The study investigates text input field security in web browsers, revealing that browsers’ permission model breaches security principles. Two vulnerabilities are found, including passwords exposed as plaintext in HTML source code. A proof-of-concept extension demonstrates the impact, bypassing review processes. The vulnerabilities are widespread, affecting major sites like Google. Around 12.5% of extensions could exploit these flaws, with 190 extensions accessing passwords directly. The study proposes remedies: a JavaScript package for developers to safeguard input fields and a browser-level alert for sensitive field access. The research underscores the demand for enhanced online user information protection.

Google now requires developers to implement Data Safety Sections (DSS) for improved transparency in data collection and sharing. A research paper analyzes Google’s DSS through quantitative and qualitative methods, examining a large number of apps (1.1 million) from the Android Play store. The study identifies inconsistencies and instances of both over and under-reporting practices in DSS content. A longitudinal analysis indicates that developers are still adapting their practices over time. The research also delves into the challenges developers face when working with DSS, highlighting the need for better resources and guidelines to ensure accurate and reliable privacy labels, which are crucial for their effectiveness.

Privacy nutrition labels provide a way to understand an app’s key data practices without reading the long and hard-to-read privacy policies. Recently, the app distribution platforms for iOS(Apple) and Android(Google) have implemented mandates requiring app developers to fill privacy nutrition labels highlighting their privacy practices such as data collection, data sharing, and security practices. These privacy labels contain very fine-grained information about the apps’ data practices such as the data types and purposes associated with each data type. This provides us with a unique vantage point from which we can understand apps’ data practices at scale.

Online services utilize privacy settings to provide users with control over their data. However, these privacy settings are often hard to locate, causing the user to rely on provider-chosen default values. In this work, we train privacy settings centric encoders and leverage them to create an interface that allows users to search for privacy settings using free-form queries.

Online services utilize privacy settings to provide users with control over their data. However, these privacy settings are often hard to locate, causing the user to rely on provider-chosen default values. In this work, we train privacy settings centric encoders and leverage them to create an interface that allows users to search for privacy settings using free-form queries. To achieve this, we create a custom Semantic Similarity dataset, which consists of real user queries covering various privacy settings. We then use this dataset to fine-tune the state of the art encoders. Using these fine-tuned encoders, we perform semantic matching between the user queries and the privacy settings to retrieve the most relevant setting. Finally, we also use these encoders to generate embeddings of privacy settings from the top 100 websites and perform unsupervised clustering to learn about the online privacy settings types.