Phones have become essential tools for modern everyday life. As we rely more and more on apps, how can we ensure that they are only doing what we're asking. Come to Privacy Lab and find out about new efforts to track what your phone is actually doing from Berkeley's ICSI Haystack Project and Northeastern University's Recon.

Dave Choffnes will talk about - ReCon: Identifying and Controlling Privacy Leaks from Mobile Devices

ReCon is a cross-platform system for mobile devices that reveals privacy leaks and gives users control over them without requiring any special privileges or custom OSes. Specifically, our key observation is that PII leaks must occur over the network, so we implement our system in the network using a software middlebox. We then use a machine learning approach to to efficiently and accurately detect users' PII without knowing a priori the content that is PII. Further, we develop techniques to block, obfuscate, or ignore the PII leak, by displaying leaks via a visualization tool and letting the user decide how the system should act on transmitted PII. I discuss the design and implementation of the system and evaluate its methodology with measurements from controlled experiments and flows from a user study with more than 200 volunteer participants worldwide.

Narseo Vallina-Rodriguez will talk about: The ICSI Haystack: A Tool to Illuminate the Mobile Ecosystem

As a society we have come to rely upon our mobile phones for myriad
daily tasks. It is striking how little insight we, as mobile users and
researchers, have into the operation of our apps, into how (or
whether) they protect the information we entrust to them, and with
whom they share it. The research community have energetically used a
variety of approaches to gain empirical understanding of the mobile
device/network ecosystem; however, these techniques have had to make
tradeoffs that affect either the scale or accuracy of measurements.
This talk describes how we leverage ideas from this prior work to
design and develop the ICSI Haystack: a user-space mobile app that
inspects user's traffic locally and in real time for researchers and
average users alike. We will discuss our preliminary results about the
alarming presence of third-party services in mobile apps and our
future development efforts.

Primal Wijesekera will talk about a user study of Andriod applications and how protected data is accessed. The talk will go into detail about the user response and the study of over 27M datapoints of third party app's data access.

Kashmir Hill will talk about security flaws in the Waze app that allow hackers to track your location. She's written extensively about for fusion.net and will give a full rundown of the situation at Privacy Lab.

More information about Narseo can be found here: https://www.haystack.mobi

What to Expect:

As per Privacy Lab's standard format, Narseo and David will talk, followed by a short Q&A session. Afterwards we will breakout into informal small group discussions and networking from 7-8pm If you can't make it to the talks/Q&A, you are still welcome to join us for the small groups and networking or vice versa.

Background Info:

Privacy Lab is a meeting for people who are interested in digital privacy in the Bay Area, and is a follow-up to previous events held at Mozilla and other spaces for the past year. The goal of these events is to bring together privacy professionals and privacy community members at non-profits, for-profits, and NGOs alike to foster communication and collaboration.

For those who can't attend the event will be livestreamed via CSM Passcode here: http://www.csmonitor.com/World/Passcode/2016/0603/Event-Mobile-privacy-and-what-your-apps-are-actually-doing

More information about this event and future events can be found at: https://wiki.mozilla.org/Privacy/Privacy_Lab To hear about future events, please join our mailing list, which will send out approximately one mailing and one reminder a month publicizing that month's event: https://mail.mozilla.org/listinfo/privacy-events. Note that RSVPs will be added to this mailing list as well.

Privacy Lab events are dedicated to providing a harassment-free conference experience for everyone, regardless of gender, gender identity and expression, sexual orientation, disability, physical appearance, body size, race, age or religion. We do not tolerate harassment of event participants in any form. Event participants violating these rules may be sanctioned or expelled from the event at the discretion of the conference organizers. Our anti-harassment policy can be found at:

https://wiki.mozilla.org/Privacy/Privacy_Lab#Code_of_Conduct