TeamUSEC
Projects
Publications
Classes
Theses
Team
Code of Conduct
Projects
Publications
Classes
Theses
Team
Code of Conduct

Publications

2025

“Threat modeling is very formal, it’s very technical, and also very hard to do correctly”: Investigating Threat Modeling Practices in Open-Source Software Projects
Harjot Kaur, Carson Powers, Ronald E. Thompson III, Sascha Fahl and Daniel Votipka. In 34th USENIX Security Symposium, USENIX 2025, Seattle, WA, USA, August 13-15, 2025
PDF Abstract Cite
How Transparent is Usable Privacy and Security Research? A Meta-Study on Current Research Transparency Practices
Jan H. Klemmer, Juliane Schmüser, Fabian Fischer, Jacques Suray, Jan-Ulrich Holtgrave, Simon Lenau, Byron M. Lowens, Florian Schaub and Sascha Fahl. 34th USENIX Security Symposium
PDF Abstract Cite URL
“That’s my perspective from 30 years of doing this”: An Interview Study on Practices, Experiences, and Challenges of Updating Cryptographic Code
Alexander Krause, Harjot Kaur, Jan H. Klemmer, Oliver Wiese and Sascha Fahl. In 34th USENIX Security Symposium, USENIX 2025, Seattle, WA, USA, August 13-15, 2025
PDF Abstract Cite URL
"I’m pretty expert and I still screw it up": Qualitative Insights into Experiences and Challenges of Designing and Implementing Cryptographic Library APIs
Juliane Schmüser, Philip Klostermeyer, Kay Friedrich and Sascha Fahl. In 46th IEEE Symposium on Security and Privacy, IEEE S&P 2025, May 12-14, 2025
Website Abstract Cite URL
“It’s time. Time for digital security.”: An End User Study on Actionable Security and Privacy Advice
Anna Lena Rotthaler, Harshini Sri Ramulu, Lucy Simko, Sascha Fahl and Yasemin Acar. In 46th IEEE Symposium on Security and Privacy, IEEE S&P 2025, May 12-15, 2025
Abstract Cite
A Qualitative Study of Adoption Barriers and Challenges for Passwordless Authentication in German Public Administrations
Jan-Ulrich Holtgrave, Sabrina Klivan, Karola Marky and Sascha Fahl. CHI Conference on Human Factors in Computing Systems (CHI ’25), April 26–May 01, 2025
PDF Abstract Cite URL
Transparency in Usable Privacy and Security Research: Scholars’ Perspectives, Practices, and Recommendations
Jan H. Klemmer, Juliane Schmüser, Byron M. Lowens, Fabian Fischer, Lea Schmüser, Florian Schaub and Sascha Fahl. In 46th IEEE Symposium on Security and Privacy, IEEE S&P 2025, May 12-15, 2025
PDF Abstract Cite URL
Attributing Open-Source Contributions is Critical but Difficult: A Systematic Analysis of GitHub Practices and Their Impact on Software Supply Chain Security
Jan-Ulrich Holtgrave, Kay Friedrich, Fabian Fischer, Nicolas Huaman, Niklas Busch, Jan H. Klemmer, Marcel Fourné, Oliver Wiese, Dominik Wermke and Sascha Fahl. Network and Distributed System Security (NDSS) Symposium 2025, February 24-28, 2025
PDF Abstract Cite

