{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T06:02:47Z","timestamp":1775023367661,"version":"3.50.1"},"reference-count":44,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"1","license":[{"start":{"date-parts":[[2021,11,20]],"date-time":"2021-11-20T00:00:00Z","timestamp":1637366400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/3.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,1,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>End users are increasingly using trigger-action platforms like <jats:italic>If-This-Then-That<\/jats:italic> (IFTTT) to create applets to connect smart-home devices and services. However, there are inherent implicit risks in using such applets\u2014even non-malicious ones\u2014as sensitive information may leak through their use in certain contexts (<jats:italic>e.g.,<\/jats:italic> where the device is located, who can observe the resultant action). This work aims to understand to what extent end users can assess this implicit risk. More importantly we explore whether usage context makes a difference in end-users\u2019 perception of such risks. Our work complements prior work that has identified the impact of usage context on expert evaluation of risks in IFTTT by focusing the impact of usage context on end-users\u2019 risk perception. Through a Mechanical Turk survey of 386 participants on 49 smart-home IFTTT applets, we found that participants have a nuanced view of contextual factors and that different values for contextual factors impact end-users\u2019 risk perception differently. Further, our findings show that nudging the participants to think about different usage contexts led them to think deeper about the associated risks and raise their concern scores.<\/jats:p>","DOI":"10.2478\/popets-2022-0009","type":"journal-article","created":{"date-parts":[[2021,11,21]],"date-time":"2021-11-21T02:43:09Z","timestamp":1637462589000},"page":"166-186","source":"Crossref","is-referenced-by-count":9,"title":["If This <i>Context<\/i> Then That <i>Concern<\/i>: Exploring users\u2019 concerns with IFTTT applets"],"prefix":"10.56553","volume":"2022","author":[{"given":"Mahsa","family":"Saeidi","sequence":"first","affiliation":[{"name":"Affil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"McKenzie","family":"Calvert","sequence":"additional","affiliation":[{"name":"Affil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Audrey W.","family":"Au","sequence":"additional","affiliation":[{"name":"Affil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anita","family":"Sarma","sequence":"additional","affiliation":[{"name":"Affil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rakesh B.","family":"Bobba","sequence":"additional","affiliation":[{"name":"Affil"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"35752","published-online":{"date-parts":[[2021,11,20]]},"reference":[{"key":"2022062314370063002_j_popets-2022-0009_ref_001","unstructured":"[1] If This, Then That (IFTTT). https:\/\/www.ifttt.com\/. Accessed: 2019-09-9."},{"key":"2022062314370063002_j_popets-2022-0009_ref_002","doi-asserted-by":"crossref","unstructured":"[2] Noah Apthorpe, Yan Shvartzshnaider, Arunesh Mathur, Dillon Reisman, and Nick Feamster. Discovering smart home internet of things privacy norms using contextual integrity. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 2(2):1\u201323, 2018.10.1145\/3214262","DOI":"10.1145\/3214262"},{"key":"2022062314370063002_j_popets-2022-0009_ref_003","doi-asserted-by":"crossref","unstructured":"[3] Iulia Bastys, Musard Balliu, and Andrei Sabelfeld. If this then what?: Controlling flows in iot apps. