{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T04:47:07Z","timestamp":1784695627969,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":51,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,6,27]],"date-time":"2020-06-27T00:00:00Z","timestamp":1593216000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100007515","name":"National Science Foundation","doi-asserted-by":"publisher","award":["1748109, 184646, 1453139, 1948244, 1736209"],"award-info":[{"award-number":["1748109, 184646, 1453139, 1948244, 1736209"]}],"id":[{"id":"10.13039\/100007515","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,6,27]]},"DOI":"10.1145\/3377811.3380401","type":"proceedings-article","created":{"date-parts":[[2020,10,1]],"date-time":"2020-10-01T18:25:34Z","timestamp":1601576734000},"page":"1572-1583","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":21,"title":["How does misconfiguration of analytic services compromise mobile privacy?"],"prefix":"10.1145","author":[{"given":"Xueling","family":"Zhang","sequence":"first","affiliation":[{"name":"University of Texas at San Antonio"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoyin","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Texas at San Antonio"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rocky","family":"Slavin","sequence":"additional","affiliation":[{"name":"University of Texas at San Antonio"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Travis","family":"Breaux","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jianwei","family":"Niu","sequence":"additional","affiliation":[{"name":"University of Texas at San Antonio"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,10]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Retrieved","year":"2019","unstructured":"2017. Equifax Data Breach. Retrieved May, 2019 from http:\/\/fortune.com\/2018\/09\/07\/equifax-data-breach-one-year-anniversary\/"},{"key":"e_1_3_2_1_2_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. AppBrain Android analytics libraries. Retrieved October, 2018 from https:\/\/www.appbrain.com\/stats\/libraries\/tag\/analytics\/android-analytics-libraries"},{"key":"e_1_3_2_1_3_1","unstructured":"2018. AppBrain Firebase. Retrieved October 2018 from https:\/\/www.appbrain.com\/stats\/libraries\/details\/firebase\/firebase"},{"key":"e_1_3_2_1_4_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. AppsFlyer provide encryption option in API setUserEmails. Retrieved October, 2018 from https:\/\/support.appsflyer.com\/hc\/en-us\/articles\/207032126-AppsFlyer-SDK-Integration-Android"},{"key":"e_1_3_2_1_5_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Crashlytics dashboard. Retrieved October, 2018 from https:\/\/stackoverflow.com\/questions\/34888420\/crashlytics-how-to-see-user-name-email-id-in-crash-details\/"},{"key":"e_1_3_2_1_6_1","volume-title":"Retrieved","year":"2019","unstructured":"2018. Facebook Data Breach. Retrieved May, 2019 from https:\/\/www.nytimes.com\/2018\/09\/28\/technology\/facebook-hack-data-breach.html"},{"key":"e_1_3_2_1_7_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Firebase collect user event by default. Retrieved October, 2018 from https:\/\/support.google.com\/firebase\/answer\/6317485?hl=en&ref_topic=6317484"},{"key":"e_1_3_2_1_8_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Firebase set user ID. Retrieved October, 2018 from https:\/\/frebase.google.com\/docs\/analytics\/userid"},{"key":"e_1_3_2_1_9_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Firebase set user preoperties. Retrieved October, 2018 from https:\/\/firebase.google.com\/docs\/analytics\/android\/properties"},{"key":"e_1_3_2_1_10_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Firebase user propertise. Retrieved October, 2018 from https:\/\/support.google.com\/firebase\/answer\/6317519?hl=en&ref_topic=6317489"},{"key":"e_1_3_2_1_11_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Flurry API setUserId(). Retrieved October, 2018 from https:\/\/developer.yahoo.com\/flurry\/docs\/analytics\/gettingstarted\/technicalquickstart\/android\/"},{"key":"e_1_3_2_1_12_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Flurry dashboard. Retrieved October, 2018 from https:\/\/developer.yahoo.com\/flurry\/docs\/analytics\/lexicon\/eventreporting\/"},{"key":"e_1_3_2_1_13_1","volume-title":"Retrieved","year":"2020","unstructured":"2018. GDPR Anonymous Data. Retrieved January, 2020 from https:\/\/gdpr-info.eu\/recitals\/no-26\/"},{"key":"e_1_3_2_1_14_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. GDPR definition of personal data. Retrieved October, 2018 from https:\/\/gdpr-info.eu\/art-4-gdpr\/"},{"key":"e_1_3_2_1_15_1","volume-title":"Retrieved","year":"2020","unstructured":"2018. GDPR Lawfulness of processing. Retrieved January, 2020 from https:\/\/gdpr-info.eu\/art-6-gdpr\/"},{"key":"e_1_3_2_1_16_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. GDPR online identifiers for profiling and identification. Retrieved October, 2018 from https:\/\/gdpr-info.eu\/recitals\/no-30\/"},{"key":"e_1_3_2_1_17_1","volume-title":"Retrieved","year":"2019","unstructured":"2018. Marriott Data Breach. Retrieved May, 2019 from https:\/\/www.consumer.ftc.gov\/blog\/2018\/12\/marriott-data-breach"},{"key":"e_1_3_2_1_18_1","unstructured":"2018. Mixpanel collect user event by default."},{"key":"e_1_3_2_1_19_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Mixpanel's rule about using API. Retrieved October, 2018 from https:\/\/help.mixpanel.com\/hc\/en-us\/articles\/360000679006-Managing-Personal-Information"},{"key":"e_1_3_2_1_20_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. PlayDron metadata. Retrieved August, 2018 from https:\/\/archive.org\/details\/android_apps&tab=about"},{"key":"e_1_3_2_1_21_1","volume-title":"Retrieved","year":"2018","unstructured":"2018. Privacy policy of Crashlytics. Retrieved October, 2018 from https:\/\/try.crashlytics.com\/terms\/privacy-policy.pdf"},{"key":"e_1_3_2_1_22_1","unstructured":"2018. Universal Analytics usage guidelines. https:\/\/support.google.com\/analytics\/answer\/2795983?hl=en."