Michael Dowd
email: m.s.dowd@edu.salford.ac.uk

Contextualised Concerns: The Online Privacy Attitudes of Young Adults

Keywords: Online privacy, Young adults, Qualitative

Existing research into online privacy attitudes, whilst useful, remains insufficient. This paper begins by outlining the shortcomings of this existing research before offering a fresh approach which is inspired by Solove's notion of "situated and dynamic" privacy. With reference to ongoing PhD research it is argued that the generation of rich, situated data can help us to understand privacy attitudes in context. In this research semi-structured interviews are being used in order to grasp how young adults understand, manage, and negotiate their privacy across online settings. The paper concludes with a call for further qualitative research into online privacy attitudes and suggests focusing on more niche online settings than Facebook.

Introduction

As technological advancements are made, new means of both violating and protecting privacy may emerge and this is why technological developments are often met with concerns and questions relating to privacy. Indeed the most widely cited text in privacy literature, Warren and Brandeis' landmark 1890 publication: "The Right to Privacy" [START_REF] Warren | The Right to Privacy[END_REF], was concerned with the "recent inventions" of instantaneous photographs and advanced printing technologies, which were described as threatening to: "…make good the prediction that "what is whispered in the closet shall be proclaimed from the house-tops." [START_REF] Warren | The Right to Privacy[END_REF]. It should come as little surprise then that the rapid evolution of the internet has been accompanied by increasing interest in its impact on privacy, as is illustrated both by the current focus of media attention on the topic [START_REF] Aaronovitch | Online truth is more valuable than privacy[END_REF][START_REF] Chakrabortty | Facebook, Google and Twitter: custodians of our most intimate secrets[END_REF][START_REF] Keegan | Where does privacy fit in the online video revolution? Guardian[END_REF] and also the growing body of academic research into a wide range of issues relating to online privacy.

The existing research into online privacy emanates from a broad range of disciplines including law, computer science, business, media and various others. It is important for any work in this area to explicate its disciplinary background because research from these diverse disciplines of course focuses on varying aspects of online privacy e.g. computer scientists tend to be concerned with the technical means of protecting privacy online, whilst business researchers are usually interested in the difficulties online privacy concerns can pose for e-marketing. This paper is written from a sociological perspective and is concerned with people's attitudes, understandings, behaviours and concerns relating to online privacy. There is a useful body of existing research into online privacy attitudes but, as will be explained, it remains insufficient and so a fresh research approach will be offered here This paper will present ongoing PhD research into the online privacy attitudes of young adults in support of the view that context is vitally important in understanding privacy attitudes. It will be shown that because of this it can be very fruitful for researchers to take an inductive research approach, generating situated data which can help us to understand privacy attitudes in particular contexts. It will be argued that generating data of this nature, and so offering insights beyond those offered by previous survey research, is the real value of social science in researching online privacy.

In order to achieve these aims the paper will be structured in the following way: firstly, the existing online privacy literature which has informed this research will be summarised and its influence clarified; secondly, the research methods being used here will be described and the rationale for their selection justified; and thirdly, interim findings from the PhD research will be cautiously presented in order to demonstrate both the significance of the research, and also the nature of the data being generated.

Existing Research

The existing literature relating to online privacy attitudes can be divided largely into two distinct categories with contrasting research approaches. Firstly, there is a significant body of quantitative, survey based research which comes generally from a business and marketing perspective. In the past this research had tended to focus on issues of consumer privacy [START_REF] Bellman | International Differences in Information Privacy Concerns: a Global Survey of Consumers[END_REF][START_REF] Garbarino | Gender differences in the perceived risk of buying online and the effects of receiving a site recommendation[END_REF][START_REF] Moscardelli | Adolescents' Concern for Privacy When Using the Internet: An Empirical Analysis of Predictors and Relationships With Privacy-Protecting Behaviors[END_REF][START_REF] Milne | A Segmentation Study of Consumers' Attitudes Toward Direct Mail[END_REF][START_REF] Nowak | Understanding Privacy Concerns: An Assessment of Consumers' Information-Related Knowledge and Beliefs[END_REF] and so was concerned with commercial, rather than social, activities, the "instrumental", rather than the "expressive", internet [START_REF] Tufekci | Can you see me now? Audience and disclosure regulation in online social network sites[END_REF]. This trend, however, has faded away in recent years with the publication of quantitative research into social networking sites [START_REF] Hoy | Gender Differences in Privacy-Related Measures for Young Adult Facebook Users[END_REF]. Secondly, there is a growing amount of relevant qualitative research exploring the use of social networking sites. This research has developed in response to the rapid growth in popularity of such sites [START_REF] Boyd | Social Network Sites: Definition, History, and Scholarship[END_REF] and, whilst not always focused specifically on privacy, it does make important contributions to understanding the online privacy attitudes of social networking site users. Survey questionnaires have been by far the most popular method used for researching online privacy attitudes and so we will begin by summarising the key survey findings which have informed this research.

Survey Research

There are two prominent themes which have emerged from the existing survey literature and inform the PhD research presented here: the "privacy paradox", and "determinant factors". The "privacy paradox" is the apparent disconnect, or even contradiction, between reported privacy attitudes and actual behaviours. Surveys have found that users, perhaps particularly young adults [START_REF] Barnes | A privacy paradox: Social networking in the United States[END_REF], report themselves to be very concerned about their online privacy and the flow of their personal information, yet upon examining their behaviour it seems they freely share personal information and either do not engage, or do not engage effectively, with privacy settings on social networking sites [START_REF] Gross | Information Revelation and Privacy in Online Social Networks[END_REF]. The "privacy paradox" has been evident in surveys of both social [START_REF] Barnes | A privacy paradox: Social networking in the United States[END_REF][START_REF] Gross | Information Revelation and Privacy in Online Social Networks[END_REF] and commercial [START_REF] Norberg | The privacy paradox: Personal information disclosure intentions versus behaviours[END_REF] aspects of internet use. A number of possible explanations for the "privacy paradox" have been suggested but none have been widely accepted. Stenger and Coutant have contended that users may indeed be concerned about their online privacy but lack the technical skills and understanding required to protect it [START_REF] Stenger | How Teenagers Deal with their Privacy on Social Network Sites? Results from a National Survey in France[END_REF]. Albrechtslund has outlined the "moral panic" perspective: that users actually have a complete lack of interest in personal privacy [START_REF] Albrechtslund | Online Social Networking as Participatory Surveillance[END_REF]. It has also been suggested that perhaps "optimistic bias" is at play, whereby users are concerned about privacy on a societal level but do not consider themselves to be vulnerable and so do not feel the need to actively protect their privacy [START_REF] Cho | Optimistic bias about online privacy risks: Testing the moderating effects of perceived controllability and prior experience[END_REF].

"Determinant factors" are demographic variables which have been found to apparently influence online privacy attitudes. Survey research has identified a number of apparent "determinant factors" including: gender, age and level of education. Gender is perhaps the most prominent of these as women have repeatedly and consistently been found to be more concerned about their online privacy than men [START_REF] Garbarino | Gender differences in the perceived risk of buying online and the effects of receiving a site recommendation[END_REF][START_REF] Coles-Kemp | Privacy on the Internet: Attitudes and Behaviours[END_REF][START_REF] Cho | A multinational study on online privacy: global concerns and local responses[END_REF][START_REF] Fogel | Internet social network communities: Risk taking, trust, and privacy concerns[END_REF][START_REF] O'neil | Analysis of Internet Users' Level of Online Privacy Concerns[END_REF][START_REF] Sheehan | An investigation of gender differences in online privacy concerns and resultant behaviors[END_REF]. These gendered findings have also been supported by studies focused on adolescents [START_REF] Moscardelli | Adolescents' Concern for Privacy When Using the Internet: An Empirical Analysis of Predictors and Relationships With Privacy-Protecting Behaviors[END_REF][START_REF] Youn | Gender and Online Privacy among Teens: Risk Perception, Privacy Concerns, and Protection Behaviors[END_REF]. Age too has been repeatedly identified as a significant factor, with older people found to be generally more concerned about their online privacy than younger people [START_REF] Bellman | International Differences in Information Privacy Concerns: a Global Survey of Consumers[END_REF][START_REF] Nowak | Understanding Privacy Concerns: An Assessment of Consumers' Information-Related Knowledge and Beliefs[END_REF][START_REF] Cho | A multinational study on online privacy: global concerns and local responses[END_REF], although it is important to recognise that, despite these apparent patterns, levels of privacy concern vary considerably within age cohorts as well as across them [START_REF] Marwick | Youth, Privacy and Reputation: Literature Review. The Berkman Center for Internet[END_REF]. Numerous studies have found that higher levels of education correspond with higher levels of online privacy concern [START_REF] Milne | A Segmentation Study of Consumers' Attitudes Toward Direct Mail[END_REF][START_REF] Wang | Direct Marketing Activities and Personal Privacy: A Consumer Survey[END_REF] and this is supported by research which has found that those with higher levels of education are more likely to adopt privacy protective behaviours [START_REF] Nowak | Understanding Privacy Concerns: An Assessment of Consumers' Information-Related Knowledge and Beliefs[END_REF].