2024

Passwords To-Go: Investigating Multi-faceted Challenges for Password Managers in the Android Ecosystem
Nicolas Huaman, Marten Oltrogge, Sabrina Amft, Yannick Evers and Sascha Fahl. 40th Annual Computer Security Applications Conference, ACSAC'24, Dec 11-13, 2024
Abstract Cite URL
Skipping the Security Side Quests: A Qualitative Study on Security Practices and Challenges in Game Development
Philip Klostermeyer, Sabrina Amft, Sandra Höltervennhoff, Alexander Krause, Niklas Busch and Sascha Fahl. In 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24), October 14--18, 2024, Salt Lake City, UT, USA
Website Abstract Cite URL
Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns
Jan H. Klemmer, Stefan Albert Horstmann, Nikhil Patnaik, Cordelia Ludden, Cordell Burton Jr, Carson Powers, Fabio Massacci, Akond Rahman, Daniel Votipka, Heather Richter Lipford, Awais Rashid, Alena Naiakshina and Sascha Fahl. In 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24), October 14--18, 2024, Salt Lake City, UT, USA
PDF Abstract Cite URL
"There were Sacrifices to reach that Deadline": Security Challenges in Game Development
Philip Klostermeyer, Sabrina Amft, Alexander Krause and Sascha Fahl. At devcom Developer Conference 2024, Cologne, Germany, August 18-20, 2024
Abstract Cite URL
A Mixed-Methods Study on User Experiences and Challenges of Recovery Codes for an End-to-End Encrypted Service
Sandra Höltervennhoff, Noah Wöhler, Arne Möhle, Marten Oltrogge, Yasemin Acar, Oliver Wiese and Sascha Fahl. In 33rd USENIX Security Symposium, USENIX Security '24, August 14-16, 2024
PDF Abstract Cite URL
On The Challenges of Bringing Cryptography from Papers to Products: Results from an Interview Study with Experts
Konstantin Fischer, Ivana Trummová, Phillip Gajland, Yasemin Acar, Sascha Fahl and Angela Sasse. In 33rd USENIX Security Symposium, USENIX Security '24, August 14-16, 2024
Website PDF Abstract Cite URL
“You Received $100,000 From Johnny”: A Mixed-Methods Study on Push Notification Security and Privacy in Android Apps
Thomas Neteler, Sascha Fahl and Luigi Lo Iacono. IEEE Access, 12, p. 112499-112516, 2024.
PDF Abstract Cite DOI
“You have to read 50 different RFCs that contradict each other”: An Interview Study on the Experiences of Implementing Cryptographic Standards
Nicolas Huaman, Jacques Suray, Jan H. Klemmer, Marcel Fourné, Sabrina Amft, Ivana Trummová, Yasemin Acar and Sascha Fahl. In 33rd USENIX Security Symposium, USENIX Security '24, Philadelphia, PA, USA, August 14-16, 2024
Website PDF Abstract Cite URL
Everyone for Themselves? A Qualitative Study about Individual Security Setups of Open Source Software Contributors
Sabrina Amft, Sandra Höltervennhoff, Rebecca Panskus, Karola Marky and Sascha Fahl. In 45th IEEE Symposium on Security and Privacy, IEEE S&P 2024, May 20-23, 2024, San Francisco, USA
PDF Abstract Cite URL
Analyzing Security and Privacy Advice During the 2022 Russian Invasion of Ukraine on Twitter
Juliane Schmüser, Harshini Sri Ramulu, Noah Wöhler, Christian Stransky, Felix Bensmann, Dimitar Dimitrov, Sebastian Schellhammer, Dominik Wermke, Stefan Dietze, Yasemin Acar and Sascha Fahl. In Proceedings of the CHI Conference on Human Factors in Computing Systems (CHI '24), May 11--16, 2024, Honolulu, HI, USA
PDF Abstract Cite URL
Mental Models, Expectations and Implications of Client-Side Scanning: An Interview Study with Experts
Divyanshu Bhardwaj, Carolyn Guthoff, Adrian Dabrowski, Sascha Fahl and Katharina Krombholz. In Proceedings of the CHI Conference on Human Factors in Computing Systems (CHI '24), May 11--16, 2024, Honolulu, HI, USA
PDF Abstract Cite URL

