Reciprocity attacks

  • Authors:

  • Feng Zhu;Sandra Carpenter;Ajinkya Kulkarni;Swapna Kolimi

  • Affiliations:

  • The University of Alabama in Huntsville, Huntsville, Alabama;The University of Alabama in Huntsville, Huntsville, Alabama;The University of Alabama in Huntsville, Huntsville, Alabama;The University of Alabama in Huntsville, Huntsville, Alabama

  • Venue:
  • Proceedings of the Seventh Symposium on Usable Privacy and Security
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

In mobile and pervasive computing environments, users may easily exchange information via ubiquitously available computers ranging from sensors, embedded processors, wearable and handheld devices, to servers. The unprecedented level of interaction between users and intelligent environments poses unparalleled privacy challenges. We identify a new attack that can be used to acquire users' private information---using reciprocity norms. By mutually exchanging information with users, an attacker may use a psychological method, the norm of reciprocity, to acquire users' private information. We implemented software to provide a rich shopping experience in a mobile and pervasive computing environment and embedded the reciprocity attack. Our experiments showed that participants were more willing to provide some types of private information under reciprocity attacks. To the best of our knowledge, this is the first attempt to understand the impact of the norm of reciprocity as an attack in mobile and pervasive computing environments. These human factors should be taken into consideration when designing security measures to protect people's privacy.