The robustness of these findings has been demonstrated by the consistency with which they have been replicated; however there remains a need to further explore these "determinant factors" in order to understand how and why they have an apparent influence. This is particularly true in the case of gender because, despite the consistent survey findings, there has been no sustained exploration of why women may be more concerned about their online privacy than men. The explanations suggested in the literature have merely been weakly extrapolated from research in other areas. For instance, Moscardelli and Divine [START_REF] Moscardelli | Adolescents' Concern for Privacy When Using the Internet: An Empirical Analysis of Predictors and Relationships With Privacy-Protecting Behaviors[END_REF] have argued that women are more concerned about their online privacy than men because they have a greater fear of danger citing research into the fear of crime. Garbarino and Strahilevitz [START_REF] Garbarino | Gender differences in the perceived risk of buying online and the effects of receiving a site recommendation[END_REF] have argued that women are more concerned because they are more risk averse generally, citing research from a variety of other domains to support this contention. These explanations do not have any empirical link to the research conducted and are completely unsatisfactory.

What is problematic about using survey research to further explore the "privacy paradox" and "determinant factors" is that the data generated is abstract and not rooted in the lived experiences of the research participants. Quantitative research is useful for identifying patterns but in order to insightfully explore these patterns, to understand how and why "determinant factors" such as gender might have an influence on privacy attitudes, and to better grasp the "privacy paradox", we contend that a qualitative approach is required. By adopting a qualitative approach the research can be inductive: a weakness of this existing body of research is its 'topdown' approach, relying on predetermined definitions of privacy built into precoded surveys. This denies participants the opportunity to express their own understandings of privacy and so ignores individuals' ability to make, modify and define privacy in their own terms, in different ways across contexts. By working inductively, understandings can be allowed to emerge through the generation of situated, contextualised data so that credible explanations, rooted in the lived experiences of participants, can be offered.

Qualitative Research

The emerging body of qualitative research into social networking sites makes use of ethnographic methods [START_REF] Boyd | Why Youth (Heart) Social Network Sites: The Role of Networked Publics[END_REF][START_REF] Raynes-Goldie | Aliases, creeping, and wall cleaning: Understanding privacy in the age of Facebook[END_REF][START_REF] Livingstone | Mediating the public/private boundary at home[END_REF][START_REF] Livingstone | Taking risky opportunities in youthful content creation: teenagers' use of social networking sites for intimacy, privacy and self-expression[END_REF][START_REF] West | Students' Facebook 'friends': public and private spheres[END_REF] and, although the specific research focus is not necessarily on privacy issues, the rich and contextualised data generated in these studies offers valuable insights into how users understand and manage their privacy in these online spaces.

Perhaps the central finding of the existing qualitative literature is that for young people online: "…"privacy" is not a singular variable" [START_REF] Marwick | Youth, Privacy and Reputation: Literature Review. The Berkman Center for Internet[END_REF], instead, different types of information are considered more or less private depending on who may have access to that information [START_REF] Livingstone | Taking risky opportunities in youthful content creation: teenagers' use of social networking sites for intimacy, privacy and self-expression[END_REF]. For instance, individuals may be content to share certain information with their friends but not with their parents, with potential romantic partners but not with employers and so on. The work of both Livingstone [START_REF] Livingstone | Mediating the public/private boundary at home[END_REF][START_REF] Livingstone | Taking risky opportunities in youthful content creation: teenagers' use of social networking sites for intimacy, privacy and self-expression[END_REF] and boyd [START_REF] Boyd | Why Youth (Heart) Social Network Sites: The Role of Networked Publics[END_REF][START_REF] Boyd | Facebook's Privacy Trainwreck: Exposure, Invasion, and Social Convergence[END_REF] makes clear that online settings, such as social networking sites, are not conceptualised by young people as straightforwardly "public" or "private" in a binary way, but instead distinctions are made based upon their 'imagined audience' [START_REF] Boyd | Why Youth (Heart) Social Network Sites: The Role of Networked Publics[END_REF] and the affordances of the particular online setting [START_REF] Livingstone | Taking risky opportunities in youthful content creation: teenagers' use of social networking sites for intimacy, privacy and self-expression[END_REF]. What "privacy" means and what is "private" online is context dependent and so understandings and negotiations of privacy can vary across online settings. These findings demonstrate the need for research into online privacy attitudes to generate data which is situated rather than abstract because privacy attitudes are contextual.

These ethnographic studies have also illuminated a variety of the ways in which users manage their privacy in these online spaces. boyd describes a variety of privacy protective behaviours which users sometimes adopt in order to retain control of who has access to their social networking profiles, in an attempt to manage 'social convergence' [START_REF] Boyd | Facebook's Privacy Trainwreck: Exposure, Invasion, and Social Convergence[END_REF]: falsifying identifying information such as age and location; engaging with privacy settings; and creating "mirror profiles" for instance [START_REF] Boyd | Why Youth (Heart) Social Network Sites: The Role of Networked Publics[END_REF]. More recent research into social networking sites has uncovered further means of managing privacy in these settings such as "wall cleaning" and creating aliases [START_REF] Raynes-Goldie | Aliases, creeping, and wall cleaning: Understanding privacy in the age of Facebook[END_REF]. The point here is that the nature of the data generated by these qualitative studies enables researchers to develop more granular and sophisticated understandings of how privacy is conceptualised and managed by users in the social networking sites studied.

The shortcoming of the existing qualitative research into social networking sites is that thus far it has remained focused on specific online activities and sites as chosen by the researcher, largely Facebook. This means that the ways in which understandings of privacy may alter, or remain constant, across online settings has not been explored and also that more niche online settings are being neglected. Nonetheless, the illuminating findings of this body of qualitative research and the nature of the data generated have, to some extent, inspired the methods employed in the PhD research presented here.

Conceptualising Privacy

Research into privacy attitudes is often presented with a lengthy discussion of the specific privacy definition being utilised in that particular paper. This research, however, does not rely on any predetermined, overarching conception of privacy but instead takes an approach which builds on the work of Solove [START_REF] Solove | Conceptualizing Privacy[END_REF] who proposed attempting to understand privacy contextually rather than in abstract.

Privacy is both historically and culturally contingent [START_REF] Bezanson | The Right to Privacy Revisited: Privacy, News, and Social Change, 1890-1990[END_REF], and has been recognised as being an especially 'elastic' concept [START_REF] Allen | Uneasy Access: Privacy for Women in a Free Society[END_REF], as is apparent from the vast number of ways in which it has been conceptualised. Solove has argued that the bewildering array of existing privacy conceptions can be dealt with in six categories: the right to be let alone; limited access to the self; secrecy; control over personal information; personhood; and intimacy [START_REF] Solove | Conceptualizing Privacy[END_REF]. These categories are not mutually exclusive, as there is overlap between conceptions, but Solove uses them as a means of critically examining the overall discourse on conceptualising privacy. Solove concludes that existing conceptions, whilst illuminating in relation to certain aspects of privacy, are either too narrow or too broad due to their attempts to isolate the "core" characteristics, or abstract "essence" of privacy [START_REF] Solove | Conceptualizing Privacy[END_REF].

Solove advocates a new and pragmatic approach to conceptualising privacy inspired by Wittgenstein's notion of 'family resemblances'. Solove contends that it would be more useful to attempt to understand privacy as an aspect of everyday practices, by focusing on specific privacy problems, rather than attempting to isolate the "core" characteristics of privacy in order to understand it as an abstract, overarching concept. In doing this, privacy can be conceptualised: "…from the bottom up rather than the top down, from particular contexts rather than in the abstract" [START_REF] Solove | Conceptualizing Privacy[END_REF], so recognising the: "…contextual and dynamic nature of privacy" [START_REF] Solove | Conceptualizing Privacy[END_REF]. This conceptual approach is consistent with our contention that the data generated by research into privacy attitudes must be situated rather than abstract and underpins the methodological decisions outlined in the following section.

