SEKE 2012 Proceedings - Knowledge Systems Institute

le 2 shows that all OSNs except LinkedIn provide limited
coverage of connections, otherwise third parties can retrieve
user data without their consent as long as their friends’ data
is accessible. The LinkedIn API, however, strongly covers
second-degree connections. This accessiblility may be deliberate
to support LinkedIn’s main objective of mining connections
to establish professional and business relationships.
Thus, the LinkedIn API can be abused to collect signif cant
user information without directly targeting them.
Number of methods
Fb T G+ LI YT Ork
Prof le 44 14 33 40 25 52
Message 9 9 9 5 6 6
Media 21 12 0 0 6 10
Friend 2 1 1 23 0 1
Friend-of-friend 0 1 0 21 0 0
Brand 7 0 6 0 0 0
Event 7 0 0 0 0 0
Group 6 1 3 0 0 0
Note 7 0 0 2 0 0
Coverage (%)
Fb T G+ LI YT Ork
Prof le 80 70 70 90 85 90
Message 90 90 90 100 85 60
Media 90 100 0 - 85 65
Friend 20 100 15 100 - 15
Friend-of-Friend 0 35 0 100 - 0
Brand 100 - 85 - - -
Event 100 - - - - -
Group 100 100 60 - - -
Note 100 - - 100 - -
Table 2. User information – # and coverage
3.2 Privacy Settings
OSN users can expect to control the spread and visibility
of their information through privacy settings. Each setting is
associated with a privacy option which indicates the pieces
of data it covers. Moreover, a privacy option is exercised by
assigning a scope, which identif es the audience of the data.
Next, we study the privacy options and scopes of the APIs.
3.2.1 Privacy Options
Privacy options may apply either to a collection of users’
data at the account level or to a specif c data item such as a
social message, a photo, or a video. Account-level options
are broad, whereas, item-level options are narrow. Itemlevel
options offer f ner, second layer of protection on top of
account-level options. For example, account-level options
may allow public access to all Facebook wall posts, but an
item-level option can restrict the visibility of a specif cpost.
We identif ed 35 distinct options; 20 are account-level, and
15 are item-level. Table 3 lists these options and their coverage
for each OSN.
Facebook and LinkedIn def ne a large number of accountlevel
options to give users substantial control over how they
can be searched and reached. LinkedIn users can decide
which f elds of their resume are publicly viewable, and who
can send them a message. Similarly, Facebook users can
choose the distance between themselves and other users who
can send them friend requests, and whether their prof le can
be indexed by a search engine. Google+ and Orkut have
weaker account-level options, and users can neither control
who can share information with them nor can they decide
how their prof le can be searched. Orkut’s limited accountlevel
options is concerning, because it seeks very personal
information as listed in Table 1. Finally, YouTube and Twitter
can implement numerous account-level options given the
type of information users share, and arguably these options
may even be necessary. However, the lack of these accountlevel
options may be intentional, because the purpose of
these OSNs is open, public sharing.
Number of options
Fb T G+ LI YT Ork
Account 11 0 6 15 3 4
Item 9 2 3 2 3 4
Coverage (%)
Fb T G+ LI YT Ork
Account 70 0 50 85 25 35
Item 70 30 40 50 60 55
Table 3. Privacy options – # and coverage
Facebook and Google+ offer strong item-level options,
and users can limit the audience of a wall post, and identify
a group who can see an update. Other OSNs offer very
few item-level options and implementation of some additional,
feasible ones can easily enhance user privacy on these
OSNs. For example, Twitter can implement important itemlevel
options such as reviewing of tweets that mention a user,
and restricting the reach of tweets to specif c receivers.
3.2.2 Privacy Scopes
Very few users accept the notion that OSN activity is publicby-default,
private-by-effort; 84% Facebook prof les set to
full, default, public access [7] conf rm this belief. Most
users are also easily confused and frustrated by too many options
and scopes and are therefore discouraged from changing
their default settings [11]. Savvy users, however, need
comprehensive options and scopes to adequately manage
their privacy. This conf ict poses a tradeoff between the
number of options and scopes and their usability.
Table 4 lists the privacy scopes for each OSN; a (x)̌ indicates
(un)availability of a scope. Only Twitter (YouTube)
403