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pages 1102\u20131119. ACM, 2018.10.1145\/3243734.3243841","DOI":"10.1145\/3243734.3243841"},{"key":"2022062314370063002_j_popets-2022-0009_ref_004","unstructured":"[4] Microsoft Flow: Automate processes and tasks. https:\/\/flow.microsoft.com\/. Accessed: 2019-09-9."},{"key":"2022062314370063002_j_popets-2022-0009_ref_005","doi-asserted-by":"crossref","unstructured":"[5] Rainer B\u00f6hme and Stefan K\u00f6psell. Trained to accept?: A field experiment on consent dialogs. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI \u201910, pages 2403\u20132406, New York, NY, USA, 2010. ACM.10.1145\/1753326.1753689","DOI":"10.1145\/1753326.1753689"},{"key":"2022062314370063002_j_popets-2022-0009_ref_006","unstructured":"[6] Apple\u2019s HomeKit. http:\/\/www.apple.com\/ios\/home\/. Accessed: 2019-09-9."},{"key":"2022062314370063002_j_popets-2022-0009_ref_007","unstructured":"[7] Z Berkay Celik, Leonardo Babun, Amit Kumar Sikder, Hidayet Aksu, Gang Tan, Patrick McDaniel, and A Selcuk Uluagac. Sensitive information tracking in commodity iot. In 27th USENIX Security Symposium (USENIX Security 18), pages 1687\u20131704, 2018."},{"key":"2022062314370063002_j_popets-2022-0009_ref_008","unstructured":"[8] Z Berkay Celik, Patrick McDaniel, and Gang Tan. Soteria: Automated iot safety and security analysis. In 2018 USENIX Annual Technical Conference (USENIX ATC 18), pages 147\u2013158, 2018."},{"key":"2022062314370063002_j_popets-2022-0009_ref_009","doi-asserted-by":"crossref","unstructured":"[9] Z Berkay Celik, Gang Tan, and Patrick D McDaniel. Iot-guard: Dynamic enforcement of security and safety policy in commodity iot. In NDSS, 2019.10.14722\/ndss.2019.23326","DOI":"10.14722\/ndss.2019.23326"},{"key":"2022062314370063002_j_popets-2022-0009_ref_010","unstructured":"[10] Eun Kyoung Choe, Sunny Consolvo, Jaeyeon Jung, Beverly Harrison, Shwetak N Patel, and Julie A Kientz. Investigating receptiveness to sensing and inference in the home using sensor proxies. In Proceedings of the 2012 ACM Conference on Ubiquitous Computing, pages 61\u201370. ACM, 2012."},{"key":"2022062314370063002_j_popets-2022-0009_ref_011","unstructured":"[11] Camille Cobb, Milijana Surbatovich, Anna Kawakami, Mah-mood Sharif, Lujo Bauer, Anupam Das, and Limin Jia. How risky are real users\u2019 ifttt applets? In Sixteenth Symposium on Usable Privacy and Security ({SOUPS} 2020), pages 505\u2013529, 2020."},{"key":"2022062314370063002_j_popets-2022-0009_ref_012","unstructured":"[12] Zapier: Automate Workflows. https:\/\/zapier.com\/. Accessed: 2019-09-9."},{"key":"2022062314370063002_j_popets-2022-0009_ref_013","unstructured":"[13] Samsung Smartthings. https:\/\/www.smartthings.com\/. Accessed: 2019-09-9."},{"key":"2022062314370063002_j_popets-2022-0009_ref_014","doi-asserted-by":"crossref","unstructured":"[14] Earlence Fernandes, Jaeyeon Jung, and Atul Prakash. Security analysis of emerging smart home applications. In 2016 IEEE symposium on security and privacy (SP), pages 636\u2013654. IEEE, 2016.10.1109\/SP.2016.44","DOI":"10.1109\/SP.2016.44"},{"key":"2022062314370063002_j_popets-2022-0009_ref_015","unstructured":"[15] Earlence Fernandes, Justin Paupore, Amir Rahmati, Daniel Simionato, Mauro Conti, and Atul Prakash. Flowfence: Practical data protection for emerging iot application frameworks. In 25th USENIX Security Symposium (USENIX Security 16), pages 531\u2013548, 2016."