Research Sample

The decision to focus on the online privacy attitudes of young adults was made for a number of reasons. Firstly, online privacy is considered to be an especially important issue for young people as they will be: "…the first to experience the aggregated effect of living a digital mediated life." [START_REF] Marwick | Youth, Privacy and Reputation: Literature Review. The Berkman Center for Internet[END_REF]. Secondly, today's young adults are widely recognised as being part of the first generation to grow up immersed in digital technology [START_REF] Tapscott | Growing Up Digital: The Rise of the Net Generation[END_REF][START_REF] Howe | Millennials Rising: The Next Great Generation[END_REF][START_REF] Prenksy | Digital natives, digital immigrants[END_REF] and so may be expected to have online experiences distinct from other demographic groups. Thirdly, much of the existing research into online privacy is focused on children [START_REF] Livingstone | Mediating the public/private boundary at home[END_REF][START_REF] Livingstone | Taking risky opportunities in youthful content creation: teenagers' use of social networking sites for intimacy, privacy and self-expression[END_REF][START_REF] Byron | Safer Children in a Digital World: The Report of the Byron Review[END_REF] and is often motivated by the public's desire to protect the young and 'vulnerable' [START_REF] Byron | Safer Children in a Digital World: The Report of the Byron Review[END_REF]. This research aims to recognise its participants not as "youth", "children" or "adolescents" in need of protection, but as young adults, responsible for themselves both online and offline.

"Young adults" have been defined as those born between 1990 and 1994 because the formative years of these people have coincided with the widespread integration of online communication and social media into everyday life: these young adults would have been aged between 5 and 9 when the instant messaging service "MSN" was launched in 1999; and between 8 and 12 when Friendster and MySpace heralded the arrival of mainstream social networking sites in 2002 [START_REF] Boyd | Social Network Sites: Definition, History, and Scholarship[END_REF]. In an English context this means that even before these people began studying at secondary school, aged 11, instant messaging had become everyday and widespread [START_REF] Lenhart | Teenage Life Online: The Rise of the Instant Message Generation and the Internet's Impact on Friendships and Family Relationships[END_REF], with social networking sites not far behind. The experiences of these young adults then may be distinct even from those only slightly older.

The sampling is purposive: participants are being recruited in an attempt to access a diversity of experience and attitudes [START_REF] Holstein | The Active Interview[END_REF]. Sampling has been informed by the existing literature which suggests gender and levels of education influence online privacy attitudes. For this reason, both men and women from a variety of educational backgrounds are being recruited e.g. college students; university students; vocational apprentices; those in employment; those not in education, employment or training. An aim underpinning the work is to explore understandings of privacy across online settings, including those which have previously been under researched, and this is why participants are being recruited from diverse online settings such as Last.fm and Foursquare. Offline recruitment of research participants has taken place via contacts in educational institutions and community groups.

Research Method

Inspired by the rich, insightful data generated in ethnographic studies of social networking sites [START_REF] Boyd | Why Youth (Heart) Social Network Sites: The Role of Networked Publics[END_REF][START_REF] Raynes-Goldie | Aliases, creeping, and wall cleaning: Understanding privacy in the age of Facebook[END_REF] this research is using a qualitative approach to explore how young adults understand, manage and negotiate their privacy online. This approach is suitable because the interest is in understanding the participants, their practices, and attitudes rather than in measuring or quantifying them [START_REF] Gilbert | Research, Theory and Method[END_REF]. Adopting a qualitative approach also allows us to work inductively: rather than limiting the research by imposing predefined, overarching definitions of privacy we instead allow understandings to emerge from the participants' own accounts. This enables us to conceptualise privacy contextually, as Solove has argued in favour of.

Semi-structured interviews are being conducted in order to generate situated and contextualised data: rather than asking all participants the same questions, participants are deliberately enabled to help shape discussions so ensuring that interviews focus on activities and issues which are familiar and relevant to them. This means that we do not limit the online settings which can be discussed: we focus on whichever online activities are most important to the participant. In exploring a variety of online settings the aim is to be able to make cross-contextual comparisons. This is important because as Jennifer Mason, a leading authority on qualitative research, has argued: "…instead of asking abstract questions, or taking a 'one-size-fits-all' structured approach, you may want to give maximum opportunity for the construction of contextual knowledge by focusing on relevant specifics in each interview…The point really is that if what you are interested in, ontologically and epistemologically speaking, is for example a social process which operates situationally, then you will need to ask situational rather than abstract questions." [START_REF] Mason | Qualitative Researching[END_REF] An interview guide is composed prior to interviews but its structure is not rigid: interviews are interpersonal events [START_REF] Kvale | Interviews: An Introduction to Qualitative Interviewing[END_REF] in which both the interviewer and interviewee are active, co-constructing knowledge [START_REF] Holstein | The Active Interview[END_REF], and so each interview is inevitably and desirably different. Field notes are made after each interview noting both theoretical and methodological reflections. These field notes are later read in conjunction with the interview transcriptions in order to retain as much of the interview context as possible when coding and analysing the data. The environments in which interviews are conducted vary but it is always ensured that a laptop with internet access is available so that participants are able to illustrate points with online examples if they wish to do so.

At this point interviews have been conducted with 15 participants. Interviews with further participants are currently being scheduled with recruitment continuing both online and offline. There are also plans for follow up interviews with some of the existing participants in order to further pursue specific issues raised in their initial interviews.

Interim Findings

It must be stressed that the findings cautiously presented here are only preliminary: research is continuing and data analysis is iterative and ongoing. It is intended that these preliminary findings begin to demonstrate the value of taking an inductive approach and generating rich, situated data when researching online privacy attitudes. The names of all participants are pseudonyms for reasons of confidentiality.

A broad range of online activities have been discussed in the interviews conducted so far, including: social networking, instant messaging, online gaming, blogging, online shopping, online banking, file sharing, and participation in interest driven online communities. The specific online settings which have been discussed in-depth have so far included: Last.fm, Facebook, MySpace, Bebo, Chat Roulette, "MSN", Mousebreaker, Amazon, eBay, YouTube, various dating websites and a number of chat forums.

Initial findings have indicated that all participants so far consider themselves to be techno-savvy internet users who are confident in their own abilities to manage their privacy online. Often participants have explicitly linked this confidence to technical skills, for example 'Frank' (Gender: male. Age: 17. Occupation: toolmaker) explained that: "I got an 'A' in ICT so I know most stuff about computers and the internet". Of course, how well placed this self-confidence actually is remains open to question. Related to this self-confidence has been an advocacy for personal responsibility in managing privacy online: often breaches of privacy, and general negative online experiences, have been characterised as being at least partially the fault of the victim. Breaches of online privacy have been described as resulting from the victim's own reckless behaviour, immaturity or lack of technical knowledge, as 'Luke' (Gender: male. Age: 17. Occupation: apprentice maintenance technician) phrased it: "It's just what you get yourself into".

The most prominent concerns expressed have been related to being deceived online, essentially the concern being that: "People online are not who they present themselves to be". Interestingly though this has not been in relation to e-commerce: concerns that online vendors are not reputable or genuine for instance, but instead it has been on a more social level. The kinds of deception which concern participants occur not during online transactions but through online interactions, whether that be via instant messaging, social networking sites or any other form of online communication. There has been a perceived distinction between being deceived by strangers, and being deceived by known parties. Being deceived by strangers has been associated with a physical threat from the "paedos", "creeps" and "weirdoes" ubiquitous in media reports [START_REF] Minchin | Postman jailed for child sex abuse[END_REF][START_REF] Savill | Father frog-marches internet paedophile to police[END_REF]. Whilst being deceived by known parties has been associated with the emotional threat of being embarrassed or humiliated, be it playfully by friends or maliciously by former partners seeking revenge for instance. Some participants explained that they were wary of deception as they themselves had deceived people online. For example, 'Kirsten' (Gender: female. Age: 16. Occupation: engineering student) explained how she had duped a female friend into believing an enamoured male had made contact with her: "I said, 'This lad fancies you', so I made an email address".

Participants have also recognised 'identity theft' as a concern, but not in the sense of financial fraud as the term is commonly used. Instead, the participants have expressed concerns about being impersonated online, perhaps via a convincing social networking profile or instant messaging account, and having their social identity stolen and, subsequently, their reputation damaged. A number of participants explained that this was the main reason they engaged with the privacy settings on social networking sites: to ensure that only those they trusted had access to photographs which could be used to convincingly impersonate them.