2023

“Make Them Change it Every Week!”: A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication
Jan H. Klemmer, Marco Gutfleisch, Christian Stransky, Yasemin Acar, M. Angela Sasse and Sascha Fahl. In 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23), November 26–30, 2023, Copenhagen, Denmark
PDF Abstract Cite URL
“We’ve Disabled MFA for You”: An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments
Sabrina Amft, Sandra Höltervennhoff, Nicolas Huaman, Alexander Krause, Lucy Simko, Yasemin Acar and Sascha Fahl. In 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23), November 26–30, 2023, Copenhagen, Denmark
PDF Abstract Cite URL
"I wouldn’t want my unsafe code to run my pacemaker": An Interview Study on the Use, Comprehension, and Perceived Risks of Unsafe Rust
Sandra Höltervennhoff, Philip Klostermeyer, Noah Wöhler, Sascha Fahl and Yasemin Acar. In 32nd USENIX Security Symposium, USENIX Security '23, Anaheim, CA, USA, August 9-11, 2023
PDF Abstract Cite URL
Poster: Pixelated Protection - Identifying Security Challenges in Game Development Processes
Philip Klostermeyer, Sabrina Amft, Alexander Krause, Niklas Busch and Sascha Fahl. In 32nd USENIX Security Symposium, USENIX 2023, Anaheim CA, USA, August 9-11, 2023
Website PDF Abstract Poster Cite URL
"Security is not my field, I’m a stats guy": A Qualitative Root Cause Analysis of Barriers to Adversarial Machine Learning Defenses in Industry
Jaron Mink, Harjot Kaur, Juliane Schmüser, Sascha Fahl and Yasemin Acar. In 32nd USENIX Security Symposium, USENIX 2023, Anaheim CA, USA, August 9-11, 2023
PDF Abstract Cite URL
Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories
Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar and Sascha Fahl. In 32nd USENIX Security Symposium, USENIX 2023, Anaheim CA, USA, August 9-11, 2023
Website PDF Abstract Cite URL
Poster: Pushed by Accident – Prevention and Remediation Strategies Against Secret Leakage
Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar and Sascha Fahl. In 19th Symposium on Usable Privacy and Security, SOUPS 2023, Anaheim CA, USA, August 6-8, 2023
Abstract Poster Cite
“Would You Give the Same Priority to the Bank and a Game? I Do Not!” Exploring Credential Management Strategies and Obstacles during Password Manager Setup
Sabrina Amft, Sandra Höltervennhoff, Nicolas Huaman, Yasemin Acar and Sascha Fahl. In 19th Symposium on Usable Privacy and Security, SOUPS 2023, Anaheim CA, USA, August 6-8, 2023
Website PDF Abstract Cite URL
Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites
Christine Utz, Sabrina Amft, Martin Degeling, Thorsten Holz, Sascha Fahl and Florian Schaub. In Privacy Enhancing Technologies Symposium, PETS 2023, July 10-12, 2023
PDF Abstract Cite URL
Talk: Video Game Development from the Perspective of Security Research
Philip Klostermeyer, Sabrina Amft, Alexander Krause and Sascha Fahl. At GermanDevDays'23, Frankfurt, Germany, June 6-7, 2023
PDF Abstract Cite URL
"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain
Dominik Wermke, Jan H. Klemmer, Noah Wöhler, Juliane Schmüser, Harshini Sri Ramulu, Yasemin Acar and Sascha Fahl. In 44th IEEE Symposium on Security and Privacy, IEEE S&P 2023, May 22-25, 2023
Website PDF Abstract Cite URL
It's like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security
Marcel Fourné, Dominik Wermke, William Enck, Sascha Fahl and Yasemin Acar. In 44th IEEE Symposium on Security and Privacy, IEEE S&P 2023, May 22-25, 2023
Website PDF Abstract Cite URL

2022

If You Can’t Get Them to the Lab: Evaluating a Virtual Study Environment with Security Information Workers
Nicolas Huaman, Alexander Krause, Dominik Wermke, Jan H. Klemmer, Christian Stransky, Yasemin Acar and Sascha Fahl. Eighteenth Symposium on Usable Privacy and Security, SOUPS 2022, Boston MA, USA, August 8-9, 2022
Website PDF Abstract Cite URL
Where to Recruit for Security Development Studies: Comparing Six Software Developer Samples
Harjot Kaur, Sabrina Amft, Daniel Votipka, Yasemin Acar and Sascha Fahl. In 31st USENIX Security Symposium, USENIX Security '22, Boston MA, USA, August 10-12, 2022
Website PDF Abstract Cite URL
Poster: User Awareness of Phishing and WebAuthn
Mindy Tran, Sabrina Amft and Dominik Wermke. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022
PDF Abstract Poster Cite URL
Poster: Committed by Accident – Prevention and Remediation Strategies Against Secret Leakage
Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar and Sascha Fahl. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022
PDF Abstract Poster Cite URL
Poster: They Would do Better if They Worked Together The Case of Interaction Problems Between Password Managers and Websites
Nicolas Huaman, Sabrina Amft, Marten Oltrogge, Yasemin Acar and Sascha Fahl. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022
PDF Abstract Poster Cite URL
Poster: Unsafe Rust - Conscious Choice or Spiky Shortcut?
Sandra Höltervennhoff, Philip Klostermeyer, Noah Wöhler, Yasemin Acar and Sascha Fahl. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022
PDF Abstract Poster Cite URL
27 Years and 81 Million Opportunities Later: Investigating the Use of Email Encryption for an Entire University
Christian Stransky, Oliver Wiese, Volker Roth, Yasemin Acar and Sascha Fahl. 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 22-26, 2022
Website PDF Abstract Cite
Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects
Dominik Wermke, Noah Wöhler, Jan H. Klemmer, Marcel Fourné, Yasemin Acar and Sascha Fahl. 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 22-26, 2022
Website PDF Abstract Cite URL
How Does Usable Security (Not) End Up in Software Products? Results From a Qualitative Interview Study
Marco Gutfleisch, Jan H. Klemmer, Niklas Busch, Yasemin Acar, M. Angela Sasse and Sascha Fahl. 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 22-26, 2022
Website PDF Abstract Cite

