A Run a Day Won't Keep the Hacker Away: Inference Attacks in Fitness Tracking Social Networks

Fitness tracking social networks such as Strava allow users to record sports activities and share them publicly. Sharing encourages peer interaction but also constitutes a risk, because an activity's start or finish may inadvertently reveal privacy-sensitive locations such as a home or workplace.

To mitigate this risk, networks introduced endpoint privacy zones (EPZs), which hide track portions around protected locations. We show that EPZ implementations of major services remain vulnerable to inference attacks that significantly reduce the effective anonymity provided …

attacks fitness hacker home may networks privacy record risk run sensitive sensitive locations share sharing social social networks sports start strava tracking workplace