular means of computing. They allow users to synchronize data between devices and relieve low-powered devices from heavy computations. In response to the surge of smartphones and mobile devices, several cloud-based Web browsers have become commercially available. These "cloud browsers" assemble and render Web pages within the cloud, executing JavaScript code for the mobile client. This paper explores how the computational abilities of cloud browsers may be exploited through a Browser MapReduce (BMR) architecture for executing large, parallel tasks. We explore the computation and memory limits of four cloud browsers, and demonstrate the viability of BMR by implementing a client based on a reverse engineering of the Puffin cloud browser. We implement and test three canonical MapReduce applications (word count, distributed grep, and distributed sort). While we perform experiments on relatively small amounts of data (100 MB) for ethical considerations, our results strongly suggest that current cloud browsers are a viable source of arbitrary free computing at large scale.