Feng Zhu et al. report on the experimental use of reciprocity for information security attacks in computing environments that are mobile or pervasive. Reciprocity here refers to the psychological phenomenon of reducing resistance to divulging private information within a mutual exchange of information. The authors implemented enhanced shopping software on a personal digital assistant (PDA) device, and the reciprocity attacks were embedded in the software.

The introductory section provides background on personal identity attitudes and the nature of reciprocity. The second section summarizes related work in the literature. The core contribution in the paper comes in the next three sections, which include experimental design, experimental results and interpretation, and other findings with lessons learned. The experimental design encompasses the underlying hypothesis, the nature of the participants, the procedure followed, the software and animated agent used, four reciprocity attacks, a control group, and a follow-up questionnaire. The experimental results and interpretation provide statistical analyses of various behavioral characteristics related to identity exposure. The other findings and lessons learned are essentially a careful postmortem. The paper closes with sections that address limitations of the study, together with what may be concluded and future directions. Appendices with the script used in the experiment and feedback questions are also provided.

The paper is well organized and quite readable. Human factors associated with privacy in the world of mobile and pervasive computing are worthy of continued study. Feng Zhu et al. have contributed to the literature and built a base for future experimentation.