Colleen Swanson
email: c2swanso@cs.uwaterloo.ca

Ruth Urner
email: rurner@cs.uwaterloo.ca

Edward Lank
email: lank@cs.uwaterloo.ca

David C Cheriton

Naïve Security in a Wi-Fi World

Keywords: Wi-Fi, hotspot, security, behavior, privacy, trust

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In March 2002, Network World ran an article entitled "Wi-Fi World," in which they hypothesize a world where wireless internet is ubiquitous. They describe a scenario in which people move from wireless at home to wireless at work, at cafés, and at airports. Helped along by inexpensive hardware, we now enjoy near-universal access to 802.11 wireless networks. While wireless hotspots have made accessing the internet more convenient, they also pose significant privacy and security risks to users.

Wireless network communication is particularly susceptible to eavesdropping (or packet sniffing) because an eavesdropper need not physically connect to a hardwired connection. They can sit in secluded locations within range of a wireless access point, but at some distance from their victim, and monitor all internet traffic being transmitted through the wireless signal. This allows them to easily determine websites users are visiting and any files, messages, or passwords used in the event users log into unsecured sites, use unencrypted email protocols (POP3 or IMAP) or unencrypted computer-to-computer connections (e.g. FTP, telnet, remote desktop). Furthermore, recent attacks on the SSL protocol [START_REF] Marlinspike | Null Prefix Attacks against SSL/TLS Certificates[END_REF] highlight the vulnerability of even encrypted-and therefore supposedly secure-connections. This paper focuses on users' reactions to an awareness of their vulnerabilities when on Wi-Fi networks. To develop an understanding of whether people change with awareness of their vulnerabilities, we conducted a novel two-phase study of Wi-Fi users recruited from public cafés. This study included a demonstration of packet sniffing during the first phase and a follow-up study to determine whether and how users changed behaviors.

While we find that some participants do report an increased awareness of encrypted connections, changes in behavior were generally minor. We found an ingenuousness, a naïveté with respect to existing dangers, both before and after our demonstration of packet sniffing. Participants analyze dangers based on a set of simplistic assumptions: that they have nothing to hide; that no one would care to listen; that others on the network are honest; or that it is unlikely someone would target them. As a result, while they do take some steps to protect themselves, our participants engage in naïve risk mitigation, often basing their security strategies on faulty assumptions and analogies to the real world. Finally, we argue that by understanding users' perceptions of security, designers will be better able to train users to be secure and to communicate to users the risks and vulnerabilities that exist on their systems.

This paper is structured as follows. Section 2 contrasts our current research with related work. Section 3 outlines the details of our study. Sections 4 and 5 present the results, and Section 6 the design implications of our work.

Related Work

Research often paints a rather pessimistic image of users as having little understanding of current technology and the potential security risks involved. Even informed users often do not use available security tools, pay attention to browser indicators, or use secure passwords [START_REF] Adams | Users Are Not the Enemy[END_REF][START_REF] Dhamija | Why Phishing Works[END_REF][START_REF] Friedman | Users' Conceptions of Web Security: A Comparative Study[END_REF][START_REF] Wu | Do Security Toolbars Prevent Phishing Attacks?[END_REF].

In the past decade, there has been broad interest in user understanding and reactions to privacy and security issues that arise in the online world [START_REF] Ackerman | Privacy in E-commerce: Examining User Scenarios and Privacy Preferences[END_REF][START_REF] Dourish | Security in the Wild: User Strategies for Managing Security as an Everyday, Practical Problem[END_REF][START_REF] Flinn | User Perceptions of Privacy and Security on the Web[END_REF][START_REF] Friedman | Users' Conceptions of Web Security: A Comparative Study[END_REF][START_REF] Hart | Attitudes and Practices of Students towards Password Security[END_REF][START_REF] Kindberg | Security and Trust in Mobile Interactions: A Study of Users' Perceptions and Reasoning[END_REF]); we will not attempt to address all related work, but rather highlight the most relevant. Flinn and Lumsden [START_REF] Flinn | User Perceptions of Privacy and Security on the Web[END_REF] conclude that although users try to educate themselves, they generally lack the basic knowledge necessary to assess privacy and security risks. Viseu [START_REF] Viseu | Situating Privacy Online: Complex Perceptions and Everyday Practice[END_REF] briefly touches on the theme of user behavior varying based on location, but only in the context of distinguishing between personal and public computers for online banking. Dourish et al. [START_REF] Dourish | Security in the Wild: User Strategies for Managing Security as an Everyday, Practical Problem[END_REF] highlight the need to make security more understandable, a theme we explore in our paper. We, however, focus on public Wi-Fi behavior with respect to both privacy and security, whereas Dourish is interested in security on a much broader level, focusing on how users view security relative to desired tasks. Finally, Dourish and Anderson [START_REF] Dourish | Collective Information Practice: Exploring Privacy and Security as Social and Cultural Phenomena[END_REF] note that security is more than "economic rationality" and that general models of privacy and security are frequently borrowed from the physical world, a conclusion that echoes our observations of naïve risk management in the Wi-Fi world.

There is a small set of studies that focus on security, privacy and behavior on Wi-Fi connections. Kindberg et al. [START_REF] Kindberg | Measuring Trust in Wi-Fi Hotspots[END_REF] investigate trust in Wi-Fi hotspots, observing that users willingly provided personal information in order to register for the authors' spoofed wireless service. Kowitz and Cranor [START_REF] Kowitz | Peripheral Privacy Notifications for Wireless Networks[END_REF] explore privacy in a lab setting by projecting excerpts from captured Wi-Fi packets onto a display. They report that participants felt uncomfortable while the display was on, but admit that participants may not have properly understood the relationship of the display to the functioning of the wireless network.

Klasnja et al. [START_REF] Klasnja | When I am on Wi-Fi, I am Fearless": Privacy Concerns & Practices in Everyday Wi-Fi Use[END_REF] investigate user understanding of Wi-Fi technology, current practices, and whether users send information they consider sensitive in the clear (accomplished by installing software to monitor participants' computers). They observe that users do not have a firm understanding of Wi-Fi security issues, and are surprised and concerned when presented with a list of released personal information. Users also indicated an intent to change their practices. Klasnja et al.'s primary focus, however, was on what users currently do to protect their privacy and whether users release information they wish to keep private.

Our study complements Klasnja et al.'s work in three ways. First, while Klasnja et al. look at what users currently do to protect their security, we expand significantly on this, exploring motivations for users' current Wi-Fi behaviors. Second, while Klasnja et al. observe a desire to change, they did not follow up to explore whether users actually changed, and why they did or did not change. Finally, our approach differs significantly from that of Klasnja et al. (and from Kowitz and Cranor) in that we did not involve participants' personal information in the demonstration of vulnerability. There is a distinction between a violation of privacy and an awareness of the possibility of privacy violation, especially with respect to user reactions and potential behavior changes. While both approaches have merit, we are most interested in how to encourage users to improve their privacy and security without first violating their security or privacy. In summary, we go beyond these and other previous works by not only exploring users' understanding of privacy and security practices, but also what effect increased knowledge of Wi-Fi actually has on behavior.

Methodology

Participants were recruited by word of mouth at local cafés offering free Wi-Fi and were only told we were interested in gathering information on general Wi-Fi behavior in public places. We interviewed 11 people of varying occupations and computer knowledge, P1-P11, and one security expert, S1, with ages ranging from 22-67; see Table 1. We remark that of the 12 participants, while most used their laptops frequently for work, study, and/or personal use, only S1 had extensive computer knowledge. Local recruitment and sample size may raise some concerns about the generalizability of these results. However, security and privacy researchers have found that geographic location and demographic characteristics have little effect on security/privacy behaviors [START_REF] Friedman | Users' Conceptions of Web Security: A Comparative Study[END_REF]. As well, our sample size is not particularly small for a qualitative study [START_REF] Dourish | Collective Information Practice: Exploring Privacy and Security as Social and Cultural Phenomena[END_REF].

Interviews were audio recorded and transcribed. For each round of interviews (initial and follow-up), once the data collection was complete, selected quotes were highlighted and analyzed using open coding; we refer the reader to [START_REF] Strauss | Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory[END_REF] for a discussion of this technique. Quotes were organized using an affinity diagram by two of the researchers working collaboratively. A third researcher performed a separate coding of transcripts and validated clustering on the affinity diagram. Our interviews were designed as follows. In the first interview, we gathered demographic information about the participants, as well as information on where participants use wireless internet. We conducted a walk-through of their most recent Wi-Fi session at a public place, then inquired whether and how often participants engage in various online activities at public Wi-Fi locations, all without reference to security. We transitioned into a discussion of privacy and security by asking about privacy and/or security concerns if participants had not already mentioned these topics on their own. We asked whether participants use any sort of protective measures while using wireless internet, explored their understanding and behavior with respect to SSL, and asked what information about their Wi-Fi activities might be available to other people.

