Topics · Papers
Web security and privacy
Tail Attacks on Web ApplicationsHuasong Shan (Louisiana State University, Computer Science and Engineering Division), Qingyang Wang (Louisiana State University, Computer Science and Engineering Division), Calton Pu (Georgia Institute of Technology)
Let’s go in for a closer look: Observing passwords in their natural habitatSarah Pearman (Carnegie Mellon University), Jeremy Thomas (Carnegie Mellon University), Pardis Emami Naeini (Carnegie Mellon University), Hana Habib (Carnegie Mellon University), Lujo Bauer (Carnegie Mellon University), Nicolas Christin (Carnegie Mellon University), Lorrie Faith Cranor (Carnegie Mellon University), Serge Egelman (University of California, Berkeley), Alain Forget (Google)
Hindsight: Understanding the Evolution of UI Vulnerabilities in Mobile BrowsersMeng Luo (Stony Brook University), Oleksii Starov (Stony Brook University), Nima Honarmand (Stony Brook University), Nick Nikiforakis (Stony Brook University)
How Unique is Your .onion? An Analysis of the Fingerprintability of Tor Onion ServicesRebekah Overdorf (Drexel University), Marc Juarez (KU Leuven), Gunes Acar (KU Leuven), Rachel Greenstadt (Drexel University), Claudia Diaz (KU Leuven)
Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate ErrorsMustafa Emre Acer (Google), Emily Stark (Google), Adrienne Porter Felt (Google), Sascha Fahl (Leibniz University Hannover), Radhika Bhargava (Purdue University), Bhanu Dev (International Institute of Information Technology Hyderabad), Matt Braithwaite (Google), Ryan Sleevi (Google), Parisa Tabriz (Google)
Querying for Queries: Indexes of Queries for Efficient and Expressive IT-PIRSyed Mahbub Hafiz (Indiana University), Ryan Henry (Indiana University)
A Comprehensive Symbolic Analysis of TLS 1.3Cas Cremers (University of Oxford), Marko Horvat (The Max Planck Institute For Software Systems), Jonathan Hoyland (Royal Holloway, University of London), Sam Scott (Royal Holloway, University of London), Thyla van der Merwe (Royal Holloway, University of London)
Herding Vulnerable Cats: A Statistical Approach to Disentangle Joint Responsibility for Web Security in Shared HostingSamaneh Tajalizadehkhoob (Delft University of Technology), Tom van Goethem (KU Leuven, imec-DistriNet), Maciej Korczyński (Delft University of Technology), Arman Noroozian (Delft University of Technology), Rainer Böhme (Innsbruck University), Tyler Moore (The University of Tulsa), Wouter Joosen (KU Leuven, imec-DistriNet), Michel van Eeten (Delft University of Technology)
The Wolf of Name Street: Hijacking Domains Through Their NameserversThomas Vissers (KU Leuven, imec-DistriNet), Timothy Barron (Stony Brook University), Tom Van Goethem (KU Leuven, imec-DistriNet), Wouter Joosen (KU Leuven, imec-DistriNet), Nick Nikiforakis (Stony Brook University)
Automated Crowdturfing Attacks and Defenses in Online Review SystemsYuanshun Yao (University of Chicago), Bimal Viswanath (University of Chicago), Jenna Cryan (University of Chicago), Haitao Zheng (University of Chicago), Ben Y. Zhao (University of Chicago)
Deterministic BrowserYinzhi Cao (Lehigh University), Zhanhao Chen (Lehigh University), Song Li (Lehigh University), Shujiang Wu (Lehigh University)
Rewriting History: Changing the Archived Web from the PresentAda Lerner (Wellesley College), Tadayoshi Kohno (University of Washington), Franziska Roesner (University of Washington)
Data breaches, phishing, or malware? Understanding the risks of stolen credentialsKurt Thomas (Google), Frank Li (University of California, Berkeley), Ali Zand (Google), Jake Barrett (Google), Juri Ranieri (Google), Luca Invernizzi (Google), Yarik Markov (Google), Oxana Comanescu (Google), Vijay Eranti (Google), Angelika Moscicki (Google), Dan Margolis (Google), Vern Paxson (University of California, Berkeley), Elie Bursztein (Google)
Deemon: Detecting CSRF with Dynamic Analysis and Property GraphsGiancarlo Pellegrino (CISPA, Saarland University), Martin Johns (SAP SE), Simon Koch (CISPA, Saarland University), Michael Backes (CISPA, Saarland University), Christian Rossow (CISPA, Saarland University)
Most Websites Don’t Need to Vibrate: A Cost-Benefit Approach to Improving Browser SecurityPeter Snyder (University of Illinois at Chicago), Cynthia Taylor (University of Illinois at Chicago), Chris Kanich (University of Illinois at Chicago)
The TypTop System: Personalized Typo-tolerant Password CheckingRahul Chatterjee (Cornell Tech), Joanne Woodage (Royal Holloway, University of London), Yuval Pnueli (Technion - Israel Institute of Technology), Anusha Chowdhury (Cornell University), Thomas Ristenpart (Cornell Tech)
Code-reuse attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script GadgetsSebastian Lekies (Google), Krzysztof Kotowicz (Google), Samuel Groß (SAP SE), Eduardo Vela (Google), Martin Johns (SAP SE)