Some intriguing gender issues have also started to emerge. Male participants have expressed great enthusiasm for approaching "new girls" online, 'Frank' for instance explained that: "Lads, I know for definite, go on with their mates to Facebook profiles and they go through their friends. If they see a good looking girl they're obviously going to add them and try to get to know them and see if they get anywhere, if you know what I mean…I mean I've done it before." In stark contrast, female participants have consistently complained of the irritation of being approached by unfamiliar men. For example, 'Julie' (Gender: female. Age: 16. Occupation: engineering student) explained how she had grown tired of being approached by men through Bebo and so decided to move on to Facebook, although this migration from one social networking site to another did not actually solve the problem: "Ah, all the men and stuff adding me all the time [laughs]…and in the end I got sick of it that much I just deleted my account…I get it sometimes on Facebook". It has also been interesting to note the widespread use of gender stereotypes in perceptions of other internet users with older men frequently cast as "dirty old men" and female users widely considered vulnerable targets.

Other themes which have emerged and which will be explored further as the research progresses include interesting perceptions of age and the media. Participants commonly expressed concern for the privacy of younger users and also voiced the view that older people may lack the technical knowledge to understand online activities and interactions. Participants have inconsistently criticised media portrayals of privacy online and yet also cited the media in support of their own opinions. It could be interesting to explore further how participants connect media reports with their own attitudes, experiences and practices.

Significance of Findings

Whilst these findings are, as previously stressed, only preliminary they do begin to demonstrate the usefulness of the research approach adopted and the nature of the data being generated. By working inductively, understandings are allowed to emerge from participants' own accounts and this can lead to the revelation of previously hidden meanings. In this case, a fresh perspective was gained on the taken for granted term "identity theft". "Identity theft" commonly refers to a form of financial fraud but for the participants in this research the term had a quite different meaning related to their social identity. This insight could not have been gained from, for instance, a survey which posed the question: "How concerned are you about identity theft?" This potential for revealing previously hidden meanings and understandings is a key advantage of working inductively.

Issues of online privacy are embedded in everyday life and so it is important to try and understand where these issues fit into the lives of the participants. This is why semi-structured interviews are useful: they enable us to focus on "relevant specifics" [START_REF] Mason | Qualitative Researching[END_REF] in each interview in order to generate rich and contextualised data. The short data extracts presented here should have imparted a small flavour of the data and briefly illustrated its richness. The importance of data being rich and contextualised is that theories generated from such data will be rooted in the lived experiences of the participants. This is a departure from previous theorising on the influence of "determinant factors" which has relied on abstract data and, at times, weak extrapolation [START_REF] Garbarino | Gender differences in the perceived risk of buying online and the effects of receiving a site recommendation[END_REF][START_REF] Moscardelli | Adolescents' Concern for Privacy When Using the Internet: An Empirical Analysis of Predictors and Relationships With Privacy-Protecting Behaviors[END_REF]. The fact that previous research has consistently identified women as more concerned about their online privacy than men without any sustained exploration of why this is the case means that the gender issues emerging from the data are theoretically significant.

It is significant that many of the diverse online settings discussed in interviews so far are under-researched. Websites such as Last.fm, Chat Roulette and LookBook have attracted only small amounts of interest from academic researchers despite having considerable numbers of users engaging in activities with significant privacy implications. This is, of course, partly as a result of internet research having to pursue a "moving target" [START_REF] Livingstone | Critical debates in internet studies: reflections on an emerging field[END_REF], meaning that researchers may not always be able to keep pace with developments, but it is probably also to some extent due to the intense focus on Facebook. This indicates a need for research to focus on more diverse online settings.

Conclusion

This paper has emphasised the importance of context in understanding online privacy attitudes by providing an outline of ongoing PhD research and explaining its relationship with existing literature in the area. It has been contended that social scientists can make a significant contribution to research into online privacy attitudes by generating rich, situated data which can help us to understand privacy attitudes in context.

To conclude this paper it is appropriate to call for further qualitative research into online privacy attitudes. It could be especially fruitful for researchers to move their focus away from Facebook and to explore more niche online settings. The current trend of Facebook centered research is understandable, given its rapid growth in membership [48] and media attention on the sites, however, this does not justify neglecting other significant online settings. Last.fm for instance has a reported 30 million active members [START_REF] Jones | Last.fm Radio Announcement[END_REF] engaging in a variety of social activities based around music. This considerable membership only seems diminutive in comparison with the phenomenon that is Facebook. If privacy concerns are influenced by the affordances and audiences of particular online settings [START_REF] Boyd | Why Youth (Heart) Social Network Sites: The Role of Networked Publics[END_REF][START_REF] Livingstone | Mediating the public/private boundary at home[END_REF][START_REF] Livingstone | Taking risky opportunities in youthful content creation: teenagers' use of social networking sites for intimacy, privacy and self-expression[END_REF] then settings such as Last.fm are important for research into online privacy attitudes, not only because of their substantial membership, but also because of their varying technical affordances and differing social contexts.

Acknowledgements

. This work forms part of the Visualisation and Other Methods of Expression (VOME) research project and was supported by the Technology Strategy Board; the Engineering and Physical Sciences Research Council and the Economic and Social Research Council [grant number EP/G00255/X]


Anna Vapen
email: anna.vapen@liu.se

Nahid Shahmehri
email: nahid.shahmehri@liu.se

Security Levels for Web Authentication using Mobile Phones

Keywords: Authentication, information security, mobile phone, security levels, evaluation method

Mobile phones offer unique advantages for secure authentication: they are small and portable, provide multiple data transfer channels, and are nearly ubiquitous. While phones provide a flexible and capable platform, phone designs vary, and the security level of an authentication solution is influenced by the choice of channels and authentication methods. It can be a challenge to get a consistent overview of the strengths and weaknesses of the available alternatives. Existing guidelines for authentication usually do not consider the specific problems in mobile phone authentication. We provide a method for evaluating and designing authentication solutions using mobile phones, using an augmented version of the Electronic Authentication Guideline.

Introduction

Most people today have multiple accounts and identities on the Internet, which they use in everyday life for a variety of purposes, from the inconsequential to the vital. To access these accounts, digital identities consisting of username/password pairs are commonly used [START_REF] Mannan | Using a personal device to strengthen password authentication from an untrusted computer[END_REF]. Since users usually have many identities to remember, there is a risk that they will write the passwords down or choose the same password for several sites, which increases the risk of identity theft [START_REF] Yan | Password memorability and security: empirical results[END_REF]. Users also tend to choose simple passwords that can be revealed to an attacker in an online guessing attack [START_REF] Bonneau | The password thicket: technical and market failures in human authentication on the web[END_REF].

A hardware device can be used to ensure strong authentication by providing a tamper-resistant environment in which an authentication algorithm can run. Examples of hardware devices for authentication are smart cards, USB sticks, and devices with a display and a keypad [START_REF] Burr | Electronic authentication guideline[END_REF]. Hardware devices for authentication are mainly used in online banking and other security-critical applications. The hardware is issued by the service provider and dedicated to a specific application [START_REF] Hiltgen | Secure internet banking authentication[END_REF]. Dedicated hardware can require additional equipment, such as cables or card readers. It may be inconvenient for the user to carry the device and other equipment at all times, especially for mobile users who use multiple computers in different locations, for example at work, at home and at an Internet kiosk. Another option is to use a device that a user will already be carrying for a different reason. A mobile phone is an example of a device always available to the user. Furthermore, it does not require distribution to users, since most users already have access to a mobile phone [START_REF] Aloul | Two factor authentication using mobile phones[END_REF]. Examples of authentication solutions where a mobile phone is used are:

-2-clickAuth [START_REF] Vapen | 2-clickAuth -optical challenge-response authentication[END_REF], an optical authentication solution for identity providers; -Strong Authentication with Mobile Phones [START_REF] Van Thanh | Strong authentication with mobile phone as security token[END_REF], an authentication solution using SIM cards [START_REF] Rannenberg | Identity management in mobile cellular networks and related applications[END_REF]; -SWA [START_REF] Wu | Secure web authentication with mobile phones[END_REF], authentication adapted specifically for untrusted computers.

Since authentication solutions for mobile phones differ significantly from each other, and since there are many choices with regard to data transfer and communication, it can be difficult to determine how secure a solution is. It is also difficult to design a new authentication solution with a specified security level in mind, since the choices of input and communication depend on the specific situation.

We propose a method for the evaluation and design of authentication solutions that use mobile phones as secure hardware devices. Our method focuses on mobile phones and also considers usability, availability and economic aspects, as well as security. The method uses the security level concept from the Electronic Authentication Guideline from NIST [START_REF] Burr | Electronic authentication guideline[END_REF]. We also propose supplements to the guideline to include secure hardware devices that can communicate with a local computer or a remote authentication server.