We then moved to a brief explanation of how information is sent on wireless networks, introduced the concept of packet sniffing, and gave a brief demonstration using Wireshark (www.wireshark.org), a freeware network-monitoring program. Packet sniffing may be illegal by Canadian law, so we used two computers belonging to the researchers and avoided involving participants' or other café customers' computers. Instead, the demonstration consisted of using one computer to sniff the traffic of the other, while a researcher used the target computer to go to GoogleMaps and type in an address. Participants watched as the first computer captured this information, and were then shown how it was possible to recover exactly what had been typed and submitted to Google. Participants were allowed to ask questions as the demonstration progressed. In case participants did not ask about activities such as online banking or online shopping, we briefly explained how SSL encryption disguises information and noted the URL indicator "https." Following the demonstration, we encouraged participants to discuss what they had seen, how they felt about it, and whether anything they had witnessed was likely to affect their Wi-Fi behavior.

Between 3-4 weeks after the initial interview, we contacted participants for a follow-up. Participants were not informed in advance of the second interview, but had agreed to be contacted in case we had further questions. Out of the participants P1-P11, all but P6 met us for a follow-up. 1 In this interview, we asked participants if they had given the demonstration any further thought and whether their public Wi-Fi behavior had changed in any way. We inquired how likely participants felt a packet-sniffing attack was, and what, if anything, would prompt them to change their behavior. To complete the overall picture of user behavior, we also asked participants about privacy and security programs and whether they would use such tools to protect themselves.

Current Wi-Fi Beliefs and Practices

The overwhelming view of our participants, when asked to identify any concerns they might have using Wi-Fi, was that they had none. Most explained that they generally felt safe using public Wi-Fi. P1 explained that while "there is probably some security risk . . . ," he was not concerned, describing himself as a "careless Wi-Fi user." P5 justified her lack of concern by comparing public wireless with her previous work wireless connection: given that "it's secure enough to use Wi-Fi for business purposes," she felt public wireless must also be safe by association. Although P5 was aware that her work laptop had special security features installed, this did not affect her reasoning. Her comment is a first glimpse of participants making choices based on analogy to the real world: while in some circumstances, it might make sense to say that "if A can do activity x safely, so can B", this is often faulty reasoning in reality and certainly does not translate well to the wireless world, as different security settings and software will result in different levels of security.

An analysis of the typical online activities our participants engage in via unsecured wireless, however, reveals a more complicated view of safety and security. Indeed, almost all of our participants (with the exception of P8) acted to protect either their privacy or their security, most commonly in the form of deciding on a set of activities with which they were comfortable, a topic we discuss in Section 4.1. In addition, some of our participants actively sought to protect themselves via awareness of SSL or security certificates; we discuss our participants' behaviors with respect to these security tools in Section 4.2. These results are especially interesting in the context of what types of attacks our participants believed possible before the packet-sniffing demonstration, which ranged from the belief in all-powerful hackers who could access any information on users' computers to the belief that any attackers would have to physically look at the laptop screen to glean information; a common theme was the idea that any attack beyond shoulder-surfing would require "computer savvy" (P12). Regardless of how extensive participants thought an attacker's reach might be, their security behaviors were surprisingly similar.

Controlling Risk through Regulation of Online Activities

In the first component of the interview process, we paid special attention to the types of online activities participants engage in while using public Wi-Fi. We were particularly interested in activities participants claimed to avoid and attempted to determine the underlying cause. The overwhelming (and unsurprising) theme emerging from this was that participants were primarily concerned with the security of their financial information and therefore uncomfortable banking or shopping via public Wi-Fi. While this was the main focus of their security concerns, we also observed that participants viewed privacy and security based on a perception of context (i.e., a café) and what was appropriate in that context. Some of these participants were particularly concerned with protecting the impression others would have of them.

As we discuss in the following sections, participants' security choices are frequently informed by an understanding of typical behavior in the real world, a phenomenon we call naïve risk mitigation. For example, some think about impression management and try to ensure that nothing scandalous about them is released. Others, conditioned to protect financial information, apply this same notion to the online world. Finally, while many researchers have argued that participants "don't care" enough about security or privacy to alter their actions, it seems that (with the exception of P8) participants we interviewed accept and expect the need to adapt their behavior to protect themselves.

Avoiding Financial Transactions Almost all of our participants reported avoiding banking and shopping while on public Wi-Fi. P2 even expressed his lack of concern regarding public Wi-Fi in terms of this avoidance:

[Public Wi-Fi has] never been a concern because . . . I don't do online banking in public places or purchase anything in public. (P2) Two participants who said they did not "really" have concerns about public Wi-Fi immediately mentioned a discomfort in banking while on public Wi-Fi. P6 mentioned that he was unsure whether he would access his online banking over an unsecured wireless connection and that he tried to pay attention to whether the network was "secure" or not, citing fear of identity theft. The other, who said she does occasionally connect to online banking in public if she has forgotten to at home, admitted: I feel like I don't want to do my banking, also, like sometimes at a public location, because I don't know how computers work very well. (P10)

Other reasons given for this discomfort or avoidance varied, but most were equally vague in nature. P11, in examining her security concerns, explained that she does not "do banking or anything" when she is at the café, as it "says it's unsecured." P1 said that he did not bank online in public, but rather preferred to connect at home (via his neighbor's unsecured Wi-Fi) or school, explaining that "somehow I think it's more secure, but it probably isn't." Others who expressed clear security concerns about financial transactions-"I do it at home, the same as online banking" (P7)-focused on physical security, not the security of the Wi-Fi connection. P7 worried her account number would be stolen; P5 explained: I'm not sure if it's [avoiding online shopping] primarily due to . . . security of the internet connection, or just because I don't like flashing my personal information [in public].

Even the security expert avoids banking online over a wireless connection, explaining that he "know[s] enough of the security to know it's reasonable, but [he] just [does not] do it." S1 further clarified this, mentioning the possible technical attacks on SSL sessions and the potential to be tricked when tired. He concluded the discussion, however, by reiterating the common theme of being more comfortable at a location perceived to be private and controlled: "It's one of those things I just don't bother doing, because I just wait until I get home."

As the security expert notes, it is reasonable to argue that participants' determination to avoid financial transactions is somewhat irrational. Online banking and e-commerce sites use SSL connections to transmit information, so the information is encrypted. However, with limited security knowledge, applying the age-old adage "better safe than sorry" is not an unreasonable choice. Users who do not understand how security works and do not have the knowledge to verify security before entering financial information are nevertheless confronted with the need to make a decision how to behave. "Just as you wouldn't take your wallet [out] to count your cash" (P2), online banking is viewed as an activity more appropriate to the supposedly safe environ of the home. Indeed, P2 gives perhaps the most direct explanation of this phenomenon, describing it as a result of external conditioning to protect one's financial information:

It just strikes me as something you do in the privacy of your own home. . . . I guess I'm probably conditioned in some way to believe that yeah, you just don't . . . because it's dangerous or whatever. . . . I don't really believe that, but I can't explain why I wouldn't do [online shopping]. That's probably why.

Impression Management Some participants expressed concern about protecting their privacy while on public Wi-Fi; some of the approaches were rather unique, amounting to impression management. For example, P5 limits the information on her laptop to what she is comfortable sharing with her mother: My laptop is mum-safe. . . . There is nothing which I wouldn't show to my mum and my mum is very conservative. There is nothing that couldn't be given to pretty much anyone.

As P5 further explained, she does not perform activities or store information she deems private: So like when I'm in a coffee shop right now, I don't do anything really, which is going to be a concern of mine if somebody finds out.

A similar limitation on behavior to protect privacy was echoed by other participants. For example P1, P3, and P7 did not want to be caught doing something that others might consider inappropriate. Both P1 and P3, somewhat tongue-in-cheek, mentioned pornography as something they would not download, and P7 explained that she does not have privacy concerns because she "didn't do anything illegal, you know, anything wrong."

Views of Security Protocols: SSL and Security Certificates

Although many of our participants' behaviors fit the general impression that the public suffers from lack of awareness and concern, we did see some interesting responses to SSL and security certificate warnings. Of the four participants who actually knew what SSL was, only two, P2 and P4, claimed to actively look for the "https" indicator. Interestingly, the others, P1 and P8, admitted that they never checked, but rather assumed SSL was being used whenever they "needed it"; this reaction of trust was quite similar to other participants' security beliefs and is theme we discuss further in Section 5.3.

