Towards Safer Augmented Reality: Identifying, Evaluating, and Mitigating Security & Privacy Threats
7Augmented-reality (AR) technologies merge virtual content with users' perceptions of the real-world environment. These technologies revolutionize how humans interact with the surrounding world, and enhance machine understanding of human behavior and physical spaces. As AR devices become increasingly available, protecting users from inherent security and privacy risks becomes even more imperative. In this talk, I will present our approach for identifying and evaluating these risks in today's AR system. First, we adopt a user-centric analysis to explore privacy challenges by examining how users understand and feel about eye-tracking and hand-tracking permissions in AR devices. Next, we evaluate the security of current AR platforms by identifying key three-dimensional user interface (3D UI) security properties and demonstrating the implications of various instantiations of these properties on ARCore (Google), ARKit (Apple), HoloLens (Microsoft), Oculus (Meta), and WebXR (browser). Finally, I will conclude with ongoing work developing mitigation solutions to enhance user safety, with directions for future work.