The outline of this paper is as follows: section two describes aspects of the use of mobile phones in web authentication, section three describes the security level concept and shows our proposed supplements to the NIST Electronic Authentication Guidelines and section four explains our evaluation and design method. Section five describes case studies, section six describes related work, section seven describes future work and section eight concludes the paper.

Mobile Phones in Web Authentication

The variety of communication and input channels differentiates mobile phones from other hardware devices for authentication. The channels allow transfers of large amounts of data without time-consuming typing. The phone can also connect directly to a remote server via a long-range channel [START_REF] Van Thanh | Strong authentication with mobile phone as security token[END_REF]. However, the location of the user affects the availability of the channel, e.g. whether a longrange channel can be reached and if it is costly to use. The availability of an authentication solution depends on whether the communication channels in the solution can be used without extra equipment and costs. Since users are mobile and authenticate from different places, the hardware they use will not be consistent.

An authentication solution that is available to the user and reaches the required security level should also be easy to use, regardless of the user's skill level. Usability in a broader sense should also be considered, e.g. reduction of user actions needed to perform authentication.

There are also economic aspects to authentication, such as costs incurred by the user to access the long range communication channels and costs for purchase and distribution of equipment.

We discuss these factors in our design and evaluation method in section four. However, first we describe how the existing security levels can be adapted to mobile phones as authentication devices.

Proposal for New Security Levels

The Electronic Authentication Guideline from NIST [START_REF] Burr | Electronic authentication guideline[END_REF] defines four security levels (1-4 where 4 is the highest) that can be used for evaluating the security of authentication solutions in general. Below is a short overview of the guidelines.

Level 1: Single or multi-factor authentication with no identity proof. Protection against online guessing and replay attacks. Level 2: Single or multi-factor authentication. Protection against eavesdropping and the attacks from level 1. Level 3: Multi-factor authentication with protection against verifier impersonation, MitM attacks and the attacks from level 2. Level 3 requires a token used for authentication to be unlocked by the user using a password or biometrics. Only non-reusable data (e.g. one-time passwords) may be used. Level 4: Multi-factor authentication with FIPS-140-2 certified tamper-resistant hardware [START_REF]Security requirements for cryptographic modules[END_REF]. Protects against session hijacking and the attacks from level 3.

Since there are specific concerns related to phones, we suggest complementing the Electronic Authentication Guideline [START_REF] Burr | Electronic authentication guideline[END_REF] so that it can handle phone specific issues, such as eavesdropping on short range (i.e. between a phone and a nearby computer) communication channels.

We propose two new levels between the existing security levels, to make the Electronic Authentication Guideline better suited for evaluating web authentication solutions, especially with mobile phones. We make the original levels more fine-grained by dividing levels 2 and 3 into two levels each, adding level 2.5 and 3.5. The goal is to be better able to compare authentication solutions to each other. With the current levels, two solutions with very different security may end up on the same level, which makes comparisons more difficult. When designing new solutions with a specific level in mind, a less secure design may be chosen since it is located at the same level as one that is more secure.

Since the Electronic Authentication Guideline is mainly intended for solutions where individuals are authenticated, identity proofing is required for all levels above 1. Identity proofing means that at registration the user must prove their physical identity, e.g. by providing their passport number and credit card number. Most web applications authenticate digital identities but are not concerned with physical ones. In such applications, security may be relevant even if identity proofing is not. Furthermore, our interest lies in the technological aspects of mobile authentication, whereas identity proofing is an administrative issue. For these reasons, identity proofing is not relevant to web authentication. Requiring identity proofing would make most web authentication solutions end up on level 1, independent of the overall security of the solutions.

Level 2.5: The same requirements as for level 3, but with only one of phone locking or MitM protection. Level 3.5: The same requirements as for level 4, but with a SIM or USIM card (or similar tamper-resistant module) that is not FIPS-140-2 certified.

When using a mobile phone for password storage, passwords may be strong and have high entropy, without any extra inconvenience for the user. Because it is possible to store a password securely on the phone and transfer it to a local computer without a risk of keylogging, such solutions meet the requirements of level 2, except for the identity proofing aspect. Since we consider identity proofing a separate issue, we consider these solutions to be at level 2.

For level 2.5, one of phone locking or MitM protection may be left out. An MitM attack is difficult to protect against, since such protection requires a side channel or the exchange of several rounds of data. Phone locking may be timeconsuming for a user that authenticates often. Verifier impersonation lies in level 2.5 since it is a protocol issue that is unrelated to the properties of the phone.

Very few phones today can reach level 4, because of the hardware requirements. Level 3.5 requires both protection against verifier impersonation and that sensitive data transactions must be authenticated. However, a SIM or USIM card can be used in authentication, either in an EAP-SIM protocol [START_REF] Van Thanh | Strong authentication with mobile phone as security token[END_REF] or for running authentication algorithms, e.g. calculating responses to a challenge. The SIM card may not be used in such a way that secret keys or other secrets are revealed to an attacker.

Evaluation Method for Mobile Phone Authentication

We provide a list of steps, outlined in Figure 1, to follow for evaluation and design of authentication solutions using any type of mobile phone, including Cannot spread malware

S x x x

For private environments S (x) x x x x x x Bluetooth can be eavesdropped from outside a building.

For public environments S (x) (x) x x (x) (x) x Channels in parenthesis can be eavesdropped and replayed by a nearby attacker, if the data is used several times.

For phone unlocking S x x x In specific cases a touch screen or fingerprint reader could be used for biometric unlocking.

For noisy environments

U x x x x x x
For users with poor eyes

U x x x x x x

For users with shaky hands

U x x x x x x

No extra equipment AE (x) (x) x An optical channel from the phone to the computer requires a web camera. Audio channels require speakers and a microphone.

S: security factor, U: usability factor, A: availability factor, E: economic factor. x: the channel has this feature. (x): the channel usually has this feature, but there are exceptions that are noted in the Comments column.

smartphones. The list is used in conjunction with Table 1 to determine the highest security level that a solution can achieve or to suggest solutions for a chosen security level. Table 1 describes features present in the communication channels and makes it easy to compare the variety of communication channels for mobile phones, based on their features. The set of features is initial and will be extended. The features in the current set are the most important ones and can affect the security level of a solution. Evaluation: If there is a shared secret per session, this may be used to protect against hijacking. Such protection is required for level 4. Design: See evaluation.

Other factors:

Evaluation: Use Table 1 to learn about features not discussed in the Electronic Authentication Guideline. These features do not affect the security level, but may affect other aspects of the solution. For solutions in which third parties are involved, shared secrets must not be revealed to the third party, in order for the solution to reach level 2 or higher. Design: Choose channels based on the user's equipment, if known. Manual input is default for both computers and phones. If challenge-response is used as authentication protocol, data transfer in both directions between the computer and the phone is needed. If there is a risk of malware, users with poor eyes etc, check Table 1 for solutions that may be used in the specific cases. For level 2 and higher secrets must not be revealed to third parties.

Conclusions:

Evaluation: Applying these steps will allow identification of the solution's maximum security level. This will also provide information about the properties that prevent the solution from reaching a higher level. Design: Given the preferred security level, this process will provide recommendations about possible channels, authentication methods and other features. An example of this would be one-time passwords or challenge-response with manual input and Wi-Fi as a side channel.

Case Studies

We now present four case studies that apply our method from section four and show design and evaluation.

Design Case Study: Password Storage

Consider a simple application in which the user stores their password on a mobile phone, in order to have strong passwords without having to remember them and type them on the keyboard. The goal of this password storage is to make the use of passwords as secure as possible, i.e. level 2. It should be possible to use it both in private and public environments.

Authentication methods:

The default method is passwords that may reach level 2 if the passwords are tunneled or zero-proof passwords. In a public environment, NFC and a cable connection may be used. In a private environment IR, audio transfer and optical transfer may also be used. 6. Conclusions: One possible solution for this application would be to use strong, high entropy passwords (possibly automatically generated) stored on a phone and transferred to a nearby computer using a cable or NFC. Channels such as IR or Bluetooth are not appropriate since they are vulnerable to eavesdropping in a public environment. Finally, the password must be tunneled when sent over a remote network, or the solution would fail to reach even level 1.

Design Case Study: Online Banking

Consider a general online banking solution in which the user can perform several different tasks which require different levels of security. Examples of these tasks are: A) check account balance, B) withdraw money from the account and move it to another account, owned by another person and C) close the account. For A we assume that the security of a password is sufficient, given that there is additional protection against keyloggers and eavesdropping. Therefore, level 2 is chosen for A. For B, we aim for a higher security level than A. C is considered the most security-critical case and requires as high a level of security as is possible.