Participants had a mixed reaction to security certificate pop-ups. Many, including S1, ignored these warnings either all or "most of the time." Our more security-aware participants, P2 and P4, claimed to pay attention to the pop-up warnings, unless they were viewing websites they "trust" (P4). One participant, P7, said she would "rather just close [the site]." P3 noted he would be reluctant to visit the site, but that he has little of value on his computer, so it would not matter if the site was malicious. P9 said she generally goes to the site, but judges whether to remain by the website's appearance. Finally, P5 ignores the warnings if she recognizes the site and has never had any problems, but otherwise uses a friend's laptop to access the site if her fiancé says it is not safe.

Participant Responses to a Demonstration of Risk

One question we asked was how people would respond to a realistic depiction of their vulnerabilities. Does it spur them to learn more about security? To change their behavior? As we note earlier, past results in security research have rarely focused on concrete demonstrations of specific vulnerabilities, or whether such demonstrations have any lasting impact.

Initial Responses to Demonstration of Packet Sniffing

Beyond general statements of interest-comments like "Cool," "Awesome," or "Neat"-our participants expressed a range of responses to the packet-sniffing demonstration. P1 was surprised by the demonstration, but noted that privacy was not "really a big deal" for him, and that if "something like that happened, I wouldn't really care that much." One participant stated he was "a little perturbed" (P4), but not overly concerned (although this participant later modified his behavior significantly, as described in Section 5.2). Others noted that the demonstration was "kind of scary" (P11) or "super creepy" (P10). Some expressed surprise that "people can actually see my info, personal things" (P9). Others questioned whether we could spy on anyone in the café, and when we explained how we could (though we did not spy on others), commented that this was "not good" (P3). More specific reactions to the demonstration can be grouped into four categories: participants were surprised at how easy packet sniffing was; participants wanted to know how packet sniffing could be prevented; participants had questions about the security of their own activities; and participants appreciated learning about packet sniffing.

Many participants were not surprised by the demonstration itself, but were surprised by how easy it was: I probably would have thought something like this is possible. . . . I am surprised that there is a program that does that readily for you. (P8) P2, P4, P5, P6, P8, and P9 all expressed similar sentiments, particularly some surprise at how easy it was for non-technical users. P6, for example, thought that it would "take some . . . technical skills, some programming or whatever."

An interesting role reversal took place at this point of the interview, where participants began to interview us. Participants were curious about how to prevent packet-sniffing attacks; they wanted to know "how you prevent that?" (P3), or "what [the café] would have to do to prevent this" (P8). Another common type of query involved the safety of online activities: online banking, e-commerce sites, Facebook, email, and others. Participants questioned us quite carefully on how security for online banking and e-commerce sites works. We provided a basic description of SSL protocols and how this protected participants from such attacks when connecting to these sites. Also, if participants did not ask about online banking or e-commerce, we proactively explained SSL connections to them. Several participants were reassured by this, noting that things were OK "as long as they can't find my banking information" (P10).

Finally, a common response was appreciation. P5 indicated that it "clearly shows that you can pretty much see everything." P4 always "thought it was that easy, but now that you showed me, [I'm more aware]." P2 noted: I'll certainly remain conscious of it, which is a good thing, obviously.

Participants also appreciated the ability to be able to act on information from the demonstration. P11 commented on getting laptops with wireless at work with "a lot of client info" on them and intended to verify that "those security measures" would be put in place. Another participant, P6, was concerned about "inside company information," noting that it was a "good thing" to see the demonstration because he was "doing this consulting project now" and "has a lot of financial documents" he sends "back and forth."

Behavioral Changes: The Plan and the Reality

When queried immediately after the demonstration about whether it would motivate behavior change, participants were split. Some participants expressed a desire to "be more cautious" (P11). Participants who queried us about online banking and security measures noted they would be more aware of the "https" indicator to ensure an SSL connection (P9, P10, P11). P5 explained that she was "probably gonna be a little bit more paranoid in terms of not using any . . . personal information in public locations." Other participants were less concerned. P6 said he would not change his behavior because he does not "really have anything to hide." However, he also notes: Certainly if I were to work on some sensitive stuff, then that's definitely what I would probably think of. I would probably not send stuff from here on this wireless network.

P2 explained that despite a desire to remain conscious of the demonstration, "I don't think it would necessarily change my practices." This mixed message was common: participants indicated they were unlikely to change their practices, but also indicated that they would be more aware and take more care.

An analysis of reported participant behavior on follow-up confirms this notion: on the whole, any changes in behavior that occurred were minor and relegated to attempts to be more aware. Our main focus after the initial interview was determining whether participants had actually changed their behavior in any way. We wanted to see what they retained from the demonstration and if they reported being more aware. We conducted our follow-ups after 3-4 weeks, in our estimation enough time for participants to have re-established regular behaviors, but not so much that they would have difficulty recalling the demonstration.

We began the follow-up interviews by asking participants if they had given the demonstration any thought. Several participants mentioned having thought about the demonstration and all but one of the participants had discussed it. Some just told one or two of their friends, an unsurprising result. Some reported using their new knowledge to correct behaviors of their friends: I told [two of my friends] how it's not safe [to enter personal information in unsecured websites] because you showed me that what I typed in actually shows on your computer. (P9) One participant (P11) taught all of her colleagues at work about the SSL protocol, claiming that they had all become more aware of the "s" in the browser and now tried to pay attention to it. P3, P5, P9, and P10 also reported remembering and thinking about SSL when online. Unfortunately, this did not necessarily translate into participants' behavior being more secure. While some (P3, P10, P11) reported checking for SSL when using sites they considered sensitive (e.g. banking), others only mentioned noticing the "https" when it was present: I haven't really investigated [whether sites I log into use "https"], but now I know [about "https"] so I probably know when it comes up and I feel more safe about it. . . . When it comes up it will automatically make me think it's a safe site, right. But then I didn't really [look] for it. (P9) This last observation is particularly concerning, as from a security perspective, it is more important for users to notice the absence of a secure connection than its presence. P9's response to learning about SSL was to be reassured if she happened to notice its presence, rather than to actively check that SSL was being used. In this case, our user felt more safe online because she thought she was more aware, but in reality she had not improved her security.

Participants' perceptions of security and privacy changed in other ways as well. Increased knowledge of technology caused some participants to feel less safe overall, with some expressing doubts about their security even in the presence of security protocols. P3, at the end of his first interview, captured this feeling quite well: "I mean even the secure stuff, how secure is it?" P4 became so unsure of his online safety that he tried to avoid public Wi-Fi entirely, and if he did use public Wi-Fi did not do "anything that requires a login and a password." P9 explained that she now felt it was not "really safe to access [her] bank or you know, personal information," so she tried to avoid these activities while in public. P5 noted: Say if I was about to buy something and I had to enter all my credit card information. Although you said that if it says "s" it's safe, I probably would think about it twice, whether or not I want to use Wi-Fi.

Finally, nothing had changed for P1, P2, P7, and P8. P2, one of our more security-conscious participants, stressed that he had no reason to change as he had already been careful about his online activities. The others were also happy with their pre-demonstration behavior. As P8 explained:

Nothing that I saw in there made me feel unsecure or threatened.

Given the limited effect of the demonstration, we asked participants what would motivate them to change their behaviors online. Most noted that the only thing that might prompt them to change their behavior would be if someone captured information from them:

If I ever had a problem I'd change things, but . . . I have no reason to think that I'd do anything different right now. (P3) Many participants echoed the sentiment that they would take action if something happened, but these behaviors were usually discrete, solving that specific problem rather than protecting themselves more generally. For example, P1 mentioned that if someone hacked into his email account, he would "have to change the password or something like that." P7 said that if she knew someone was spying on her, she would be "upset" and would stop using the Wi-Fi connection.

A Deeper Look: Underlying Motivations for (Lack of ) Change

While we saw some change in behavior, we were surprised that, even with an awareness of how open information is on Wi-Fi, we did not see more awareness of privacy and security vulnerabilities. On the whole, participants were comfortable with their original Wi-Fi behavior. An analysis of the data reveals the following set of underlying assumptions that helps explain this: participants believed they had nothing to hide; participants felt people would lose interest pretty quickly; participants trusted others to not spy on them or to protect them; participants believed that packet sniffing did not happen often.

