Towards a Privacy-enhanced Social Networking Site
The rise of Social Networking Sites (SNS), such as Facebook, Myspace, and LinkedIn has provided a platform for individuals to easily stay in touch with friends, family and colleagues and actively encourage their users to share personal information. With the wealth of activities available on SNS, the amount and variety of personal information shared is considerable and diverse. Additionally, due to its digital nature, this information can be easily copied, modified and disclosed without the explicit consent of their owner. Personal information disclosed from SNS could affect users’ life, with privacy risks ranging from simple embarrassment to ruining their reputation, or even identity theft. Unfortunately, many users are not fully aware of the danger of divulging their personal information and the current privacy solutions are not flexible and thorough enough to protect user data. Furthermore, even though users of SNS can control access to their own profile, they cannot control what others may reveal about them. Friends can sometimes be untrustworthy and disclose more information about the user than they should. Considering that privacy is a fundamental right for every individual, in this thesis, we present an approach that increases privacy awareness of the users and maintains the sovereignty of their data when using SNS. The first contribution of this thesis is the classification of multiple types of risks as well as user expectations regarding privacy in SNS. Afterwards, we introduce the Privacy Framework for SNS and the concept of User Privacy Policy (UPP) to offer users an easy and flexible way to specify and communicate their privacy concerns to other users, third parties and SNS provider. Additionally, we define a taxonomy (possibly non-exhaustive) of privacy criteria that can enhance the user privacy if they are integrated within the design of a SNS and introduce the concept of a Privacy-enhanced SNS (PSNS). Furthermore, we present also Privacy Watch, a theoretical proposal of a PSNS platform that combines the concept of provenance and accountability to help SNS users maintain sovereignty over their personal data. Finally, we survey and compare several privacy-enhanced SNS that were recently proposed that try to integrate some privacy features directly into the design of the system. We also classify these different approaches with respect to the privacy criteria developed.
Privacy Social networking sites Accountability Watermarking Encryption Access control