We will now use our evaluation method to find suitable authentication solutions for A and B. For this scenario we assume Bluetooth access, a phone network, a phone camera and manual input. We assume that the solutions are to be used in public environments.

1. Authentication methods: A: All methods can be used. B: Only methods with non-reusable authentication data can be used. occurs, the attacker must not get access to sensitive data. Eavesdropping resistance will suffice in this case. (f) Session hijacking: A and B: protection against this type of attack is not needed for levels 2-3. C: Session secrets can be used for protection against hijacking. 5. Other factors: A: Only manual input is available for reusable data, but not suitable for passwords (malware risk). B: No other factors apply. C: Data transactions must be authenticated. 6. Conclusions: For checking account balance (A), one-time passwords with manual input may be used. An alternative is to transfer data via Bluetooth instead of manual input. A challenge-response protocol can be used instead of one-time passwords. In that case the response may be sent optically. Otherwise, manual input or Bluetooth may be used. For withdrawing money and moving it to another person's account (B), the requirements for A applies, but with locking using manual or optical input and with additional MitM mitigation. For closing the account (C), the requirements for B applies, but with authenticated data transfer and session secrets. Since secure hardware is not available, sufficient security for C cannot be achieved with a mobile phone alone. The user can initiate the closing of the account with the solution from B, but then must add another method such as physically signing a form from the bank and sending it by mail.

Evaluation Case Study: 2-clickAuth

2-clickAuth [START_REF] Vapen | 2-clickAuth -optical challenge-response authentication[END_REF] is an optical challenge-response solution that uses a cameraequipped mobile phone as a secure hardware token together with a web camera to provide fast, simple, highly available and secure authentication. Data is transferred both to and from the phone using two-dimensional barcodes. To reach level 3, some kind of MitM mitigation (e.g. using SMS as a side channel) must be used.

Evaluation Case Study: Strong Authentication (SA)

The Strong Authentication (SA) solution consists of several variants wherein a phone operator is considered a trusted third party. A secret identifier stored on the user's SIM card and listed in the phone operator's user database is used to calculate session IDs and challenges. The user authenticates by using one of the following alternatives:

A: The user sends an SMS to the SA server acknowledging that a session ID shown in the computer's browser and one sent to the user's phone are the same. B: The user sends an SMS to the SA server, containing a response calculated by the phone to a challenge shown in the computer's browser and typed into the phone by the user (or sent via Bluetooth). A variant is that the user receives the challenge via SMS and sends the response via the computer. C: The EAP-SIM protocol is used for strong authentication via Bluetooth or SMS [START_REF] Van Thanh | Strong authentication with mobile phone as security token[END_REF].

Related Work

The NIST guidelines for authentication [START_REF] Burr | Electronic authentication guideline[END_REF] cover different areas of authentication and discuss technical details and formal security requirements. However, in their guidelines, security is the only factor. In this paper, the aim is to combine the well known and accepted security levels from NIST with factors such as availability, usability and economic factors. This should help developers and evaluators make the best choice among several solutions that meet the same security requirements.

There is no comparison of authentication channels and methods made specifically for mobile phones. However, for the authentication system Strong Authentication with Mobile Phones, which uses a phone's SIM card in authentication, there is a comparison between the different modes of the system in which different channels are used. The comparison shows how the different modes compare to each other when it comes to factors such as cost, infrastructure, security and usability [START_REF] Van Thanh | Strong authentication with mobile phone as security token[END_REF]. Cost and infrastructure, e.g. which equipment and networks are needed, are not factors that are explicitly discussed in this paper.

There is also work in progress on evaluating authentication solutions in the area of IMS (IP Multimedia Subsystem). The IMS evaluation method considers several different factors such as security, simplicity and userfriendliness [START_REF] Eliasson | A criteria-based evaluation framework for authentication schemes in IMS[END_REF].

Future Work

Our evaluation and design method can be extended to include cryptographic methods as well as examples of trusted hardware modules and their usage. We will introduce new factors, such as infrastructure and learnability to make the method more detailed.

We have already taken into account the cost issues regarding the use of phone networks and equipment that the user may need for short range communication via specific channels. We intend to investigate other cost issues, such as factors related to deployment and running of authentication systems. We will integrate these factors into our method to help developers create economically feasible solutions. Our method will also be adapted for different types of applications and user groups as well as for services and parts of services. We will also investigate the possibility of designing authentication solutions in which the user can actively change the authentication level, based on other requirements such as the current situation and application.

Summary and Conclusions

Hardware devices can help increase the security of authentication solutions. The mobile phone is a flexible and capable device with several channels for transferring authentication data. Different channels and authentication methods influence the level of security of authentication solutions, but it may be difficult to get an overview of all combinations of channels and methods. We provide a method for evaluating authentication solutions where mobile phones are used as hardware devices. This is different from the case where a user authenticates to a web site using the phone's browser (i.e. the phone is used as a handheld computer). In that case the phone itself becomes untrusted.

Our method is related to the Electronic Authentication Guideline, but has been adapted to apply to the specific problems of mobile phone authentication, especially considering communication channels. We have also introduced intermediary security levels to improve the granularity at which authentication methods can be compared. To the best of our knowledge, there are currently no other evaluation methods for phone authentication.

The method is to be extended and can be used both for evaluating existing authentication systems and for designing new solutions. The goal is to help developers create secure authentication, taking availability, usability and economic factors into account.

Fig. 1 .

 1 Fig. 1. Description of the evaluation and design method.

2 .

 2 Data protection (a) Locking methods: A: No locking needed. B, C: Manual or optical (biometric) input can be used for locking the phone. (b) Secure hardware: A and B: Secure hardware is not needed. If a SIMcard is used for secure storage, B may reach level 3.5. C: Secure hardware must be used, but is not present in phones. 3. Protocols: A: A strong password protocol such as tunneled or zero-knowledge password protocols may be used. Proof-of-possession protocols may also be used. B, C: A proof-of-possession-protocol must be used. 4. Attack resistance (a) Online guessing: A: Passwords must be strong and have a least 10 bit entropy. B, C: Passwords are not used. (b) Replay attacks: A: Bluetooth and optical data transfer should not be used for sending reusable data. Tunneling must be used for reusable data. All channels can be used for one-time data. B, C: All channels can be used. (c) Eavesdropping: A, B and C: The same as for replay attacks apply. (d) MitM: A: MitM protection is not needed. B, C: The phone network can be used as a side channel. Other mitigation methods can also be used. (e) Verifier impersonation: A: Not needed for level 2. B, C: If an attack

Table 1 .

 1 Features of mobile phone communication channels

	Features	Factors	Bluetooth	IR	NFC	Cable	Audio	Optical	Manual	Comments
	Keylogger	S	x x x x x x (x) Manual input may be vulnerable
	resistant									to keyloggers when using pass-
										words. Non-HID Bluetooth devices
										are not vulnerable to keyloggers.

  There are methods with reusable data (e.g. passwords) and with one-time data (e.g. one-time passwords). Evaluation: Identify the authentication method used in the solution. If a method with reusable data is used, level 2 is the highest level possible. For level 1, passwords must have reasonable security (see online guessing below). To reach level 2, passwords with at least 10 bit entropy are required[START_REF] Burr | Electronic authentication guideline[END_REF]. Biometrics may not be used, according to the Electronic Authentication Guideline. Design: Choose the authentication methods that are feasible. For level 3 and higher, only methods with one-time data may be used. For level 2, passwords with 10 bit entropy are needed. Using a phone for password storage makes it possible to use a strong password that is difficult to remember.2. Data protection (a)Locking methods: To protect the phone when it is not in use, it may be locked using biometrics (e.g. voice or face recognition) or a manual method (e.g. password or PIN). Challenge-response passwords can at most reach level 1. Tunneled or zero-knowledge password protocols, which are protocols that cannot be easily eavesdropped, reach level 2 at most. Proof-of-possession protocols can reach level 4. Design: See evaluation. On a mobile phone, proof-of-possession protocols require keys to be securely loaded into and stored in the phone.[START_REF] Burr | Electronic authentication guideline[END_REF]. Attack resistance (a) Online guessing: Passwords must be strong enough not to be guessed.Evaluation: For level 1 and 2, passwords must resist online guessing. This is achieved by using strong passwords and not sending them in the clear. The maximum chance of success of a password guessing attack must be 1/1024 for level 1 and 1/16384 for level 2, over the complete lifetime of the password[START_REF] Burr | Electronic authentication guideline[END_REF]. Passwords are not used in levels 3 and 4. Design: See evaluation. (b) Replay attacks: In a replay attack, authentication data is reused by the attacker. Evaluation: Resistance against replay attacks is required for levels 1-4. If passwords are sent in the clear, the solution does not reach level 1. Design: To reach level 1, passwords must be tunneled or salted while sent over a network or phone channel. (c) Eavesdropping: Table 1 shows which channels can be used in a private environment, i.e. a room without untrusted people present, and which channels can be used in a public environment, e.g. an open area with untrusted people present, without being eavesdropped by an attacker. Evaluation: For non-reusable authentication data, the solution can reach level 4. For reusable data (e.g. passwords), use Table 1 to see if the channels are vulnerable to eavesdropping. If not, the solution can reach level 2.Otherwise the solution can reach level 1 at most. Level 2 also requires reusable data to be tunneled (e.g. using SSL) or otherwise protected, when sent from the local computer to a remote server. In this type of attack, an attacker claims to be the verifier in order to learn passwords and secret keys. An attacker modifies or reroutes parts of a session.