},{"key":"2022062314370063002_j_popets-2022-0009_ref_016","unstructured":"[16] Joseph L Fleiss, Bruce Levin, and Myunghee Cho Paik. Statistical methods for rates and proportions. john wiley & sons, 2013."},{"key":"2022062314370063002_j_popets-2022-0009_ref_017","doi-asserted-by":"crossref","unstructured":"[17] Hana Habib, Neil Shah, and Rajan Vaish. Impact of contextual factors on snapchat public sharing. In Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, pages 1\u201313, 2019.10.1145\/3290605.3300256","DOI":"10.1145\/3290605.3300256"},{"key":"2022062314370063002_j_popets-2022-0009_ref_018","unstructured":"[18] Weijia He, Maximilian Golla, Roshni Padhi, Jordan Ofek, Markus D\u00fcrmuth, Earlence Fernandes, and Blase Ur. Re-thinking access control and authentication for the home internet of things (iot). In 27th USENIX Security Symposium (USENIX Security 18), pages 255\u2013272, 2018."},{"key":"2022062314370063002_j_popets-2022-0009_ref_019","unstructured":"[19] OPENHAB: Open Source Automation Software for Home. https:\/\/www.openhab.org\/. Accessed: 2019-09-9."},{"key":"2022062314370063002_j_popets-2022-0009_ref_020","unstructured":"[20] What is IFTTT? How to use If This, Then That services. https:\/\/www.computerworld.com\/article\/3239304\/what-isifttt-how-to-use-if-this-then-that-services.html. Accessed: 2020-12-12."},{"key":"2022062314370063002_j_popets-2022-0009_ref_021","unstructured":"[21] Yunhan Jack Jia, Qi Alfred Chen, Shiqi Wang, Amir Rahmati, Earlence Fernandes, Zhuoqing Morley Mao, and Atul Prakash. Contexlot: Towards providing contextual integrity to appified iot platforms. In NDSS, 2017."},{"key":"2022062314370063002_j_popets-2022-0009_ref_022","doi-asserted-by":"crossref","unstructured":"[22] Kim J Kaaz, Alex Hoffer, Mahsa Saeidi, Anita Sarma, and Rakesh B Bobba. Understanding user perceptions of privacy, and configuration challenges in home automation. In 2017 IEEE Symposium on Visual Languages and Human-Centric Computing (VL\/HCC), pages 297\u2013301. IEEE, 2017.10.1109\/VLHCC.2017.8103482","DOI":"10.1109\/VLHCC.2017.8103482"},{"key":"2022062314370063002_j_popets-2022-0009_ref_023","unstructured":"[23] Ruogu Kang, Stephanie Brown, Laura Dabbish, and Sara Kiesler. Privacy attitudes of mechanical turk workers and the us public. In 10th Symposium On Usable Privacy and Security ({SOUPS} 2014), pages 37\u201349, 2014."},{"key":"2022062314370063002_j_popets-2022-0009_ref_024","doi-asserted-by":"crossref","unstructured":"[24] Patrick Gage Kelley, Lucian Cesca, Joanna Bresee, and Lorrie Faith Cranor. Standardizing privacy notices: An online study of the nutrition label approach. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI \u201910, pages 1573\u20131582, New York, NY, USA, 2010. ACM.10.1145\/1753326.1753561","DOI":"10.1145\/1753326.1753561"},{"key":"2022062314370063002_j_popets-2022-0009_ref_025","doi-asserted-by":"crossref","unstructured":"[25] Hosub Lee and Alfred Kobsa. Understanding user privacy in internet of things environments. In 2016 IEEE 3rd World Forum on Internet of Things (WF-IoT), pages 407\u2013412. IEEE, 2016.10.1109\/WF-IoT.2016.7845392","DOI":"10.1109\/WF-IoT.2016.7845392"},{"key":"2022062314370063002_j_popets-2022-0009_ref_026","doi-asserted-by":"crossref","unstructured":"[26] Hosub Lee and Alfred Kobsa. Privacy preference modeling and prediction in a simulated campuswide iot environment. In 2017 IEEE International Conference on Pervasive Computing and Communications (PerCom), pages 276\u2013285. IEEE, 2017.10.1109\/PERCOM.2017.7917874","DOI":"10.1109\/PERCOM.2017.7917874"},{"key":"2022062314370063002_j_popets-2022-0009_ref_027","unstructured":"[27] Jialiu Lin, Shahriyar Amini, Jason I Hong, Norman Sadeh, Janne Lindqvist, and Joy Zhang. Expectation and purpose: understanding users\u2019 mental models of mobile app privacy through crowdsourcing. In Proceedings of the 2012 ACM conference on ubiquitous computing, pages 501\u2013510. ACM, 2012."