2021

A Large-Scale Interview Study on Information Security in and Attacks against Small and Medium-sized Enterprises
Nicolas Huaman, Bennet von Skarczinski, Dominik Wermke, Christian Stransky, Yasemin Acar, Arne Dreißigacker and Sascha Fahl. In 30th USENIX Security Symposium, USENIX Security '21, Vancouver, B.C., Canada, August 11-13, 2021
Website PDF Abstract Cite URL
Never ever or no matter what: Investigating Adoption Intentions and Misconceptions about the Corona-Warn-App in Germany
Maximilian Häring, Eva Gerlitz, Christian Tiefenau, Matthew Smith, Dominik Wermke, Sascha Fahl and Yasemin Acar. Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021
Website PDF Abstract Cite URL
On the Limited Impact of Visualizing Encryption: Perceptions of E2E Messaging Security
Christian Stransky, Dominik Wermke, Johanna Schrader, Nicolas Huaman, Yasemin Acar, Anna Lena Fehlhaber, Miranda Wei, Blase Ur and Sascha Fahl. Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021
Website PDF Abstract Cite URL
Poster: Cybercrime in Small and Medium-sized Enterprises
Nicolas Huaman, Alexander Krause, Bennet von Skarczinski, Christian Stransky, Dominik Wermke, Yasemin Acar, Arne Dreißigacker and Sascha Fahl. In Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021
Poster Cite URL
Poster: They Would do Better if They Worked Together The Case of Interaction Problems Between Password Managers and Websites
Nicolas Huaman, Sabrina Amft, Marten Oltrogge, Yasemin Acar and Sascha Fahl. In Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021
Poster Cite URL
Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications
Marten Oltrogge, Nicolas Huaman, Sabrina Amft, Yasemin Acar, Michael Backes and Sascha Fahl. In 30th USENIX Security Symposium, USENIX Security '21, Vancouver, B.C., Canada, August 11-13, 2021
PDF Abstract Cite URL
They Would do Better if They Worked Together: The Case of Interaction Problems Between Password Managers and Websites
Nicolas Huaman, Sabrina Amft, Marten Oltrogge, Yasemin Acar and Sascha Fahl. 42nd IEEE Symposium on Security and Privacy, IEEE S&P 2021, May 24-27, 2021
Website PDF Abstract Cite URL

2020

Cloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations of Security and Privacy in Cloud Office Suites
Dominik Wermke, Christian Stransky, Nicolas Huaman, Niklas Busch, Yasemin Acar and Sascha Fahl. Sixteenth Symposium on Usable Privacy and Security, SOUPS 2020, August 12-14, 2020
Website PDF Abstract Cite URL
From Needs to Actions to Secure Apps? The Effect of Requirements and Developer Practices on App Security
Charles Weir, Ben Hermann and Sascha Fahl. 29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020
PDF Abstract Cite URL
Poster: Perceptions of Handling Sensitive Data in Cloud Office Applications
Dominik Wermke, Christian Stransky, Nicolas Huaman, Niklas Busch, Alexander Krause, Yasemin Acar and Sascha Fahl. In 41st IEEE Symposium on Security and Privacy, IEEE S&P 2020, May 18-20, 2020
PDF Abstract Poster Cite URL
Poster: When Brave Hurts Privacy: Why Too Many Choices do More Harm Than Good
Anna Lena Fehlhaber, Marco Gutfleisch, Daniel Theis, Florian Wallkoetter, Yasemin Acar and Sascha Fahl. In 41st IEEE Symposium on Security and Privacy, IEEE S&P 2020, May 18-20, 2020
PDF Cite URL
Listen to Developers! A Participatory Design Study on Security Warnings for Cryptographic APIs
Peter Leo Gorski, Yasemin Acar, Luigi Lo Iacono and Sascha Fahl. CHI '20: CHI Conference on Human Factors in Computing Systems, Honolulu, HI, USA, April 25-30, 2020
PDF Abstract Cite DOI