Nothing to Hide, Nothing to Fear Security researchers frequently quote the adage "The honest man has nothing to hide" as motivation for inertia when it comes to self-protection online. P1, P2, P5, P6, P7, P8, and P10 all mentioned variants of this. Participants felt that it was perfectly acceptable for someone to find out what they do online. P8 and P9 shared the sentiment that "if somebody is out there logging what websites I visit and sells it, that's all fine" (P8). P7 characterized her online activities as "not private," saying that she does "nothing super important." P5 echoed this sentiment when she explained that her "personal emails" were not "security sensitive." I'm Not That Interesting P1 stated: "I'm not that interesting to begin with." Participants operated under a perception that the things they might reveal would be of limited value to other parties. P1, P2, P5, P6, P7, and P8 all noted the limited payoff someone would get from eavesdropping:

The general notion of people that are invading your privacy isn't that much of a concern to me . . . I think they would lose interest pretty quickly in my case, anyway. There's not much to [know]. (P2) I Can Trust Others There are two dimensions to trust that we found in responses. P1, P7, P9, and P10 all expressed trust that others would not spythat others would be honest. P7 asked "What's the point of spying on what other people do?", while P1 explained that an eavesdropper would have to have "some psychological problems."

Both P7 and P9 attributed an honesty of intent to others, that people would do "their own stuff" (P9): I mean if people come in, they would do their own things, right? Normally people don't spying on purpose. (P7) This trust extended to companies and institutions. For example, P10 trusted her internet service provider to monitor her home wireless network for intruders. P2 trusted the café to combat eavesdropping. Finally, P1, P4, and P6 assumed universities would protect the security of their communication on campus, an assumption faulty in reality. P1 and P3 both felt online banking must be all right because their banks were "legitimate" institutions.

It Would Never Happen to Me Some participants assumed the likelihood of network snooping was low, either because of a lack of interesting data or their understanding of the expense of the attack. P8 thought the odds are "slim to none": I just don't see what motive somebody would have to do that. To . . . take your time, go out of your way, put all this software on and go to a public [place] . . . and then sniff around.

Only P4 and P5 seemed to think eavesdropping more likely. P4 explained that "Enough of [his] friends have had some sorts of security issues that . . . [he is] not willing to open [himself] up to that," and P5 took it as a "fact of life": I'm pretty sure people do it because it's available, it's there. I mean, for crying out loud, people peak on people in the change rooms, why won't they peak on somebody's laptop, which seems to be a little bit more useful to me.

Discussion

Practicing Naïve Security

In our observations, we bring to light two trends. First, we note that many participants' actions are (mis)informed by drawing mistaken analogy to realworld practices. Second, lacking knowledge, our participants believe that they have little of value, trust that others would not victimize them, and believe that something bad is unlikely. Together, these data lead to a view of our participants as both naïve (making decisions based on feelings, impressions, ideas, and not facts) and ingenuous (guided by a false sense of security). We draw a likeness between our participants' views of security and the concept of naïve, or 'folk' physics. Computers and computer security are incomprehensible to our participants. Therefore, our participants exhibit a naïve Wi-Fi behavior-they avoid things that may be dangerous, but they do so without knowing what is truly risky behavior. Participants practice naïve Wi-Fi Security based on their perceptions of risk and vulnerability.

Participants' activities are rife with instances of naïve security. When discussing security certificates, P9 went to websites and trusted the site based on if it "looked safe." P6 stated he would use any unsecured access point he could find to "check email," but not to browse the web. Finally, P8 does not believe people have "time to log hundreds of people." Unfortunately, malicious websites are designed to look trustworthy, unsecured access points are trying to get users to release passwords and other personal information, and logging and then parsing large data sets is trivial with simple scripting. Participants felt snooping did not happen because others would be honest, that their online financial transactions would be all right because they trusted the companies in question. P8, who never looked for SSL, was perfectly comfortable in the assumption that it was there if he "needed it."

Naïve security is also evident when we examine the more complicated behaviors of our participants. For example, recall P5's method of off-loading risk when confronted with security certificate warnings: If she recognizes a site and has never had any problems, she ignores the warnings. Otherwise she asks her more technically-minded fiancé if it is safe to go on, transferring responsibility. If he tells her it is not, she then "call[s] up [her] friend and use[s] his laptop" (P5), thereby transferring risk.

To overcome the misunderstandings in the naïve security paradigm, one valuable avenue for our participants seemed to be interaction with experts. They valued the packet-sniffing demonstration and in some cases acted on it appropriately. Just as concepts from naïve physics are addressed through education and enhanced understanding, additional discussions with experts could help our participants address security issues like email client setup, Gmail and Facebook use, malicious access points, and other potential Wi-Fi threats. However, it is challenging to engage participants to this extent. Beyond the limited resources of computer experts-we cannot spend individual time with everyone who uses public Wi-Fi-participants have an "it won't happen to me" attitude. Like those who believe theorems from folk physics, participants lack interest in developing a full and sophisticated understanding of the Wi-Fi world and how to protect themselves there: I did mention [the demonstration] to my fiancé, and I had to stop him at some point, because he . . . tried to explain in detail, but . . . . I'm really not interested in technical details. (P5)

Creating Wi-Fi Security and Privacy Tools

Participants' reluctance to break from the naïve security paradigm might, at first, seem frustrating. However, through a better understanding of the paradigm of naïve security, one can imagine designing tools that educate users about risks based on analogies that they understand. Moreover, our results suggest that users appreciate learning about security via concrete, non-technical demonstrations, indicating the potential usefulness of such tools. Consider the following example. In spoken communication, we monitor our privacy by looking around to see who is close enough to overhear our conversation. Tools like Wi-Fi Radar that provide users with a radar display of nearby access points and the signal strengths associated with these access points could also display other wireless network interface cards (NICs) on the network. Combining this idea with Kowitz and Cranor's projected packet excerpts [START_REF] Kowitz | Peripheral Privacy Notifications for Wireless Networks[END_REF] could let Wi-Fi users know what others can hear and that others might be listening.

The challenge with tool design is that users still do not place a sufficiently high premium on privacy and security. When we explored attributes of security tools that participants might adopt during our interviews, participants noted that tools need to be cheap. Participants also did not want tools that slow their computer or require frequent interaction, describing security software as "just plain annoying" (P8):

If [that tool] is not really expensive to buy . . . . Pretty sure I'll get it. If it's a product like a virus detector, a program that I [just] need to put in my computer. (P9) I mean, given that nothing happened to me yet, I think my priorities would still be as long as it's convenient, it doesn't slow my computer down, stuff like that, right? (P1) While challenges in tool design may seem insurmountable, some tools have met with broad consumer acceptance. Most users hate the User Account Control dialog in Vista ("A program needs your permission to continue . . . ") because it prompts them at what seems to be foolish times, but the "set and forget" attributes of Windows Firewall and most virus scanners have met with broad acceptance. Research has consistently demonstrated that if users can understand explanations, they are much more accepting of software [START_REF] Bunt | Supporting Interface Customization Using a Mixed-initiative Approach[END_REF]. Coupling explanations that incorporate concepts of naïve security with technologies such as peripheral or ambient displays [START_REF] Sankarpandian | Talc: Using Desktop Graffiti to Fight Software Vulnerability[END_REF], better awareness of user interruptibility [START_REF] Avrahami | Biases in Human Estimation of Interruptibility: Effects and Implications for Practice[END_REF], or more intelligent "detail on demand" could enhance acceptance of security tools.

Conclusion

In this paper we explore the rationale behind current Wi-Fi security practices and the factors that limit changes in user behavior. Together, our observations of naïve risk mitigation and user ingenuousness depict a domain of naïve security, where users apply superficial concepts of real-world privacy and security and real-world likelihood of risk to the Wi-Fi world. We argue that by understanding how and why users rationalize actions, we can approach security-tool design from a more user-centric perspective, educating users based on their current understanding and presenting information in new, more effective ways.

Table 1 .

 1 Participant Demographics

	ID Occupation	Age, M/F
	P1 Mathematics Ph.D. student	29/M
	P2 English student/retail employee	22/M
	P3 Retired sales manager	67/M
	P4 Government employee	24/M
	P5 MBA student	26/F
	P6 MBA student	29/M
	P7 Chemical engineering/MA student 23/F
	P8 Investment analyst	23/M
	P9 Physiotherapy/recreation student 24/F
	P10 Sociology MA student	26/F
	P11 Behavior therapist	30/F
	S1 Security expert	35+/M

We remark that given S1's area of expertise, we only conducted the first part of the initial interview, as we felt the packet-sniffing demonstration and second interview would be inappropriate.

Acknowledgments We thank the participants in our study. Funding for this research was provided by the Natural Science and Engineering Research Council of Canada, NSERC.


