The security of the Internet and numerous other applications rests on a small number of open-source cryptographic libraries: A vulnerability in any one of them threatens to compromise a significant percentage of web traffic. Despite this potential for security impact, the characteristics and causes of vulnerabilities in cryptographic software are not well understood. In this work, we conduct the first systematic, longitudinal analysis of cryptographic libraries and the vulnerabilities they produce. We collect data from the National Vulnerability Database, individual project repositories and mailing lists, and other relevant sources for all widely used cryptographic libraries.

Most users of smartphone apps remain unaware of what data about them is being collected, by whom, and how these data are being used. In this mixed methods investigation, we examine the question of whether revealing key data collection practices of smartphone apps may help people make more informed privacy-related decisions. To investigate this question, we designed and prototyped a new class of privacy indicators, called Data Controller Indicators (DCIs), that expose previously hidden information flows out of the apps. Our lab study of DCIs suggests that such indicators do support people in making more confident and consistent choices, informed by a more diverse range of factors, including the number and nature of third-party companies that access users' data. Furthermore, personalised DCIs, which are contextualised against the other apps an individual already uses, enable them to reason effectively about the differential impacts on their overall information exposure.

The aim of this research was to understand what affects people's privacy preferences in smartphone apps. We ran a four-week study in the wild with 34 participants. Participants were asked to answer questions, which were used to gather their personal context and to measure their privacy preferences by varying app name and purpose of data collection. Our results show that participants shared the most when no information about data access or purpose was given, and shared the least when both of these details were specified. When just one of either purpose or the requesting app was shown, participants shared less when just the purpose was specified than when just the app name was given. We found that the purpose for data access was the predominant factor affecting users' choices. In our study the purpose condition vary from being not specified, to vague to be very specific. Participants were more willing to disclose data when no purpose was specified. When a vague purpose was shown, participants became more privacy-aware and were less willing to disclose their information. When specific purposes were shown participants were more willing to disclose when the purpose for requesting the information appeared to be beneficial to them, and shared the least when the purpose for data access was solely beneficial to developers.

Many smartphone apps collect personal information used for a variety of purposes. Users, however, are often unaware of this kind of access even though they must grant the required permissions upon app installation. We have identified three reasons for this unawareness. First, relevant permissions c

We review current technical and social barriers to COPPA compliance for popular online services aimed at children. We show that complying with COPPA has proven difficult for developers, even when a genuine attempt was made. We investigate reasons for this lack of compliance and identify common causes: specifically, difficulties obtaining verifiable parental control as well as supply mechanisms for parents to understand, review, grant access and monitor collection of their children's personal data. Unless part of online services, mobile apps do not need to comply with COPPA.

Summary form only given. Throughout the history of computer and network security research, privacy has been treated as synonymous with confidentiality, with the presumed high water mark of privacy being mathematically provable anonymity. Despite the fact that technical innovation in cryptography and network security has enabled all manner of confidentiality control over the exposure of identity in information systems, the vast majority of Internet user remain deeply worried about their privacy rights and correctly believe that they are far more exposed today than they might have been a generation earlier. Have we just failed to deploy the proper security technology to protect privacy, are our laws inadequate to meet present day privacy threats, or have business practices and social conventions simply rendered privacy dead? While there is some truth to each possibility, the central failure to achieve robust privacy in the information age can be traced to an a long-standing misassocation of privacy with confidentiality and access control. In order to revitalize privacy protection, we should shift our legal attention away from rules limiting disclosure of personal information toward policies governing how personal information can be used. And technical efforts currently focused on access control and anonymization should be redirected toward technical measures that make information usage more transparent and accountable to clearly stated policies that address proper and improper users of personal information.

Across the World Wide Web there is government censorship and monitoring of political messages and morally-corrupting material. Google have been in the news recently for capitulating to the Chinese government's demands to ban certain kinds of content, and also for refusing topass logs of browsing habits to the US government (while Microsoft and Yahoo complied wth the request). How can the Web survive as a unified, global information environment in the face of government censorship? Can governments and the private sector come to an agreement on international legal standards for the free flow of information and privacy.

Context-aware computing offers the promise of significant user gains-the ability for systems to adapt more readily to user needs, models, and goals. Dey, Abowd, and Salber (2001 [this special issue]) present a masterful step toward understanding context-aware applications. We examine Dey et al. in the light of privacy issues-that is, individuals' control over their personal data-to highlight some of the thorny issues in context-aware computing that will be upon us soon. We argue that privacy in context-aware computing, especially those with perceptually aware environments, will be quite complex. Indeed, privacy forms a co-design space between the social, the technical, and the regulatory. We recognize that Dey et al. is a necessary first step in examining important software engineering concerns, but future research will need to consider how regulatory and technical solutions might be co-designed to form a public good.