Privacy and Inferences: Measurement, Detection, and Protection

The frequency of credit card leaks attests to the difficulty of protecting even declared user attributes. If we also consider sensitive information that can be inferred about a user, protection becomes even harder, yet many well-publicized privacy breaches involve inference.

In this talk, I'll begin two steps before protection and first discuss how to determine what users want to keep private. I'll focus on self-reported data, one of the most commonly used sources for understanding user privacy concerns, and methods for reducing self-report bias. Building on this, I'll present a simple method for identifying the inference channels through which a user may reveal private information and I'll talk about how encryption can be used to protect against the completion of sensitive inference channels.

This talk will include examples demonstrating the use of these techniques to protect user privacy and to understand the relationship between privacy attitudes and behavior, including directions for further research.