Jie Zhang
email: zhangj@ntu.edu.sg

Robin Cohen

Kate Larson

Leveraging a Social Network of Trust for Promoting Honesty in E-Marketplaces

In this paper, we examine a trust-based framework for promoting honesty in e-marketplaces that relies on buyers forming social networks to share reputation ratings of sellers and sellers rewarding the buyers that are most respected within their social networks. We explore how sellers reason about expected future profit when offering particular rewards for buyers. We theoretically prove that in a marketplace operating with our mechanism: i) buyers will be better off honestly reporting seller ratings and ii) sellers are better off being honest, to earn better profit. Experiments confirm the robustness of the approach, in dynamically changing environments. With rational agents preferring to be honest, the buyer and seller strategies as specified constitute an effective approach for the design of e-marketplaces.

Introduction

Artificial intelligence researchers have proposed the use of intelligent agents to act on behalf of buyers and of sellers, in electronic marketplaces. These agents are capable of learning over time the behavior of their business partners, to enable each party to make effective decisions about which parties they wish to do business with, in the future. One approach that has received much attention is to have buying agents model the trustworthiness of selling agents, making use of ratings of sellers provided by other buyers in the marketplace; this is of particular benefit when buyers do not have much personal experience with the sellers. However, the important problem where buyers may provide unfair ratings to bad-mouth some sellers or promote some other sellers has to be addressed [START_REF] Jurca | An incentive compatible reputation mechanism[END_REF].

In our previous work [START_REF] Zhang | Design of a mechanism for promoting honesty in emarketplaces[END_REF], trust modeling was promoted as an important avenue for creating incentives for buyer and seller honesty in the marketplace. In this approach, buying agents make use of a neighborhood of other buying agents (known as advisors) to provide seller ratings and sellers are inclined to act honestly, because they are being modeled. But sellers also offer better rewards to buyers that belong to many neighborhoods in the marketplace, a feature motivated by the work of Gintis et al. [START_REF] Gintis | Costly signaling and cooperation[END_REF] which argues that altruism in one context signals "quality" that is rewarded by increased opportunities in other contexts. Experimental evidence was presented to demonstrate that a framework like this promotes honesty in reporting seller ratings, from buyers, and honesty in delivering goods as promised, by sellers.

In this paper, we begin with the model of [START_REF] Zhang | Design of a mechanism for promoting honesty in emarketplaces[END_REF], where buyers use a social network to model sellers and sellers model buyers to offer varying rewards. We then explore how sellers can reason about expected future profit, starting from refined formulae for reasoning about immediate profit. As a result, we are able to provide a specification for seller bidding behavior and for offering rewards to buyers based on their reputation. We also emphasize the importance for buyers to adopt a strategy to limit the number of sellers that are considered for each good to be purchased. Most importantly, we theoretically prove that both rational buyers and rational sellers are incentivized to behave honestly in our mechanism, in so doing providing definitive validation of the effectiveness of our proposal.

We then present a series of experimental results to provide additional detail on marketplace trends that demonstrate the value of our newly designed incentive mechanism, conducted in a simulated environment where buyers and sellers may be deceptive and they may be arriving and departing. This provides a stronger endorsement of the mechanism as one that is robust to important conditions in the marketplace. In addition, we validate the benefit of our specific proposal for the seller bidding strategy and for the buyer strategy of limiting the sellers being considered, clearly showing the gains in profit enjoyed by both sellers and buyers when our mechanism is introduced and our proposed strategies are followed.

System Overview

The electronic marketplace environment we are modeling is populated with selfinterested buying and selling agents. Our incentive mechanism is generally applicable to any marketplace where sellers may alter quality and price of their products to satisfy buyers. For the remainder of this paper, we discuss the scenario where the buyers and sellers are brought together by a procurement (reverse) auction, where the auctioneer is a buyer and bidders are sellers. There is a central server that runs the auction.

In our system, a buyer that wants to purchase a product sends a request to the central server. This request indicates not only the product but also the buyer's evaluation criteria for the product (discussed in more detail in the following section). Sellers interested in selling the product to the buyer will register to participate in the auction.

The buyer will first limit the sellers it will consider for the auction, by modeling their trustworthiness. This is achieved by having the central server retain for each buyer a neighborhood of trusted other buyers, which will be asked to provide ratings of the sellers under consideration. The buyer will then convey to the central server which sellers it is willing to consider, and the pool of possible sellers is thus reduced.

Sellers allowed to participate in the auction will submit their bids and the buyer will select the winner of the auction as the seller whose product (described in its bid) gives the largest profit, based on the buyer's evaluation criteria.

In order to formulate their bids, sellers model the reputation of buyers and make more attractive offers to more reputable buyers. A buyer's reputation is based on the number of other buyers considering this buyer as their neighbor (as well as the trust these other buyers place on this buyer, and the reputation of these other buyers). The reputation of each buyer is maintained by the central server and released to the sellers.

Once a buyer has selected the winning seller, it pays that seller the amount indicated in the bid. The winning seller is supposed to deliver the product to the buyer. However, it may decide to alter the quality of the product or to not deliver the product at all. The buyer will report the result of conducting business with the seller to the central server, registering a rating for the seller. It is precisely these ratings of the seller that can then be shared with those buyers that consider this buyer as their neighbor.

In summary: the central server runs the auction and maintains information that is shared with sellers and buyers; buyers announce their intention to purchase products, consult with neighbors, choose a winning seller and report a final rating for the seller; sellers bid to win the sale to the buyer, consider buyer reputation in formulating their bids and then decide what product to deliver to the buyer (if at all).

Strategic Behavior Analysis

In this section, we propose and analyze the strategies that buyers and sellers in our mechanism should use. We also theoretically prove that these strategies will promote buyer and seller honesty.

Seller Strategy to Promote Buyer Honesty

We first present a seller's optimal strategy when sellers only take into account their instant profit. We then derive an equilibrium bidding strategy for sellers when they also take into account their expected future gain, in a simplified scenario where all sellers have the same productivity. We then remove the simplifying assumption and show that with this bidding structure, sellers are better off providing rewards to more reputable buyers and that buyers are better off participating in the social network and providing honest ratings of sellers.

Seller Strategy We discuss our mechanism in the context of the Request For Quote (RFQ) system [START_REF] Shachat | Procurement auctions for differentiated goods[END_REF]. Building on the incentive mechanism outlined in [START_REF] Zhang | Design of a mechanism for promoting honesty in emarketplaces[END_REF], we consider a scenario where a buyer b wants to buy a product p. The buyer specifies its evaluation criteria for a set of non-price features {f 1 , f 2 , ..., f n }, as well as a set of weights {w 1 , w 2 , ..., w n } that correspond to each non-price feature. Each weight represents how much its corresponding non-price feature is worth.

A higher weight for a non-price feature implies that the buyer cares more about the feature. The buyer also provides information in its evaluation criteria about the conversion from descriptive non-price feature values to numeric values (for example, a 3-year warranty is converted to the numeric value of 10 on a scale of 1 to 10). 1 We define the function τ () to denote such a conversion. Sellers {s 1 , s 2 , ..., s m } (m ≥ 1) allowed to join the auction are able to know the buyer's values of their products, formalized as follows:

V b = n j=1 w j τ (f j ) (1)
Sellers will then need to formulate their bids, reflecting what they promise to deliver (e.g. a delivery time of 1 week). An honest seller is one that honors its promise.

As in the mechanism of [START_REF] Zhang | Design of a mechanism for promoting honesty in emarketplaces[END_REF], a seller s i (1 ≤ i ≤ m) sets the price and values for the non-price features of the product p, depending on how much instant profit it can earn from selling p to the buyer b. The instant profit is the profit earned by the seller from the current transaction if it wins the auction. The seller's instant profit is defined as follows:

U s i = P s i -C s i ( 2
)
where P s i is the price of the product set by the seller s i and C s i is the cost for the seller to produce the product p with certain values for the non-price features in its bid. The seller s i will try to gain profit from the transaction. It is reasonable to assume that

P s i ≥ C s i .
The elements above are introduced in the mechanism of [START_REF] Zhang | Design of a mechanism for promoting honesty in emarketplaces[END_REF]. We now extend the treatment, to express more precisely the profit to be gained by the buyer and the seller, to then discuss the kind of gains that sellers can reason about and the kind of bids they should offer to buyers (and to demonstrate how honesty is thus promoted in the marketplace).

The profit gained by the buyer if it chooses to do business with the seller s i can be formalized as follows:

U b = V b -P si (3)
The buyer's profit is also called the seller's "surplus offer", denoted as O s i . The seller's "realized surplus" is typically calculated as the sum of the buyer's and the seller's profit:

S si = V b -C si (4)
Note that the seller's realized surplus is higher when its cost C s i is lower. We also define the cumulative distribution function for S s i (over all sellers) as F () and the support of F () is [S L , S H ]. We assume S L ≥ 0 to ensure that the value of a seller's product always exceeds its cost.

