Autofill, public and private connections, checkboxes and terms of agreement: HSC Enterprise Computing Data Science
“Examine software features that affect the privacy and security of data, including autofill, public or private connections, checkbox and terms of agreement”
Autofill speeds up forms but can leak data through hidden fields or shared devices. Public connections expose traffic to interception unless HTTPS or a VPN is used. Pre-ticked checkboxes and long terms of agreement weaken informed consent, so good design uses unticked opt-in boxes and plain-language summaries.
Jump to a section
What this dot point is asking
NESA names four software features that quietly shape how much data users give away and how safely it travels. You need to explain how each affects privacy and security and evaluate design choices.
The answer
Autofill
Browsers, password managers and apps store names, addresses, emails, passwords and card numbers and fill them into forms.
- Benefits: faster forms, fewer typing errors, and password managers encourage long unique passwords.
- Risks: hidden form fields can be silently autofilled and sent to an attacker; anyone with access to the device (shared computer, stolen phone) can use saved data; autofilled details may be entered on a look-alike phishing site.
- Protections: device lock and biometrics, password managers that only fill on the exact domain, not saving card security codes, and clearing autofill on shared computers.
Public or private connections
- Public connections (open Wi-Fi in cafes, airports, libraries) are shared with strangers and may be unencrypted. Risks include interception of traffic, fake "evil twin" hotspots and session hijacking.
- Private connections (a password-protected home or work network using WPA2 or WPA3, a mobile data connection, a VPN tunnel) limit who can join and encrypt traffic.
- The same idea applies to public and private profiles on social platforms: a public profile exposes posts, photos and connections to anyone, including data scrapers.
Checkboxes
Checkboxes record consent and preferences.
- Pre-ticked boxes make sharing the default (opt-out), so users agree without an active choice.
- Bundled consent combines essential terms and optional marketing in one box.
- Dark patterns use confusing wording ("Untick this box if you do not wish not to receive offers") to push users into sharing.
- Good design uses unticked opt-in boxes, one purpose per box and plain language.
Terms of agreement
Terms and conditions and privacy policies set out what data is collected, how it is used and who it is shared with.
- They are long and legalistic, so most people accept without reading, which weakens informed consent.
- Acceptance is usually a condition of using the service ("take it or leave it").
- Terms can change later, and clauses may allow sharing with third parties or storage overseas.
- Better practice: layered summaries, clear notice of changes and the ability to withdraw consent.
A student signs up for a free study app on library Wi-Fi.
- Connection: library Wi-Fi is public. The app should use HTTPS so the password is encrypted in transit.
- Autofill: the browser offers to save the password. Safe on the student's own locked phone; unsafe on a library computer.
- Checkbox: "Send me offers from partners" is pre-ticked. The student should untick it; the app's designer should not pre-tick it.
- Terms: the terms allow the app to share "usage data" with advertisers. A layered summary would make this clear before sign-up.
- Saying autofill is always insecure
- Password managers improve security overall; the risk depends on the device and which fields are filled.
- Treating HTTPS and a VPN as the same
- HTTPS encrypts traffic to one site; a VPN encrypts all traffic from the device to the VPN server.
- Stopping at description
- For "examine" or "evaluate", weigh convenience against risk and make a judgement.
Practice questions
Original practice questions graded from foundation to exam level, each with a full worked solution. Try them before revealing the solution.
foundation2 marksDistinguish between a public and a private network connection in terms of data security.Show worked solution →
A public connection (open cafe or airport Wi-Fi) is shared with unknown users and often unencrypted, so data can be intercepted. A private connection (a home network with WPA3, or a VPN tunnel) restricts access and encrypts traffic, reducing interception risk.
Marking guide: 1 mark for each correctly described connection.
core4 marksAn online store's checkout page has a pre-ticked box saying 'Share my details with our partners for special offers'. Explain the privacy issue and recommend a better design.Show worked solution →
The pre-ticked box makes data sharing the default, so many customers will share personal information without actively choosing to. This undermines informed, voluntary consent and may breach privacy expectations under the Australian Privacy Principles, which require personal information to be used for the purpose it was collected or with consent.
A better design uses an unticked opt-in box with plain-language wording that names who the partners are and what data is shared, keeps it separate from the order terms, and lets customers change the choice later in their account settings.
Marking guide: 2 marks for explaining the issue (default consent, lack of informed choice), 2 marks for a specific improved design.
exam6 marksA bank is redesigning its mobile app. Evaluate how autofill, connection type and terms of agreement should be handled to balance convenience with privacy and security.Show worked solution →
- Autofill
- Allow the device's secure password manager and biometric login so customers are not tempted to reuse weak passwords, but disable autofill for one-time codes' destination fields and card CVV fields, and never store full card numbers in the app. This keeps convenience for low-risk fields and blocks silent leakage of high-risk data.
- Connection type
- Enforce HTTPS with certificate pinning so data stays encrypted even on public Wi-Fi, warn users when they are on an open network, and time out sessions quickly. The bank cannot control where customers connect, so it must secure the connection itself.
- Terms of agreement
- Provide a short layered summary (what is collected, why, who it is shared with) with the full terms available, and separate optional consents (marketing, data sharing with partners) into unticked opt-in choices.
- Evaluation
- These choices keep most of the convenience customers expect while protecting the most sensitive data. The main trade-off is friction: extra warnings and re-authentication may annoy some users, but for a bank the harm from a breach outweighs small delays.
Marking guide: 1 mark each for autofill, connection and terms decisions with reasons (3 marks), 2 marks for weighing convenience against risk, 1 mark for an overall judgement.