@InProceedings{winterhalter2026soups,
  author    = {Verena Winterhalter AND Sarah Prange AND Anouk Moreno AND Harel Berger AND Florian Alt},
  booktitle = {{Twenty-First Symposium on Usable Privacy and Security}},
  title     = {{I don't know what I've all granted. Does it really matter? – Understanding Users' Awareness of Different Permission Types on Android}},
  year      = {2026},
  address   = {Hannover, Germany},
  month     = aug,
  note      = {winterhalter2026soups},
  publisher = {USENIX},
  series    = {SOUPS'26},
  abstract  = {In this paper, we present the results of an in-the-wild study (N=77) using an Android study app that captures real permission configurations, in-situ experience sampling of participants’ perceptions of which permissions apps hold, and risk awareness for permission combinations during everyday use. Such understanding matters because Android attacks can exploit individual permissions and, in particular, risky combinations. At the same time, it is unclear how often users grant such permissions (and combinations) and whether they are aware of this threat. We found that users frequently misjudge app permission states, regardless of permission type. This also holds for permissions that form part of risky combinations. 56.76% of responses mismatched the actual permission state, including 60.70% for Runtime permissions, 51.19% for Install-time permissions, and 47.67% for permissions which are part of risky combinations reported in prior security literature. Because awareness of granted permissions is a prerequisite for informed action, these gaps hinder users’ ability to mitigate privacy and security risks. We discuss the implications for permission user interfaces and platform mechanisms to better surface risks arising from permission combinations.},
  timestamp = {2026.08.26},
  url       = {http://www.florian-alt.org/unibw/wp-content/publications/winterhalter2026soups.pdf},
}