论文标题
关于移动应用程序中应用内浏览接口的可用性（IN）安全性
On the Usability (In)Security of In-App Browsing Interfaces in Mobile Apps
论文作者
论文摘要
由于在各种应用程序方案（例如聊天和电子邮件阅读）中经常遇到Web URL，因此许多移动应用程序构建了其应用程序内浏览接口（IABIS），以提供无缝的用户体验。尽管这通过避免在主题应用程序和系统内置浏览器应用程序之间恒定切换来实现用户友好性，但我们发现IABI（如果设计不当或定制的话）可能会导致可用性安全风险。在本文中，我们对Android和iOS应用程序中应用内浏览界面的可用性（IN）可用性进行了首次实证研究。具体来说，我们从包含IABI的五个常见应用程序类别（包括Facebook和Gmail）收集了25个备受瞩目的移动应用程序的数据集，并进行系统分析（虽然不是最终用户研究），该应用程序包括八个精心设计的安全测试，并涵盖了整个开放，显示和显示一个In-App In-App网页。在此过程中，我们获得了三个主要的安全发现：（1）大约30％的测试应用程序未能提供足够的URL信息，以便用户在打开URL时做出明智的决定； （2）几乎所有自定义IABI都在提供足够的指标来忠实地向用户显示应用程序内页面时都有各种问题，而基于Chrome自定义标签和SFSafariviewController的十个IABI通常是安全的； （3）只有几个IABI发出警告，以提醒用户在导航（潜在的网络钓鱼）登录页面期间输入密码的风险。大多数开发人员已经承认了我们的发现，但是与解决技术漏洞相比，他们愿意和准备解决可用性问题的意愿相当低，这是可用性安全研究的难题。然而，为了帮助减轻风险的iabis并指导未来的设计，我们提出了一组安全的IABI设计原则。
Due to the frequent encountering of web URLs in various application scenarios (e.g., chatting and email reading), many mobile apps build their in-app browsing interfaces (IABIs) to provide a seamless user experience. Although this achieves user-friendliness by avoiding the constant switching between the subject app and the system built-in browser apps, we find that IABIs, if not well designed or customized, could result in usability security risks. In this paper, we conduct the first empirical study on the usability (in)security of in-app browsing interfaces in both Android and iOS apps. Specifically, we collect a dataset of 25 high-profile mobile apps from five common application categories that contain IABIs, including Facebook and Gmail, and perform a systematic analysis (not end-user study though) that comprises eight carefully designed security tests and covers the entire course of opening, displaying, and navigating an in-app web page. During this process, we obtain three major security findings: (1) about 30% of the tested apps fail to provide enough URL information for users to make informed decisions on opening an URL; (2) nearly all custom IABIs have various problems in providing sufficient indicators to faithfully display an in-app page to users, whereas ten IABIs that are based on Chrome Custom Tabs and SFSafariViewController are generally secure; and (3) only a few IABIs give warnings to remind users of the risk of inputting passwords during navigating a (potentially phishing) login page. Most developers had acknowledged our findings but their willingness and readiness to fix usability issues are rather low compared to fixing technical vulnerabilities, which is a puzzle in usability security research. Nevertheless, to help mitigate risky IABIs and guide future designs, we propose a set of secure IABI design principles.
