Natural Web Interfaces

2 Published by the IEEE Computer Society 1089-7801/16/$33.00 © 2016 IEEE IEEE INTERNET COMPUTING W illiam Prosser, in his classic paper, describes how privacy involves diverse aspects centered on the idea of being let alone (p. 389).1 We view privacy as crucial to the user experience (UX) in a sociotechnical setting, wherein users engage socially through information technology. In previous work, we addressed privacy by limiting information disclosure to location-based (and not necessarily social) applications by computing context at an abstract level that enhances usability but hides details.2 Here, we approach privacy from the standpoint of engineering social applications, wherein interactions among users are central and thus privacy matters for more than just disclosure. Specifically, we investigate how to develop applications that deal with two foundational aspects of privacy.1 Intrusion into someone’s solitude, which originally meant physical intrusion into a person’s space, we also take to include making a noise or otherwise interrupting someone’s life. Disapprobation of someone’s peers would mean loss of face, which can arise not only with a person’s inner circle but also with strangers looking askance. Avoiding intrusion and disapprobation is overshadowed in computing research by concerns of information leakage — arguably, information leakage involves confidentiality more than privacy per se. A social application caters to multiple users: primary users, who directly interact with it, and secondary users, who might not directly interact with the application but are affected by it. The lowly ringer manager on a cell phone is a social application: its primary user is the phone’s owner and the secondary users are callers and those within earshot. The ringer manager helps the owner set a ringer mode (loud, silent, or vibrate) for incoming phone calls. A rigid design yields poor privacy and experience: The phone might ring loudly when the owner is in an important meeting (causing a nuisance) or stay silent even when the owner’s spouse calls in an emergency (losing value). Traditionally, UX design concentrates on primary users and disregards secondary users.3 This attitude can lead to suboptimal experiences for both primary and secondary users, specifically, because privacy presupposes interaction between users. Intrusion is a prominent aspect of privacy in the ringer scenario: Does the caller intrude upon the callee and does the callee intrude upon people nearby (by taking a call or by letting a phone ring)? The UX for all concerned parties depends upon whether the phone rings: the caller could be stymied by a phone set on silent and the privacy of the other users might be violated otherwise. Also, improper ringer settings expose another privacy risk — that of disapprobation, causing the owner embarrassment. Imagine if your phone went off during a classical concert!