Retrofitting privacy into operating systems