Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) USER GROUP <s> This paper provides a short survey on transparency tools for privacy purposes. It defines the term transparency tools, argues why they are important and gives examples for transparency tools. A classification of transparency tools is suggested and some example tools are analyzed with the help of the classification. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) USER GROUP <s> Mobile devices have revolutionized many aspects of our lives. We use smartphones and tablets as portable computers and, often without realizing it, we run various types of security-sensitive programs on them, such as personal and enterprise email and instant-messaging applications, as well as social, banking, insurance and retail programs. These applications access and transmit over the network numerous pieces of private information, including our geographical location, device ID, contacts, calendar events, passwords, and health records, as well as credit-card, social-security, and bank-account numbers. Guaranteeing that no private information is exposed to unauthorized observers is very challenging given the level of complexity that these applications have reached. Furthermore, using program-analysis tools with out-of-the-box configurations in order to detect confidentiality violations may not yield the desired results because only a few pieces of private data, such as the device's ID and geographical location, are obtained from standard sources. The majority of confidentiality sources (such as credit-card and bank-account numbers) are application-specific and require careful configuration. This paper presents Labyrinth, a run-time privacy enforcement system that automatically detects leakage of private data originating from standard as well as application-specific sources. Labyrinth features several novel contributions: (i) it allows for visually configuring, directly atop the application's User Interface (UI), the fields that constitute custom sources of private data, (ii) it does not require operating-system instrumentation, but relies only an application-level instrumentation and on a proxy that intercepts the communication between the mobile device and the back-end servers, and (iii) it performs an enhanced form of value-similarity analysis to detect data leakage even when sensitive data (such as a password) has been encoded or hashed. Labyrinth supports both Android and iOS. We have evaluated Labyrinth experimentally, and in this paper we report results on production-level applications. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) USER GROUP <s> We present a prototype of the user interface of a transparency tool that displays an overview of a user's data disclosures to different online service providers and allows them to access data collected about them stored at the services' sides. We explore one particular type of visualization method consisting of tracing lines that connect a user's disclosed personal attributes to the service to which these attributes have been disclosed. We report on the ongoing iterative process of design of such visualization, the challenges encountered and the possibilities for future improvements. <s> BIB003 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> 1) USER GROUP <s> The ubiquitous availability of location data to smartphone apps and online social networks has caused the collection of such information to grow at an unprecedented rate. However, the discriminative power and potential uses of this data collection is not always clear to the end user. In this work, we present FindYou, a web-based application that gives users the ability to perform a location data privacy audit. FindYou lets users import and visualize the location data collected by popular web services in order to understand what these companies know or can easily infer about them. Additionally, FindYou gives users the option to donate their data to the scientific community, creating new mobile datasets linked to user properties that will be open to use by academic institutions. We hope that FindYou will increase awareness of the privacy issues surrounding the collection and use of location data, the potential problem of "digital red-lining", and also create valuable new datasets with the full informed consent of interested users. <s> BIB004
The first group of stakeholders considered in this survey is the target user group of a TET, that is, the kind of users that will actually use it. As this survey targets TETs for enhancing privacy, all TETs surveyed consider at least the data subjects themselves as one of its user groups. Like Hedbom BIB001 , this survey considers data subjects and auditors as possible target groups. Likewise, this survey also draws the line between both groups on a conceptual and functional level, meaning that data subjects are likely to be non-professional users, while auditors are domain experts explicitly chosen for the task of analysing the former's data with professional scrutiny. Unlike Hedbom, this survey does not differentiate both groups on the level of 'user friendliness.' Instead, this survey seconds the design principles of interactive systems by ISO according to which any kind of software should be targeted towards the experiences and abilities of the respective target audience, and should satisfy the expectations of that group  . While Hedbom defines 'proxies' as entities contextually related to auditors, this group could, in theory, be treated as a separate intermediate group. Proxies could be guardians or legal representatives without technical or domain knowledge, and would therefore not qualify as members of either of the aforementioned groups. No TET could be identified that specifically targets proxies. The TET presented by Zavou et al.  differentiates between visualisation modes for service users on the one hand and online service providers on the other. While the former can review only their own personal data, the latter receive detailed information about all service users that use their service. In that regard, the TET offers multiple perspectives (Section V-E.3) for different audiences and usage contexts, respectively. The TET presented by Pistoia et al. BIB002 depends on an intermediate proxy server whose operator might be an independent authority that concurrently acts as an auditor. The TETs presented by Bier et al.  , Angulo et al. BIB003 , and Riederer et al. BIB004 allow users to review their data without referring to transaction logs. Once data subjects have retrieved their personal data from the data processors, the review process could theoretically be outsourced to an independent auditor. The majority of the TETs that might be used by an auditor were generic in nature (see Section V-D.2), the complexity of the broader usage context lending itself to the in-depth knowledge of a domain expert.