The seller whose surplus offer is the highest will win the auction. The RFQ auction then becomes a first-price sealed auction where a bidder's bids are not seen by others and the bidder with the highest bid (surplus offer) wins the auction. As argued in [START_REF] Shachat | Procurement auctions for differentiated goods[END_REF], a symmetric Bayes-Nash equilibrium surplus offer function can be derived as follows:

O * si = S s i - Ss i S L [F (x)] m-1 dx [F (S s i )] m-1 ( 5
)
where m is the number of bidders. Recall that O s i is the same as U b . From Equations 3, 4 and 5, the equilibrium bidding function for the seller can then be derived as follows:

P * s i = C s i + S s i S L [F (x)] m-1 dx [F (S s i )] m-1 (6)
The seller in our mechanism also reasons about the expected future gain from winning the current auction. It takes into account the reputation of buyer b. In our mechanism, each buyer in the marketplace has a fixed number of neighbors that the buyer trusts and from which it can ask advice about sellers. This forms a social network of buyers where there is a directed link (edge) from a buyer to its neighbors. The edges are assigned weights ∈ (0, 1] representing how much a buyer trusts its neighbors modeled using the approach that will be described in Section 3.2. A buyer becomes reputable if based on its reports about sellers it is accepted into the neighborhood of many other buyers. Cooperating with reputable buyers will allow the seller to build its own reputation and to be known as a trustworthy seller by many buyers in the marketplace. It will then be able to obtain more opportunities for doing business with buyers and to gain more profit in the future. We next provide formulae for the seller's reasoning about its expected future gain and prove that the expected future gain the seller s i can earn after doing good business increases with the reputation of buyer b.

We define the global reputation of buyer b (denoted as R b ∈ (0, 1]) on the social network to be the network effect of the buyer, which represents how much this buyer influences other buyers' decisions on the entire network. According to [START_REF] Richardson | Mining knowledge-sharing sites for viral marketing[END_REF], reputation should be calculated as the effect that this buyer has on other buyers it influences, multiplied by these other buyers' effect on the network. This is a recursive and fixed-point computation. We use the following formula to compute the reputation of the buyer:

R = L T • R (7)
where R is a vector containing each buyer's reputation. L is an asymmetric matrix of the normalized weights of edges between all two-buyer pairs. The weight between two buyers is 0 if there is no link between them. Therefore, R can be computed as the dominant eigenvector of L. 2If the seller cooperates with the buyer, the new satisfied encounter between the buyer and the seller will then increase the seller's trustworthiness. The seller's probability of being allowed to join the buyer's auctions in the future will be increased by some amount, P b , where P b > 0. Since this increment in probability is fairly small and relatively stable, we can assume that the probability of the seller being involved in auctions of other neighboring buyers increases linearly with how much these other buyers trust the current buyer b. The increase in probability of a seller being involved in every buyer's auctions across the network is

P b R b .
If the seller is involved in a buyer's auction, the average probability of winning the auction is 1 m , given that the number of bidders in the buyer's auction is m. The seller's average profit of being involved in a buyer's auction will then be

S s i m 2 ,
which is the average probability of winning the auction multiplied by the average instant profit gained from winning the auction. 3 We use E si (R b ) to denote the amount of the seller's expected future gain and n > 0 the number of expected purchases from buyers. The expected future profit

E s i (R b ) is then E s i (R b ) = n S si m 2 P b R b (8)
From Equation 8, we have the following inequality:

∂[E si (R b )] ∂R b = ∂[n Ss i m 2 P b R b ] ∂R b = n S si m 2 P b ≥ 0 (9)
The expected future gain the seller s i can earn increases with the reputation of the buyer b.

Let us first consider a simplified scenario where sellers {s 1 , s 2 , ..., s m } have the same productivity. They have the same cost for producing the products that are valued equally by the buyer. In other words, we make the following assumption that the distribution of S si , F () is a uniform distribution. Let us also assume that the seller's lowest realized surplus S L for a transaction is 0. Equation 6 can then be simplified as follows:

P * si = C si + Ss i S L [F (x)] m-1 dx [F (S s i )] m-1 = C si + S s i 0 ( x S H ) m-1 dx ( S s i S H ) m-1 = C si + S s i m ( 10
)
Since the seller's realized surplus is equal to the sum of the buyer and the seller's profit and the seller has expected future gain from winning the current auction, the seller's realized surplus S si can then be changed as follows:

S s i = U b + U s i + λE s i (R b ) = V b -C s i + λE s i (R b ) = S s i + λE s i (R b ) (11)
where λ ∈ [0, 1] is a discounting factor. 4 The lowest S si becomes λE si (R b ) instead of zero and the upper bound of S si becomes S H + λE s i (R b ). Accordingly, the symmetric Bayes-Nash equilibrium surplus offer function formalized in Equation 5 should be changed as follows:5

O * si = S si + λE si - S s i λE s i [F (x)] m-1 dx [F (S si )] m-1 (12)
From Equations 3, 4 and 12, we then can derive the modified equilibrium bidding function for the seller as follows:

P * s i = C s i -λE s i + S s i λEs i [F (x)] m-1 dx [F (S s i )] m-1 (13) = C si -λE si + Ss i +λEs i λEs i ( x S H ) m-1 dx ( Ss i +λEs i S H ) m-1 = C si + S si m - 1 m [ (λE si ) m (S si + λE si ) m-1 + (m -1)λE si ]
Comparing Equation 10with Equation 13, we can see that the seller should offer the buyer reward D s i (R b ) as follows:

D s i (R b ) = 1 m [ (λE si ) m (S si + λE si ) m-1 + (m -1)λE s i ] (14)
The reward can be the decreased price of the product. 6 According to Equation 9, the seller's expected future gain E s i (R b ) is a monotonically increasing function of R b , the reputation of buyer b. We can then prove that the reward D s i (R b ) offered to the buyer is also a monotonically increasing function of R b , shown as follows:

∂D si ∂R b = ∂{ 1 m [ (λEs i ) m (Ss i +λEs i ) m-1 + (m -1)λE si ]} ∂R b (15) = 1 m [ ∂ (λE s i ) m (S s i +λE s i ) m-1 ∂(λE s i ) λ ∂E s i ∂R b + (m -1)λ ∂E s i ∂R b ] = λ m [ m(λE s i ) m-1 (S s i + λE s i ) m-1 - (m -1)(λE s i ) m (S s i + λE s i ) m + m -1] ∂E s i ∂R b ≈ { m(λE s i ) m-1 (S s i + λE s i ) m-1 + (m -1)[1 -( λE s i S s i + λE s i ) m ]} ∂E s i ∂R b > 0
We have now proved the following proposition:

Proposition 1 Sellers are better off providing better rewards to reputable buyers in the case where all sellers have the same productivity.

The above analysis depends on the simplified assumption that sellers have the same productivity. We can generalize this result by removing this assumption. In this case, sellers may have different costs for producing the product with the same value of V b . We first modify the seller's original equilibrium bidding function formalized in Equation 6 based on Equation 4, shown as follows:

P * s i = V b -S si + S s i S L [F (x)] m-1 dx [F (S si )] m-1 (16)
We then prove that the seller's original equilibrium bidding function is a monotonically decreasing function of S si :

∂P * s i ∂S si = ∂{V b -S s i + Ss i S L [F (x)] m-1 dx [F (Ss i )] m-1 } ∂S si (17) = ∂[ Ss i 0 F (x) m-1 dx] ∂S s i [F (S s i )] m-1 - ∂[F (S s i )] m-1 ∂S s i Ss i 0 [F (x)] m-1 dx [F (S s i )] 2m-2 -1 = 1 - (m -1) ∂F (S s i ) ∂S s i [F (S s i )] m-2 Ss i 0 [F (x)] m-1 dx [F (S s i )] 2m-2 -1 = - (m -1) ∂F (S s i ) ∂S s i [F (S s i )] m S s i 0 [F (x)] m-1 dx < 0
Based on Equation 9, we can see that the seller's modified realized surplus S s i formalized in Equation 11will also increase as R b increases:

∂S s i ∂R b = ∂[S si + λE si (R b )] ∂R b = λ ∂[E si (R b )] ∂R b > 0 (18)
Therefore, the following proposition holds:

Proposition 2 The seller's equilibrium bidding function is a monotonically decreasing function of R b , which indicates that the seller will give more reward D s i (R b ) to the buyers that are considered as more reputable in the marketplace.

Buyer Honesty Here we prove the following proposition:

Proposition 3 The seller strategy creates incentives for buyers to truthfully report the results of their business with sellers in order to become more reputable in the marketplace.

