User Behavioural Vulnerability Analysis for IoT Smart-Home Privacy Threats: An Empirical Pilot Investigation

Abstract

Internet of Things (IoT) smart-home devices deliver convenient home automation, but they introduce substantial privacy risks caused by improper user operation and insufficient security awareness. This pilot empirical study aims to evaluate end-user behavioural vulnerability toward common privacy threats in smart-home environments. A total of 42 volunteer participants with different age brackets and smart-device usage experience took part in controlled laboratory simulation experiments. Participants were exposed to three typical risk scenarios: excessive permission granting, deceptive pop-up authorisation requests, and unsecure public Wi-Fi device pairing. Experimental outcomes demonstrated that 61.9% of participants granted unnecessary application permissions when faced with shortcut prompts, and 38.1% approved deceptive pop-up access requests for smart cameras and smart speakers. Even participants with prior basic cybersecurity knowledge exhibited careless behaviour under time-pressure conditions. The results indicate that human behavioural factors constitute the weakest link for smart-home privacy defence, rather than hardware or software defects alone. The findings can support system designers, policymakers and consumer organisations to develop user-centred warning mechanisms, interactive security prompts and public security education for smart-home consumers.