},{"key":"2022062314370063002_j_popets-2022-0009_ref_028","doi-asserted-by":"crossref","unstructured":"[28] Hiroaki Masaki, Kengo Shibata, Shui Hoshino, Takahiro Ishihama, Nagayuki Saito, and Koji Yatani. Exploring nudge designs to help adolescent sns users avoid privacy and safety threats. In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, pages 1\u201311, 2020.10.1145\/3313831.3376666","DOI":"10.1145\/3313831.3376666"},{"key":"2022062314370063002_j_popets-2022-0009_ref_029","unstructured":"[29] Pardis Emami Naeini, Sruti Bhagavatula, Hana Habib, Martin Degeling, Lujo Bauer, Lorrie Faith Cranor, and Norman Sadeh. Privacy expectations and preferences in an iot world. In Thirteenth Symposium on Usable Privacy and Security (SOUPS 2017), pages 399\u2013412, 2017."},{"key":"2022062314370063002_j_popets-2022-0009_ref_030","doi-asserted-by":"crossref","unstructured":"[30] Patricia A Norberg, Daniel R Horne, and David A Horne. The privacy paradox: Personal information disclosure intentions versus behaviors. Journal of Consumer Affairs, 41(1):100\u2013126, 2007.","DOI":"10.1111\/j.1745-6606.2006.00070.x"},{"key":"2022062314370063002_j_popets-2022-0009_ref_031","doi-asserted-by":"crossref","unstructured":"[31] S\u00f6ren Preibusch. Guide to measuring privacy concern: Review of survey and observational instruments. International Journal of Human-Computer Studies, 71(12):1133\u20131143, 2013.","DOI":"10.1016\/j.ijhcs.2013.09.002"},{"key":"2022062314370063002_j_popets-2022-0009_ref_032","unstructured":"[32] R Core Team. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing, Vienna, Austria, 2013."},{"key":"2022062314370063002_j_popets-2022-0009_ref_033","doi-asserted-by":"crossref","unstructured":"[33] Elissa M Redmiles, Sean Kross, and Michelle L Mazurek. How well do my results generalize? comparing security and privacy survey results from mturk, web, and telephone samples. In 2019 2019 IEEE Symposium on Security and Privacy (SP), Vol. 00. IEEE, pages 227\u2013244, 2019.10.1109\/SP.2019.00014","DOI":"10.1109\/SP.2019.00014"},{"key":"2022062314370063002_j_popets-2022-0009_ref_034","doi-asserted-by":"crossref","unstructured":"[34] Norman Sadeh, Jason Hong, Lorrie Cranor, Ian Fette, Patrick Kelley, Madhu Prabaker, and Jinghai Rao. Understanding and capturing people\u2019s privacy policies in a mobile social networking application. Personal and Ubiquitous Computing, 13(6):401\u2013412, 2009.10.1007\/s00779-008-0214-3","DOI":"10.1007\/s00779-008-0214-3"},{"key":"2022062314370063002_j_popets-2022-0009_ref_035","unstructured":"[35] Florian Schaub, Rebecca Balebako, Adam L. Durity, and Lorrie Faith Cranor. A design space for effective privacy notices. In Proceedings of the Eleventh USENIX Conference on Usable Privacy and Security, SOUPS \u201915, pages 1\u201317, Berkeley, CA, USA, 2015. USENIX Association."},{"key":"2022062314370063002_j_popets-2022-0009_ref_036","doi-asserted-by":"crossref","unstructured":"[36] Milijana Surbatovich, Jassim Aljuraidan, Lujo Bauer, Anupam Das, and Limin Jia. Some recipes can do more than spoil your appetite: Analyzing the security and privacy risks of ifttt recipes. In Proceedings of the 26th International Conference on World Wide Web, pages 1501\u20131510. International World Wide Web Conferences Steering Committee, 2017.10.1145\/3038912.3052709","DOI":"10.1145\/3038912.3052709"},{"key":"2022062314370063002_j_popets-2022-0009_ref_037","unstructured":"[37] Yuan Tian, Nan Zhang, Yueh-Hsun Lin, XiaoFeng Wang, Blase Ur, Xianzheng Guo, and Patrick Tague. Smartauth: User-centered authorization for the internet of things. In 26th USENIX Security Symposium (USENIX Security 17), pages 361\u2013378, 2017."