From Equation 3, we first formalize the total profit gained by the buyer b from l times of doing business with sellers, shown as follows:

T b = l k=1 U b,k = l k=1 (V b,k -P * s k ) (19)
Based on Proposition 2 that a seller's equilibrium bidding function P * s k is a monotonically decreasing function of R b , we then can prove that the buyer's total profit T b will increase with the increase of its reputation R b , as follows:

∂T b ∂R b = ∂[ l k=1 (V b,k -P * s k )] ∂R b = l k=1 ∂V b,k ∂R b - l k=1 ∂P * s k ∂R b = - l k=1 ∂P * s k ∂R b > 0 (20) since ∂P * s k
∂R b is negative (and considering V b,k as independent of R b ). Therefore, in order to gain more total profit, it is better off for the buyer to maintain high reputation. This can be achieved by participating in the social network and honestly reporting the results of its business with sellers. The value of honest reporting is demonstrated as well in the experiments of Figures 1(a) and 4(a) in Section 4.

Buyer Strategy to Promote Seller Honesty

In this section, we present an effective strategy for buyers to choose their business partners. Buyers using this strategy are able to gain more profit, which is further validated by experimental results presented in Section 3.2. We also discuss how this strategy creates incentives for sellers to deliver what they promised in bids.

Buyer Strategy To avoid doing business with possibly dishonest sellers, the buyer b in our mechanism first models the trustworthiness of sellers. Different existing approaches for modeling sellers' trustworthiness can be used here, for example the approach advocated by Zhang and Cohen [START_REF] Zhang | A personalized approach to address unfair ratings in multiagent reputation systems[END_REF] and the TRAVOS model proposed by Teacy et al. [START_REF] Teacy | Coping with inaccurate reputation sources: Experimental analysis of a probabilistic trust model[END_REF]. Both approaches propose to take into account the buyer's personal experience with the sellers as well as ratings of the sellers provided by other buyers. The buyer in our mechanism will allow only a number of the most trustworthy sellers to join the auction. Sellers about which the buyer b does not have information will also be allowed to join the auction with a small probability.

However, buyers may provide unfair ratings of sellers. Our mechanism allows the central server to maintain a fixed number of neighbors for each buyer: a list of the most trustworthy other buyers to this buyer, used to provide advice about sellers, in order to form a social network of buyers. 7 The trustworthiness of these other buyers then also needs to be modeled for periodically updating the buyer's neighbor list. In the experiments presented in Section 4, the approach of Zhang and Cohen [START_REF] Zhang | A personalized approach to address unfair ratings in multiagent reputation systems[END_REF] is used for this purpose. This approach allows the central server to model how trustworthy a buyer privately feels another buyer (advisor) to be based on their ratings (0 or 1) for commonly rated sellers (where, briefly, an advisor is trustworthy if its ratings of sellers within limited time windows agree with those of the buyer). When the buyer has limited private knowledge of the advisor, the public reputation of the advisor will also be considered, based on all ratings for the sellers ever rated by the advisor held in the central server (where, briefly, an advisor is trustworthy if it consistently agrees with the ratings provided for sellers by others). Finally, the trustworthiness of the advisor will be modeled by combining the private and public values. The ones with the highest trustworthiness will be chosen by the central server to be the buyer's neighborhood; untrustworthy ones will therefore decrease their opportunities for rewards from sellers.

Seller Honesty Our idea of allowing the buyer to limit the number of selected bidders in its auctions is supported by Kim's results demonstrated in [START_REF] Kim | A model of selective tendering: Does bidding competition deter opportunism by contractors?[END_REF]. Kim claims that public tendering could lead to quality reduction by bidders; in contrast, selective tendering depending on bidders' trustworthiness may avoid such difficulties. More specifically, Kim proves that by using a buyer strategy as described above (modeling the trustworthiness of sellers and limiting the number of sellers that are considered), dishonest sellers will not be able to gain more total profit than that gained by honest sellers. Suppose that a dishonest winning seller s decides not to deliver its promise in its bid submitted to the buyer b in the current auction. Also suppose that the seller's equilibrium bidding price is P s and C s is the cost for s to produce the delivered product. By assuming that a dishonest seller will lose the chance to do business with the buyer in the future, the total profit gained by the seller s can then be formalized based on Equation 2:

T s = U s = P s -C s (21)
The study of [START_REF] Kim | A model of selective tendering: Does bidding competition deter opportunism by contractors?[END_REF] does not consider the case where buyers form a social network. The seller therefore does not take into account the future profit gained by doing business with other buyers influenced by the feedback about the seller provided by the buyer b. In our case, the seller bids to sell the product to the buyer by also taking into account the future gain obtained by doing business with other buyers that consider b as their neighbor. The seller's expected gain is then greater than or equal to that in their case. Greater expected future gain leads to a larger realized surplus (see Equation 11). Based on the argument supported by Equation 17 that the seller's equilibrium bidding function is a monotonically decreasing function of its realized surplus, the seller's equilibrium bidding price P s should then be less than or equal to P s . The profit that the seller s is able to earn will be less than or equal to the profit that it can earn in the case where sellers do not take into account the expected future gain obtained from other buyers in the marketplace:

T s = U s = P s -C s ≤ P s -C s = T s (22)
Honest sellers in both cases (taking future gain into account, or not) instead are able to gain the same amount of profit. The sellers in our mechanism decrease their instant profit, which will be complemented by their expected future gain. Based on the above analysis, honest sellers in our mechanism therefore will be able to gain more total profit than that gained by dishonest sellers. Rational sellers desire profit and therefore will be honest. In conclusion, we have now proved the following: Proposition 4 The buyer strategy is able to promote seller honesty.

Experimental Results

This section presents experimental results to confirm the value of our proposed incentive mechanism, showing that: honesty is more profitable, for both buyers and sellers; sellers are more profitable when modeling the reputation of buyers; buyers are more profitable when they participate, by providing ratings to others; limiting the number of bidders by buyers promotes seller honesty; buyers derive better profit when they use the ratings of sellers provided by neighbors.

We simulate a marketplace operating with our mechanism for a period of 30 days. The marketplace involves 90 buyers. These buyers are grouped into three groups. They have different numbers of requests. Every 10 of the buyers in each group has a different number (10, 20 and 30) of requests. In our experiments, we assume that there is only one product in each request and each buyer has a maximum of one request each day. For the purpose of simplicity, we also assume that the products requested by buyers have the same non-price features. After they finish business with sellers, buyers rate sellers. Some buyers will provide unfair ratings. Each group of buyers provides different percentages (0%, 20% and 40%) of unfair ratings. We allow 2 buyers from each group to leave the marketplace at the end of each day. Accordingly, we also allow 6 buyers to join the marketplace at the end of each day. These buyers will also provide different percentage (0%, 20% and 40%) of unfair ratings, to keep the number of buyers in each group the same. Initially, we randomly assign 5 buyers to each buyer as its neighbors. As discussed in Section 3.2, buyers' neighbor lists will be updated.

There are also 9 sellers in total in the marketplace. Each 3 sellers acts dishonestly in different percentages (0%, 25% and 75%) of their business with buyers. We assume that all sellers have the same cost for producing the products because all products have the same non-price features.

The Value of Honesty

Here, we provide some general results to show that our mechanism promotes buyer and seller honesty. We first measure the reputation of buyers that provide different percentages of unfair ratings. In our experiments, a buyer's reputation is computed using Equation 7. The results 8 are shown in Figure 1(a). From this figure, we can see that the buyers providing the smaller percentages of unfair ratings have the larger reputation values. Due to the randomness of the initial setting for our experiments, buyers' reputation values change stochastically at the beginning. After approximately 10 days when our marketplace converges, the changes of buyers' reputation clearly follow a trend. After each day, we measure total profit gained by buyers that provide different percentages of unfair ratings. The profit gained by a buyer from buying a product is formalized in Equation 3. From Figure 1(b), we can see that buyers providing fewer unfair ratings gain more total profit. Our mechanism promotes buyer honesty (Proposition 3). Note that the profit difference of different types of buyers is fairly small. This is because buyers have at most 30 requests in total. We compare the average trust values of different sellers. The average trust value of a seller is calculated as the sum of the trust value each buyer has of the seller divided by the total number of buyers in the marketplace (90 in our experiments). As shown in Figure 1(c), results indicate that sellers being dishonest more often have smaller average trust values. From this figure, we can see that the average trust values of the sellers being dishonest in 75% of their business are nearly 0.5. This is because they do not have much chance to do business with buyers and do not have many ratings. A seller without any ratings will have a default trust value of 0.5. We also record the total profit gained by different sellers using our new incentive mechanism. Results are shown in Figure 2(a). From this figure, we can see that sellers being honest more often gain more profit. Therefore, our mechanism promotes seller honesty (Proposition 4). We can also see that the profit difference between the honest sellers and the sellers lying 25% is much larger than that between the sellers lying 25% and the sellers lying 75%. The reason is that we set the threshold for sellers to be considered trustworthy to be very high. The sellers lying 25% are not considered as trustworthy sellers, therefore have few occasions to be selected as business partners by buyers.

