Verifiable Credentials (VCs) allow users to assert claims about themselves in a cryptographically-verifiable way. In last the few years, several different VC schemes have emerged, offering varying levels of privacy through different cryptographic techniques. Current VC implementations aim for security against attacks that use classical computers, but the cryptography in use is vulnerable to attacks if the full power of quantum computing is ever realised. Addressing this threat is important as VCs are gaining traction for applications with safety and security implications (e.g. the mobile Driver’s License (mDL)). This work examines the cryptographic underpinnings of VCs to discuss quantum-safety, and makes recommendations regarding the next steps in the transition to post-quantum cryptography.

As mobile computing applications have become commonplace, it is increasingly important for them to address end-users’ privacy requirements. Privacy requirements depend on a number of contextual socio-cultural factors to which mobility adds another level of contextual variation. However, traditional requirements elicitation methods do not sufficiently account for contextual factors and therefore cannot be used effectively to represent and analyse the privacy requirements of mobile end users. On the other hand, methods that do investigate contextual factors tend to produce data that does not lend itself to the process of requirements extraction. To address this problem we have developed a Privacy Requirements Distillation approach that employs a problem analysis framework to extract and refine privacy requirements for mobile applications from raw data gathered through empirical studies involving end users. Our approach introduces privacy facets that capture patterns of privacy concerns which are matched against the raw data. We demonstrate and evaluate our approach using qualitative data from an empirical study of a mobile social networking application.

A growing body of research has been exploring the use of control mechanisms to address the privacy concerns raised by location-tracking technology. We report on a qualitative study of two family groups who used a custom-built tracking application for an extended period of time. Akin to sociological breaching experiments, the study focuses on the interferences between location tracking and relationship management. We analyze the tensions that can arise between affordances of the technology and uses that the contracts between family members legitimize. We describe how, by fostering misperceptions and 'nudging' behaviors, location-tracking technology can generate anxieties and conflicts even in close relationships. We discuss their vulnerability to the overreaching effects of tracking, against which the use of mechanisms such as location-sharing preferences and feedback may not be socially viable.

How can we best explore the range of users' reactions when developing future technologies that may be controversial, such as personal healthcare systems? Our approach -- ContraVision -- uses futuristic videos, or other narrative forms, that convey either negative or positive aspects of the proposed technology for the same scenarios. We conducted a user study to investigate what range of responses the different versions elicited. Our findings show that the use of two systematically comparable representations of the same technology can elicit a wider spectrum of reactions than a single representation can. We discuss why this is so and the value of obtaining breadth in user feedback for potentially controversial technologies.

Mobile privacy concerns are central to Ubicomp and yet remain poorly understood. We advocate a diversified approach, enabling the cross-interpretation of data from complementary methods. However, mobility imposes a number of limitations on the methods that can be effectively employed. We discuss how we addressed this problem in an empirical study of mobile social networking. We report on how, by combining a variation of experience sampling and contextual interviews, we have started focusing on a notion of context in relation to privacy, which is subjectively defined by emerging socio-cultural knowledge, functions, relations and rules. With reference to Gieryn's sociological work, we call this place, as opposed to a notion of context that is objectively defined by physical and factual elements, which we call space. We propose that the former better describes the context for mobile privacy.

No abstract available.