Let Only the Right One IN: Leveraging Personal Preferences for Social Privacy

TL;DR

In an era where "friendship" on social media is often a vanity metric, identity theft and privacy loss are rampant. This paper introduces a preference-based challenge-response scheme that forces those sending friend requests to prove they actually know the person they are adding. By testing a requester on the receiver's specific likes and dislikes—particularly regarding personality traits—the system creates a verifiable "knowledge gap" between real friends and malicious strangers.

Background: The Illusion of Digital Friendship

The core vulnerability of modern social networks is the Identity Verification Gap. While platforms like Facebook allow users to restrict data to "friends," the definition of a friend has become diluted. The authors categorize friends into direct friends, acquaintances, and "Internet friends" (strangers). Attackers exploit the social pressure to accept requests, gaining access to sensitive data that can be used for identity theft or harassment.

The Insight: Knowledge as a Gatekeeper

Existing solutions like CAPTCHAs or encryption keys are either too impersonal or too cumbersome. The authors' research intuition is elegant: A true friend knows your preferences better than a stranger or a data-mining bot.

Unlike biographical data (like your hometown or birth date), which is often indexed in public records, deep-seated preferences (e.g., "Do I prefer Jazz over Heavy Metal?" or "Am I an introvert?") are rarely documented publicly.

Methodology: The Verification Paradigm

The proposed system, "Verify about the Receiver," flips the traditional authentication model on its head.

1. Building the Preference Database

The user (Alice) selects likes and dislikes across categories such as:

• Lifestyle: Food, Music, Hobbies.
• Personality: Based on the Big Five factors (Openness, Conscientiousness, Extraversion, Agreeableness, Neuroticism).

2. The Verification Test (The Challenge)

When Bob sends a request, the system generates a challenge. To increase security, the authors use item combining. Instead of asking "Does Alice like Chess?", they might ask Bob to pick Alice's preference between "Chess and Carom." This increases the complexity for an attacker to guess correctly (shifting from a binary choice to a 4-option matrix: neither, only A, only B, or both).

Experimental Results: Proving the "Knowledge Gap"

The authors conducted a two-phase study to validate if this gap actually exists in the real world.

• Phase 1 (Pilot): Identified which items were "too easy" to guess (e.g., most people like "Cricket" or dislike "Heavy Metal"). These were pruned to ensure the test remained rigorous.
• Phase 2 (Testing): 32 volunteers were tested against friends and strangers.

Key Findings:

• The Accuracy Gap: Friends scored 45.86%, while strangers scored only 30.69%.
• Winning Categories: The Personality category showed the highest differentiation (21.43% difference), proving that our inner traits are our strongest social signatures.
• Ineffective Categories: Music and Movies showed the smallest gaps, suggesting tastes in media are often too generic or easily guessed among specific age cohorts.

Deep Insight & Conclusion

This work highlights a critical shift in Cybersecurity: moving from Secret-based authentication (what you know, like a password) to Relationship-based authentication (what your shared history implies).

Takeaway: By automating the "friend-or-foe" test using personality traits, social networks can reduce the cognitive load on users while significantly raising the bar for social engineering attacks.

Limitations: The 15% gap, while statistically significant, suggests that determined "insider" attackers (acquaintances who aren't quite friends) might still bypass the system. Future iterations may need to incorporate "temporal" questions (recent shared experiences) to further widen this gap.