},{"key":"2022062314370063002_j_popets-2022-0009_ref_038","doi-asserted-by":"crossref","unstructured":"[38] Janice Y Tsai, Patrick Kelley, Paul Drielsma, Lorrie Faith Cranor, Jason Hong, and Norman Sadeh. Who\u2019s viewed you?: the impact of feedback in a mobile location-sharing application. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pages 2003\u20132012. ACM, 2009.10.1145\/1518701.1519005","DOI":"10.1145\/1518701.1519005"},{"key":"2022062314370063002_j_popets-2022-0009_ref_039","doi-asserted-by":"crossref","unstructured":"[39] Gerhard Tutz and Wolfgang Hennevogl. Random effects in ordinal regression models. Computational Statistics & Data Analysis, 22(5):537\u2013557, 1996.10.1016\/0167-9473(96)00004-7","DOI":"10.1016\/0167-9473(96)00004-7"},{"key":"2022062314370063002_j_popets-2022-0009_ref_040","unstructured":"[40] Blase Ur, Elyse McManus, Melwyn Pak Yong Ho, and Michael L Littman. Practical trigger-action programming in the smart home. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pages 803\u2013812. ACM, 2014."},{"key":"2022062314370063002_j_popets-2022-0009_ref_041","doi-asserted-by":"crossref","unstructured":"[41] Qi Wang, Wajih Ul Hassan, Adam Bates, and Carl Gunter. Fear and logging in the internet of things. In Network and Distributed Systems Symposium, 2018.10.14722\/ndss.2018.23282","DOI":"10.14722\/ndss.2018.23282"},{"key":"2022062314370063002_j_popets-2022-0009_ref_042","doi-asserted-by":"crossref","unstructured":"[42] Yang Wang, Pedro Giovanni Leon, Alessandro Acquisti, Lorrie Faith Cranor, Alain Forget, and Norman Sadeh. A field trial of privacy nudges for facebook. In Proceedings of the SIGCHI conference on human factors in computing systems, pages 2367\u20132376, 2014.10.1145\/2556288.2557413","DOI":"10.1145\/2556288.2557413"},{"key":"2022062314370063002_j_popets-2022-0009_ref_043","doi-asserted-by":"crossref","unstructured":"[43] Guoming Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. Dolphinattack: Inaudible voice commands. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 103\u2013117. ACM, 2017.10.1145\/3133956.3134052","DOI":"10.1145\/3133956.3134052"},{"key":"2022062314370063002_j_popets-2022-0009_ref_044","doi-asserted-by":"crossref","unstructured":"[44] Serena Zheng, Noah Apthorpe, Marshini Chetty, and Nick Feamster. User perceptions of smart home iot privacy. Proceedings of the ACM on Human-Computer Interaction, 2(CSCW):1\u201320, 2018.10.1145\/3274469","DOI":"10.1145\/3274469"}],"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.sciendo.com\/pdf\/10.2478\/popets-2022-0009","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,7,20]],"date-time":"2022-07-20T16:31:52Z","timestamp":1658334712000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2022\/popets-2022-0009.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,20]]},"references-count":44,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2021,11,20]]},"published-print":{"date-parts":[[2022,1,1]]}},"alternative-id":["10.2478\/popets-2022-0009"],"URL":"https:\/\/doi.org\/10.2478\/popets-2022-0009","relation":{},"ISSN":["2299-0984"],"issn-type":[{"value":"2299-0984","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,11,20]]}}}