Abstract Security and Privacy from Untrusted Applications in Modern and Emerging Client Platforms

Today’s computer users have the choice among an ever increasing variety of devices and platforms, including desktops, tablets, smartphones, and web browsers. In addition to these more traditional platforms, continuous sensing platforms have recently become commercially available, including augmented reality systems like Google Glass and in-home platforms like Xbox Kinect. Beyond built-in functionality, these platforms generally allow users to install and/or run applications of their choice. While these untrusted applications can provide great benefits to users, their presence also raises security and privacy risks. For example, users may accidentally install malware that secretly sends costly premium SMS messages, and even legitimate applications commonly leak or misuse users ’ private data. This dissertation identifies and characterizes two significant security and privacy chal-lenges due to untrusted applications on modern client platforms. First, these platforms often allow applications to embed content from other applications, resulting in security and privacy implications for both the parent application and the embedded third-party content. Second, these platforms ask users to make decisions about which permissions an application should receive, including the ability to access the camera or the file system; unfortunately