Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) SELF-DESCRIPTIVENESS <s> One of the main security concerns related to the cloud hosting and virtualization, is the lack of Trust in the infrastructure. This lack of trust is due to the absence of transparency concerning the data handling and storage conditions. There are no concrete technical guarantees that can convince a potential cloud customer that he is fully controlling his data. In this paper we propose a security service (called SPACE) in the cloud that provides all the tools to data owner to impose his privacy preferences during the virtualization phase. SPACE is based on the sticky policy technology and offers access and usage control functionalities to the data anywhere in the cloud. In addition to the main security features offered by SPACE, new visualization and control functionalities are proposed to make the user fully aware on the storage condition of his private information. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) SELF-DESCRIPTIVENESS <s> Information sharing on the Internet has become a streamlined process through services such as e-mail, blogs and recently also Online Social Networks (OSNs). The speed of posting information in one central place and the convenience of this information reaching a vast audience at the same time is a great advantage of this style of communication, but at the same time also a danger. The aim of this article is thus to introduce a prototype software model that can analyse not only the Personally Identifiable Information (PII) that users share on OSNs, but with whom they share this. Such analysis will give users a good indication of how their private information is shared based on different settings within their OSN profiles. To successfully develop such a model, familiarity with the concepts of information sharing and PII is firstly investigated. Identifying information leakage within one of the most popular OSNs follows. In combination with our programming knowledge, a prototype model is introduced and an overview of preliminary results is given. Due to the generic nature of the model, we are able to visually introduce and explain the process of information deduction -- an aspect of information sharing often overlooked due to its invisible nature. After analysing the information gathered from our model, we conclude that the immense popularity of Facebook on both a global and local scale contribute to its success, but at the same time make its users more prone to leak information and subsequently be the potential targets of cyber criminals. The ease, anonymity and borderless nature of the Internet in combination with the poor default security settings of our investigated OSN all contribute to the lucrative industry of cyber crime. Proper user awareness is crucial to preventing the leaking of any information in an online environment, but for many users this still equates to (a) PII in the sky. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) SELF-DESCRIPTIVENESS <s> Mobile devices have revolutionized many aspects of our lives. We use smartphones and tablets as portable computers and, often without realizing it, we run various types of security-sensitive programs on them, such as personal and enterprise email and instant-messaging applications, as well as social, banking, insurance and retail programs. These applications access and transmit over the network numerous pieces of private information, including our geographical location, device ID, contacts, calendar events, passwords, and health records, as well as credit-card, social-security, and bank-account numbers. Guaranteeing that no private information is exposed to unauthorized observers is very challenging given the level of complexity that these applications have reached. Furthermore, using program-analysis tools with out-of-the-box configurations in order to detect confidentiality violations may not yield the desired results because only a few pieces of private data, such as the device's ID and geographical location, are obtained from standard sources. The majority of confidentiality sources (such as credit-card and bank-account numbers) are application-specific and require careful configuration. This paper presents Labyrinth, a run-time privacy enforcement system that automatically detects leakage of private data originating from standard as well as application-specific sources. Labyrinth features several novel contributions: (i) it allows for visually configuring, directly atop the application's User Interface (UI), the fields that constitute custom sources of private data, (ii) it does not require operating-system instrumentation, but relies only an application-level instrumentation and on a proxy that intercepts the communication between the mobile device and the back-end servers, and (iii) it performs an enhanced form of value-similarity analysis to detect data leakage even when sensitive data (such as a password) has been encoded or hashed. Labyrinth supports both Android and iOS. We have evaluated Labyrinth experimentally, and in this paper we report results on production-level applications. <s> BIB003
The prototypes of many TETs seemed either moderately abstract or focused on a specific usage context. The ones that leant towards abstract contexts, such as large-scale infrastructures based on central authorities BIB001 , BIB002 ,  , BIB003 , were often not discussed in terms of their actual usability. The question of whether TETs that reflect such highly abstract scenarios were self-descriptive enough and in accordance with the expectations of their respective users  in order to be actually usable remained unanswered.