	Evaluation: Resistance against verifier impersonation is required for level
	3 and higher. The data sent should not give any clues on the secret key
	used in authentication.
	Design: See evaluation.
	(f) Session hijacking:

1. Authentication methods: Evaluation: If the phone can be locked, the solution can reach level 3 or higher. Otherwise the solution can at most reach level 2. Design: For level 3 and higher, choose a locking method. This requires manual, optical or audio input on the phone, depending on the locking method. (b) Secure hardware: Tamper-resistant hardware in the phone can be used for data protection. Level 3 requires multi-factor authentication with a secure hardware device

[START_REF]Security requirements for cryptographic modules[END_REF]

, a software token (e.g. software used for calculating non-reusable authentication data), or a one-time password device. Phones can be considered hardware devices, without the FIPS certification needed for level 4, but can also be seen as devices containing software tokens.

Evaluation: If the phone uses secure hardware certified by the FIPS-140-2 standard (FIPS-140-2 level 2 overall security and FIPS-140-2 level 3 physical security)

[START_REF] Burr | Electronic authentication guideline[END_REF]

, the solution can reach level 4. If a SIM card is used as secure hardware, level 3.5 is possible. Otherwise level 3 is the highest level.

Design: See evaluation. 3. Protocols: Depending on which protocol is used in authentication, the security of the solution may vary. The following authentication protocols may be used: proof-of-possession-protocols with either private or symmetric keys, tunneled or zero-knowledge password protocols and challenge-response password protocols. Evaluation: Design: For reusable data, choose channels not vulnerable to eavesdropping and tunnel the communication to the remote server to reach level 2. For non-reusable data, any channel may be used and tunneling is not necessary. (d) Man-in-the-Middle-attacks (MitM): If there are long range channels available, such as a phone network or Wi-Fi, they can be used as a secure side channel to protect against MitM attacks. Without long range channels, mutual authentication can be used to prevent MitM attacks.

Evaluation: With MitM mitigation the solution can reach level 3 and higher. For level 2.5, either MitM mitigation or phone locking must be present.

Design: See evaluation. (e) Verifier impersonation:

  For transferring passwords from the phone to a local computer, manual input should be avoided in order to protect against keyloggers.

	(b) Replay attacks: Tunneling can be used for mitigating replay attacks
	over a remote network. For transmission between the phone and a local
	computer, choose channels from Table 1 that are not open to attacks in
	public environments.
	(c) Eavesdropping: See replay attacks.
	(d) MitM: Not needed for level 2.
	(e) Verifier impersonation: Not needed for level 2.
	(f) Session hijacking: Not needed for level 2.
	5. Other factors:
	2. Data protection
	(a) Locking methods: Phone locking is not needed for level 2.
	(b) Secure hardware: For level 2, no secure hardware is needed.
	3. Protocols: All protocols except challenge-response passwords may be used.
	4. Attack resistance
	(a) Online guessing: Passwords must be strong enough to resist password
	guessing and dictionary attacks. They must also have at least 10 bit
	entropy.

  No session secrets are used. Max level: 3 5. Other factors: It should be possible to use 2-clickAuth in noisy environments such as public places, because it uses optical data transfer. Optical channels are also malware resistant, since data can only be sent as a direct result of user action. No secure hardware can be assumed. Secrets are not revealed to third parties. 6. Conclusions: 2-clickAuth may reach level 2.5 if used with a PIN code.

	3. Protocols: A proof-of-possession protocol with shared keys is used. Max
	level: 4
	4. Attack resistance
	(a) Online guessing: Passwords are not used. Max level: 4
	(b) Replay attacks: Non-reusable data is used. Max level: 4
	(c) Eavesdropping: Since 2-clickAuth is intended for use by mobile users
	in diverse locations there is a risk of eavesdropping, but the data cannot
	be used to gain knowledge about secret keys. Max level: 4
	(d) MitM: MitM protection is not used, due to availability. Max level: 2.5
	(e) Verifier impersonation: There is a risk of verifier impersonation, but
	since the authentication data transferred does not reveal any sensitive
	information, the impersonating attacker does not gain access to secrets.
	Max level: 4
	(f) Session hijacking:
	1. Authentication methods: 2-clickAuth uses challenge-response with non-
	reusable data. Max level: 4
	2. Data protection
	(a) Locking methods: 2-clickAuth can be used with a PIN-code to lock
	the phone. Max level: 4
	(b) Secure hardware: No secure hardware is used. Max level: 3

  Session hijacking: A, B: Does not protect against verifier impersonation. Max level: 2. C: Verifier impersonation protection. Max level: 4 5. Other factors: SA requires the participation of a mobile phone operator. Shared secrets are not revealed to third parties in any of the SA variants. In A there are no shared secrets. Only C has authenticated data transfer. It is stated that SA needs to be usable. Bluetooth can spread malware between the phone and the computer. When there is a choice between SMS and Bluetooth, SMS is a better choice if it is feasible to use the phone network.

	(b) Secure hardware: SIM cards are used in all SA variants. Max level: 4
	3. Protocols: A: Similar to using passwords. Max level: 2. B, C: Proof-of-
	possession. Max level: 4
	4. Attack resistance
	(a) Online guessing: Non-reusable data is used. Max level: 4
	(b) Replay attacks: Authentication data can only be used during the ses-
	sion. Max level: 4
	(c) Eavesdropping: A: The session ID is based on a static identifier and
	may be eavesdropped. Max level: 2. B, C: Not vulnerable to eavesdrop-
	ping. Max level: 4
	(d) MitM: A, B: Does not protect against MitM attacks, even if SMS is used
	for B. This is because the SMS channel is not used as a side channel,
	but as an alternative to short range channels. Max level: 2. C: MitM
	protection. Max level: 4
	(e) Verifier impersonation: A, B: Does not protect against verifier imper-
	sonation. Max level: 2. C: Verifier impersonation protection. Max level:
	4
	(f) 6. Conclusions: The session ID solution (A) is a simple solution that reaches
	level 1. Challenge-response solutions (B) reaches level 2 and EAP-SIM solu-
	tions (C) reaches level 3.5.
	1. Authentication methods: A: Identifier based on a static value. Max level:
	2. B, C: Non-reusable data, comparable to one-time passwords. Max level: 4
	2. Data protection
	(a) Locking methods: Since the SIM card is used, a PIN code can be
	assumed for phone locking. Max level: 4


Andreas Pfitzmann

Hannes Federrath

Marit Hansen

Michael Waidner

Michael Waidner Andreas Pfitzmann

Pioneer of Technical Privacy Protection in the Information Society

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Andreas Pfitzmann 1958-2010

Pioneer of Technical Privacy Protection in the Information Society

Hannes Federrath, Marit Hansen, Michael Waidner1

Abstract. On September 23rd 2010, Prof. Dr. Andreas Pfitzmann died at the age 52 after a short but serious illness. The focus of his reasoning had been the individual and with him the society, in which he lives. During his life as a researcher Andreas Pfitzmann contributed decisively and groundbreakingly to the technical implementation of the constitutional right to informational selfdetermination.

The academic career of Andreas Pfitzmann began in 1982 at the University of Karlsruhe as a research fellow at the chair of Prof. Winfried Görke. From the beginning he was certain that even though his research work had to have a strong technical core, it was at the same time more important to have social significance and value. In 1983, the Federal Constitutional Court of Germany developed in its Census Decision the term "Right to Informational Self-Determination". Andreas Pfitzmann was one of the first to recognize that the implementation of this right could only succeed if law and technology interacted.