Seller Strategy

This experiment is to examine the average trustworthiness of and the total profit gained by sellers using different strategies. We have two groups of sellers. One group of sellers model reputation of buyers and offer better rewards to reputable buyers. Another group of sellers do not model reputation of buyers and ask for the same price from different buyers. Sellers in each group lie in different percentages (0%, 25% and 75%) of their business with buyers. We measure the average trust values of sellers from each group. Results shown in Figure 2(b) indicate that sellers modeling reputation of buyers have higher average trust values. We also measure the total profit gained by different sellers. Results in Figure 2(c) indicate that sellers are better off to model reputation of buyers and adjust prices of products according to buyers' reputation. By satisfying reputable buyers, these sellers are able to attract more buyers to do business with, in order to gain more profit.

Buyer Strategy

Buyers in the marketplace may also have different strategies. They may allow a lot of sellers to join their auctions. They may not always provide ratings for sellers. They may use different methods to model sellers, or may not model sellers at all. In this section, we carry out experiments to show the value of limiting the number of bidders and compare reputation values and total profit of buyers using different strategies. Results show that limiting the number of bidders promotes seller honesty, our mechanism provides incentives for buyers to provide ratings of sellers, and the modeling methods we propose provide buyers with more profit. Limiting Number of Bidders In this experiment, we have 90 sellers. Every 30 sellers acts dishonestly in different percentages (0%, 25% and 75%) of their business with buyers. In the first experiment, we allow 30 sellers to join each buyer's auctions. Figure 3(a) shows the amount of business (number of transactions) done by different sellers. Sellers being honest more often are still able to gain more opportunities to do business with buyers. We also compare total profit gained by different sellers in this setting. However, from the results shown in Figure 3(b), we can see that sellers being dishonest more often gain more total profit. In this case, because more sellers are allowed to join buyers' auctions, each seller's equilibrium bidding price should be lower in order to win the auctions. Sellers being honest gain very little profit from each business with a buyer; therefore, dishonesty is promoted.

In the second experiment, we limit the number of bidders allowed in each of the buyers' auctions to be 6. As shown in Figure 3(c), sellers being honest more often are able to gain more total profit. Honest sellers in this case are more likely to win the future auctions of buyers. They are offered sufficient future gain because limiting the number of bidders increases each seller's equilibrium bidding price. Therefore, limiting the number of bidders promotes seller honesty. Incentives for Providing Ratings We examine how our mechanism provides incentives for buyers to provide ratings. We compare reputation values and total profit of buyers providing different number of ratings. In this experiment, all buyers are honest. They have the same number of requests. However, they rate different percentages (1/3, 2/3 and 3/3) of their business with sellers. We first measure the reputation of the buyers. Results are shown in Figure 4(a). Buyers that provide more ratings have larger reputation values. We also measure total profit of these buyers. Results shown in Figure 4(b) indicate that buyers that have provided more ratings are able to gain more total profit. Therefore, it is better off for buyers to provide ratings of sellers. These ratings can then be shared with other buyers that consider these buyers as their neighbors, when modeling the trustworthiness of sellers.

Buyer Modeling Sellers In this experiment, one third of the buyers models the trustworthiness of sellers based on their personal experience with the sellers and advice about the sellers provided by their neighbors. Another third of the buyers uses only personal experience to model the trustworthiness of sellers. These buyers allow only a number of the most trustworthy sellers to join their auctions. The rest of the buyers do not model sellers. They allow every seller to submit a bid. We compare the total profit gained by these three types of buyers. We can see from Figure 4(c) that buyers modeling the trustworthiness of sellers and limiting their participation are able to gain more total profit. It is also clear that buyers modeling sellers by taking into account as well the advice provided by other buyers (an important element of our incentive mechanism) are able to gain more profit. In summary, it is better off for buyers to selectively choose sellers to participate in their auctions and to take into account the advice provided by other buyers when buyers lack personal experience with sellers.

Related Work

Side payment mechanisms [START_REF] Jurca | An incentive compatible reputation mechanism[END_REF][START_REF] Miller | Eliciting informative feedback: The peerprediction method[END_REF] have also been developed for promoting honesty in e-marketplaces. These mechanisms offer payment to buyers that fairly rate results of business with sellers. One facet of the side payment mechanisms in these papers is the requirement of a center to control monetary payments, so that budget balance is a concern. In contrast, in our mechanism the central server does not handle payments; rewards are directed from sellers to buyers. Brynov and Sandholm [START_REF] Braynov | Trust revelation in multiagent interaction[END_REF] design a mechanism that provides incentives for sellers to truthfully reveal their trustworthiness at the beginning of their business with buyers. Their mechanism has the limitation that the number of goods the buyers will purchase may not depend on their actual needs but has to be dependent on the trustworthiness of the seller.

The problem that strategic agents may collude with each other has been acknowledged as an important consideration by several researchers in the field (e.g [START_REF] Jurca | An incentive compatible reputation mechanism[END_REF]). Side payment mechanisms based simply on the similarity of buyers' ratings may therefore have difficulty with the situation where buyers collude in giving unfair ratings. Jurca and Faltings [START_REF] Jurca | Collusion-resistant, incentive-compatible feedback payments[END_REF] investigate side payment mechanisms that can cope with collusion. However, they do not consider the case where a seller may collude with a group of buyers in promoting the seller itself or bad-mouthing another seller. In contrast, our mechanism's use of neighborhoods provides an avenue for excluding colluding buyers. Assuming that some honest buyers exist in the marketplace, they will use that honesty to gain rewards and will also serve to exclude the differing, colluding buyers from their neighborhoods. The use of neighborhoods also helps to detect and avoid dishonest, colluding sellers (those that differ from the predominant opinion).

Conclusions and Future Work

In this paper, we presented a detailed incentive mechanism to encourage honesty, intended for use in designing e-marketplaces. We provided theoretical proofs to show that buyers have incentives to be honest in reporting about sellers, when sharing ratings with the buyers in their neighborhoods, under our particular framework. This occurs as a result of sellers offering better rewards to more reputable buyers, as part of their reasoning about how to obtain profit. We are also able to show that seller honesty is promoted, within our proposed framework, in order for sellers to receive higher profit. We further validated our mechanism through a set of experiments carried out using a simulated dynamic e-marketplace. As a result, our research emphasizes the value of using trust modeling and the sharing of reputation ratings in social networks in the design of an effective incentive mechanism.

In future work, we will carry out more extensive experimentation to continue to validate our model by comparing with others' models. In our future experiments, we will examine the situation where agents may vary their behavior widely to exploit the marketplace. In addition, we are particularly interested in empirically demonstrating how our framework is able to handle marketplaces where strategic agents collude with each other, more effectively than competing incentive-based trust models.

Fig. 1 .

 1 Fig. 1. (a) Reputation of Buyers being Honest vs. Dishonest; (b) Profit of Buyers being Honest vs. Dishonest; (c) Average Trust of Sellers being Honest vs. Dishonest

Fig. 2 .

 2 Fig. 2. (a) Total Profit Gained by Sellers being Honest vs. Dishonest; (b) Average Trust of Sellers Modeling vs. not Modeling Reputation of Buyers; (c) Total Profit Gained by Sellers Modeling vs. not Modeling Reputation of Buyers

Fig. 3 .

 3 Fig. 3. (a) Sellers' Amount of Business When Allowing Many Sellers to Bid; (b) Total Profit Gained by Sellers When Allowing Many Sellers to Bid; (c) Total Profit Gained by Sellers When Limiting Seller Bids

Fig. 4 .

 4 Fig. 4. (a) Reputation of Buyers Sharing Different Number of Ratings; (b) Total Profit Gained by Buyers Sharing Different Number of Ratings; (c) Total Profit Gained by Buyers Modeling vs. not Modeling Sellers

In this paper, we focus on non-price features that are still objective -e.g. delivery time. Handling subjective features is left for future work.

R can be recorded by the central server and shared with sellers.

The average instant profit is S s i m , as shown in Equation10.

We suggest the inclusion of a discounting factor to allow sellers to learn over time the likelihood of receiving their expected future gain. The proofs that follow do not depend on its inclusion.

We replace Es i (R b ) by Es i for a more concise formulation.

According to Equation 3, if the bidding price is fixed, the reward can also be the increased values of the product offered to the buyer.

Note for a new buyer, the central server randomly assigns to it some other buyers as its neighbors.