},{"key":"e_1_3_2_1_23_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Market share of Firebase. Retrieved August, 2019 from https:\/\/www.appbrain.com\/stats\/libraries\/details\/firebase\/firebase"},{"key":"e_1_3_2_1_24_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Market share of Flurrt. Retrieved August, 2019 from https:\/\/www.appbrain.com\/stats\/libraries\/details\/flurry\/flurry-analytics"},{"key":"e_1_3_2_1_25_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Market share of Google Analytics. Retrieved August, 2019 from https:\/\/www.appbrain.com\/stats\/libraries\/details\/analytics\/google-analytics"},{"key":"e_1_3_2_1_26_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Market share of Mixpanel. Retrieved August, 2019 from https:\/\/www.appbrain.com\/stats\/libraries\/details\/mixpanel\/mixpanel"},{"key":"e_1_3_2_1_27_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Privacy policy of emojidom. Retrieved August, 2019 from http:\/\/www.emojidom.com\/privacy-policy"},{"key":"e_1_3_2_1_28_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Privacy policy of Staples. Retrieved August, 2019 from https:\/\/www.staples.com\/hc?id=dbb94c10-973c-478b-a078-00e58f66ba32"},{"key":"e_1_3_2_1_29_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Privacy policy of Shopclues. Retrieved August, 2019 from http:\/\/m.shopclues.com\/rules-and-policies.html"},{"key":"e_1_3_2_1_30_1","unstructured":"2019. UI\/Application Exerciser Monkey. Retrieved August 2019 from https:\/\/developer.android.com\/studio\/test\/monkey.html"},{"key":"e_1_3_2_1_31_1","volume-title":"Retrieved","year":"2019","unstructured":"2019. Understanding PII in Google's contracts and policies. Retrieved August, 2019 from https:\/\/support.google.com\/analytics\/answer\/7686480?hl=en"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"e_1_3_2_1_33_1","unstructured":"Mixpanel dashboard. 2018. . Retrieved October 2018 from https:\/\/help.mixpanel.com\/hc\/en-us\/articles\/360000865566-Set-up-Your-Tracking\/"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619091"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134064"},{"key":"e_1_3_2_1_37_1","volume-title":"International Conference on Security and Privacy in Communication Systems. Springer, 655--672","author":"Liu Xing","year":"2016","unstructured":"Xing Liu, Sencun Zhu, Wei Wang, and Jiqiang Liu. 2016. Alde: privacy risk analysis of analytics libraries in the android ecosystem. In International Conference on Security and Privacy in Communication Systems. Springer, 655--672."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23092"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23039"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Abbas Razaghpanah Rishab Nithyanand Narseo Vallina-Rodriguez Srikanth Sundaresan Mark Allman Christian Kreibich and Phillipa Gill. 2018. Apps Trackers Privacy and Regulators: A Global Study of the Mobile Tracking Ecosystem. (2018).","DOI":"10.14722\/ndss.2018.23353"},{"key":"e_1_3_2_1_41_1","volume-title":"Haystack: In situ mobile traffic analysis in user space. arXiv preprint arXiv:1510.01419","author":"Razaghpanah Abbas","year":"2015","unstructured":"Abbas Razaghpanah, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Christian Kreibich, Phillipa Gill, Mark Allman, and Vern Paxson. 2015. Haystack: In situ mobile traffic analysis in user space. arXiv preprint arXiv:1510.01419 (2015), 1--13."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23143"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/2906388.2906392"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2766498.2766523"},{"key":"e_1_3_2_1_45_1","volume-title":"FLEXDROID: Enforcing In-App Privilege Separation in Android.. In NDSS.","author":"Seo Jaebaek","year":"2016","unstructured":"Jaebaek Seo, Daehyeok Kim, Donghyun Cho, Insik Shin, and Taesoo Kim. 2016. FLEXDROID: Enforcing In-App Privilege Separation in Android.. In NDSS."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884855"},{"key":"e_1_3_2_1_47_1","volume-title":"Apktool-A tool for reverse engineering 3rd party, closed, binary Android apps","author":"Tumbleson Connor","unstructured":"Connor Tumbleson and Ryszard Wisniewski. 2017. Apktool-A tool for reverse engineering 3rd party, closed, binary Android apps."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/2398776.2398812"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180196"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2016.55"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516689"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23034"}],"event":{"name":"ICSE '20: 42nd International Conference on Software Engineering","location":"Seoul South Korea","acronym":"ICSE '20","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","KIISE Korean Institute of Information Scientists and Engineers","IEEE CS"]},"container-title":["Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377811.3380401","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3377811.3380401","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:41:40Z","timestamp":1750200100000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377811.3380401"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,27]]},"references-count":51,"alternative-id":["10.1145\/3377811.3380401","10.1145\/3377811"],"URL":"https:\/\/doi.org\/10.1145\/3377811.3380401","relation":{},"subject":[],"published":{"date-parts":[[2020,6,27]]},"assertion":[{"value":"2020-10-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}