In 1983, the Federal Constitutional Court declared: "Under the modern conditions of data processing free development of personality requires the protection of the individual against the unlimited survey, storage, use and disclosure of his personal data. [...] Whoever cannot overlook with sufficient certainty, which of the information regarding him in certain areas of his social environment are known, and whoever cannot measure the knowledge of possible communication partners to any degree, can be fundamentally limited in his personal freedom to plan and make decisions out of his own self-determination. A society in which the citizen cannot know anymore, who knows what, when and at which opportunity about him, is not compatible with the right to informational self-determination." (1. BvR 209/83 paragraph C II.1, p. 43) Working for a university department specialized in computer architecture and fault tolerance, Andreas Pfitzmann began to research network anonymity, pseudonyms, signatures and electronic legal transactions in 1983. Together with his students then and later colleagues, Birgit Pfitzmann and Michael Waidner, he founded a working group and converted his office into the "Café Pfitzmann" as the group, that worked there more or less around-the-clock, consumated enormous quantities of coffee, peppermint tea and chocolate.

Within a year the group developed basic terms for what was later to be called "Privacy by Technology" and "Multilateral Security": Privacy has to be supported, controlled and finally enforced by technology. Privacy cannot only be achieved by law. Systems that are used by multiple parties have to support the security interests of all these parties. Then revolutionary and utopian, these thoughts now are commonly used in Computer Science as "Privacy Enhancing Technologies (PETs)".

In 1984, Andreas Pfitzmann met the American cryptographer David Chaum. Chaum then worked for the CWI in Amsterdam, where he developed the cryptographic background for pseudonymity and anonymity within networks. Andreas Pfitzmann soon recognized the practical potential of the theoretical works of David Chaum and an intensive working relationship developed between the two groups that continued over many years.

Andreas Pfitzmann began to probe the theoretical concepts of David Chaum and others as to their pracitical value. Then as now, privacy and security were seen as in opposition to one another within the political debate. With their publicaton "Legal Security despite Anonymity" the group around Andreas Pfitzmann tried to explain coherently to lawyers and technicians how privacy and security could be made compatible.

Approximately from 1987 on, Andreas Pfitzmann began to analyze the developed concepts and methods for privacy enhancing technologies in prototypical implementations and system concepts. Together with students in Karlsruhe and later in Hildesheim he developed the presumably first data protection practicum in Germany.

In 1988, the group around Andreas Pfitzmann developed and analyzed for the first time the concept of "ISDN-Mixes" -the first practically applicable method for anonymous communication in real time. With his method and many of his other ideas, Andreas Pfitzmann was ahead of the main stream by 5-10 years: What used to be labeled as utopian with regards to ISDN, proved to be visionary and groundbreaking with the success of the internet in the mid-90s.

In 1989 Andreas Pfitzmann earned his Ph.D. for his dissertation: "Services Integrating Communication Networks with Participant-verifiable Privacy" and in 1991, he moved on as an assistant professor to the chair of Prof. Joachim Biskup at the University of Hildesheim. Together with David Chaum he applied for the EU project "CAFÉ", which implemented and demonstrated the practical application of the first secure and anonymous smart card based payment system.

In 1993, Andreas Pfitzmann received a professorship at the Technical University of Dresden. With his promotion to professor he began his scientific work at the TU Dresden. His article on the protection of mobile participants from monitoring and localization published in 1993 in the German journal "Datenschutz und Datensicherheit" (= Data Protection and Data Security) was trendsetting for his work at the TU Dresden within the first four years. In the beginning he dealt with the application and adaption of "ISDN-Mixes" to GSM-based mobile networks. With research funds from the German Research Foundation and the Gottlieb-Daimler-and Karl-Benz Foundation, the newly founded working group around Andreas Pfitzmann developed methods for mobile networks that contrasted the popular acceptance that mobile network operators had to know the constant geographical locations of its users, with new solutions regarding the protection of confidentiality. Suddenly it was possible to be available by mobile phone without the network operator always knowing ones current whereabouts.

Within the context of the Daimler-Benz Kolleg "Security in Communication Technology" the terms "Technical Privacy" and "Multilateral Security" were developed further in the years 1993-1999 by him and other scientists, mainly the head of the Kolleg, Prof. Günter Müller, and the Kolleg coordinator, Kai Rannenberg. With regard to "Multilateral Security" the protection interests of all participants had to be embraced as well as the resulting protection conflicts at the time of establishment of any communication connection.

Andreas Pfitzmann received great recognition from science, industry and politics. The Alcatel SEL Foundation awarded him with the research prize "Technical Communication 1998", which was a milestone in the public perception and general acceptance of his works. Among his great political successes was his work during the crypto-debate of the 90s. When, around 1997, the experience of governmental powerlessness with regard to surveilling internet communication assumed grotesque shapes, the scientist and citizen Andreas Pfitzmann unremittingly fought for the free und unlimited application of cryptography in the internet. One of his essential messages was that with a ban on crypto, criminals could use unobservable technical concealment possibilities, while innocent citizens became transparent persons for the state.

From 2000 on, important works of Andreas Pfitzmann and his group concentrated on the area of anonymous communication in the internet. Together with Hannes Federrath and Marit Hansen, he successfully requested adequate research projects from the German Research Foundation and the Federal Ministry of Economics. With the internet anonymization service AN.ON he produced one of the first self-protection tools for citizens and companies alike, which made the early theoretical works for the internet practically applicable.

Our thanks for references, amendments und corrections go to Katrin Borcea-Pfitzmann, Rüdiger Dierstein, Rüdiger Grimm, Hermann Härtig, Steffen Hölldobler, Hartmut Pohl, Kai Rannenberg and Manfred Reitenspieß. The text was translated from German to English by Donate Reimer. An extended German version of this text has been published in Informatik Spektrum Heft 1,

His teaching and students were most important to him. In 2001, he was the first to receive the Best Course Award of the Department of Computer Science at the TU Dresden for the best course in the graduate study programme. As a long-standing dean of the Department of Computer Science, he lived and cultivated the unity -and freedom -of research and teaching.

With his expert report on the "Modernization of Privacy", commissioned by the Federal Ministry of the Interior in 2001, which he co-edited with Prof. Hansjürgen Garstka, he hoped that his ideas of technical privacy protection would also be reflected in legislation. The upcoming amendment of the Data Protection Act can make this wish finally -almost a decade later -come true. Again, it becomes apparent that Andreas Pfitzmann was ahead of his time. In any case, his latest works on the extension of the classical protection goals (confidentiality, integrity and availability) by special privacy protection goals such as transparency and unlinkability will have an impact on legislation. Federal data protection commissioners have referred to them in their current discussion.

Andreas Pfitzmann was invited as an expert to the political debate as well as requested by different courts, among others on issues like the application of biometry, on data retention and on online investigation. He particularly received considerable attention as an active expert for the Federal Constitutional Court on online investigation in 2007. Hence, he contributed to the phrasing of a new "Computer Constitutional Right" through the Federal Constitutional Court in February 2008 for the "Guaranty of Confidentiality and Integrity in IT-Systems". The topic of "Anonymity" in its diverse facets formed a big part of his research works. During his "Workshops on Design Issues in Anonymity and Unobservability", organized in 2000, from which the yearly "Privacy Enhancing Technologies Symposium" (PETS) developed, he started the attempt to systematically edit the terminology of Anonymity and related terms. Presented by Andreas Pfitzmann and Marit Hansen, the "Terminology-Paper" was improved with the help of contributions from the community over the last 10 years [http://dud.inf.tudresden.de/Anon_Terminology.shtml].

In the early days, Andreas Pfitzmann's view on privacy protection was dominated by the concept of data minimisation: If there are no personal data, there is no risk that they will be misused. As in many cases absolute data avoidance is impossible, he expanded his view on privacy protection by the principle of control through the individual concerned -this fits in well with the right to informational selfdetermination and the concept of multilateral security. His research works -since 2000 -on the issue of identity management also emphasized this. From 2004 until recently, he and his research group published within the scope of the EU-funded projects "PRIME -Privacy and Identity Management for Europe" and "PrimeLife" important contributions in the area of "Privacy Enhancing Identity Management" in the online world. Furthermore, he was significantly involved in the European Network of Excellence "FIDIS -Future of Identity in the Information Society" (2004)(2005)(2006)(2007)(2008)(2009). He was able to sketch his latest suggestions on privacy concepts, which on the one hand should enable life-long privacy and on the other hand should provide a contextual binding of personal data, at the IFIP/PrimeLife Summer School in August 2010-therewith giving new impulses to the PrimeLife Project.

Visionary and Pioneer

Andreas Pfitzmann was a visionary and a pioneer. With his distinctive observation skills, his deep understanding of details, his high intelligence and determination to bring together people with similar -as well as different -interests, he contributed invaluably as a scientist and human being to improving our world.