2019

"Get a Free Item Pack with Every Activation!"
Karoline Busse, Sabrina Amft, Daniel Hecker and Emanuel von Zezschwitz. i-com, 18 (3), p. 217-236, 2019.
Preprint Abstract Cite DOI
(Un)informed Consent: Studying GDPR Consent Notices in the Field
Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub and Thorsten Holz. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, London, UK, November 11-15, 2019
PDF Abstract Cite DOI
Poster: Towards Understanding the WhatsApp Dilemma
Christian Stransky, Dominik Wermke, Johanna Schrader, Nicolas Huaman, Anna Lena Fehlhaber, Yasemin Acar and Sascha Fahl. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019
Poster Cite URL
Poster: A Large Scale Investigation of Obfuscation Use in Google Play
Dominik Wermke, Nicolas Huaman, Yasemin Acar, Bradley Reaves, Patrick Traynor and Sascha Fahl. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019
PDF Abstract Poster Cite URL
Poster: Project Leine - A Virtualized Study Infrastructure
Dominik Wermke, Nicolas Huaman, Christian Stransky, Yasemin Acar and Sascha Fahl. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019
PDF Abstract Poster Cite URL
Replication: Do We Snooze If We Can't Lose? Modelling Risk with Incentives in Habituation User Studies
Karoline Busse, Dominik Wermke, Sabrina Amft, Sascha Fahl, Emanuel von Zezschwitz and Matthew Smith. Proceedings of the 2019 Workshop on Usable Security (USEC), USEC 2019, San Diego, CA, USA, February 24, 2019
PDF Abstract Cite DOI

2018

A Large Scale Investigation of Obfuscation Use in Google Play
Dominik Wermke, Nicolas Huaman, Yasemin Acar, Bradley Reaves, Patrick Traynor and Sascha Fahl. Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, PR, USA, December 03-07, 2018
PDF Abstract Cite DOI
Better managed than memorized? Studying the Impact of Managers on Password Strength and Reuse
Sanam Ghorbani Lyastani, Michael Schilling, Sascha Fahl, Michael Backes and Sven Bugiel. 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018
PDF Abstract Cite URL
Developers Deserve Security Warnings, Too: On the Effect of Integrated Security Advice on Cryptographic API Misuse
Peter Leo Gorski, Luigi Lo Iacono, Dominik Wermke, Christian Stransky, Sebastian Möller, Yasemin Acar and Sascha Fahl. Fourteenth Symposium on Usable Privacy and Security, SOUPS 2018, Baltimore, MD, USA, August 12-14, 2018
PDF Abstract Cite URL
Poster: Replication: Do We Snooze If We Can't Lose? Modelling Risk with Incentives in Habituation User Studies
Karoline Busse, Dominik Wermke, Sabrina Amft, Sascha Fahl, Emanuel von Zezschwitz and Matthew Smith. In Fourteenth Symposium on Usable Privacy and Security, SOUPS 2018, Baltimore, MD, USA, August 12-14, 2018
PDF Abstract Cite URL
Poster: On the Effect of Security Warnings on Cryptographic API Misuse
Peter Leo Gorski, Luigi Lo Iacono, Yasemin Acar, Sebastian Moeller, Christian Stransky and Sascha Fahl. In 39th IEEE Symposium on Security and Privacy, IEEE S&P 2018, San Francisco, CA, USA, May 21-23, 2018
PDF Abstract Cite URL
The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators
Marten Oltrogge, Erik Derr, Christian Stransky, Yasemin Acar, Sascha Fahl, Christian Rossow, Giancarlo Pellegrino, Sven Bugiel and Michael Backes. 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA
PDF Abstract Cite DOI
Your Secrets Are Safe: How Browsers' Explanations Impact Misconceptions About Private Browsing Mode
Yuxi Wu, Panya Gupta, Miranda Wei, Yasemin Acar, Sascha Fahl and Blase Ur. Proceedings of the 2018 World Wide Web Conference on World Wide Web, WWW 2018, Lyon, France, April 23-27, 2018
PDF Abstract Cite DOI

2017

A Stitch in Time: Supporting Android Developers in WritingSecure Code
Duc Cuong Nguyen, Dominik Wermke, Yasemin Acar, Michael Backes, Charles Weir and Sascha Fahl. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017
PDF Abstract Cite DOI
Keep me Updated: An Empirical Study of Third-Party Library Updatability on Android
Erik Derr, Sven Bugiel, Sascha Fahl, Yasemin Acar and Michael Backes. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017
PDF Abstract Cite DOI
Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors
Mustafa Emre Acer, Emily Stark, Adrienne Porter Felt, Sascha Fahl, Radhika Bhargava, Bhanu Dev, Matt Braithwaite, Ryan Sleevi and Parisa Tabriz. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017
PDF Abstract Cite DOI
Developers Need Support, Too: A Survey of Security Advice for Software Developers
Yasemin Acar, Christian Stransky, Dominik Wermke, Charles Weir, Michelle L. Mazurek and Sascha Fahl. IEEE Cybersecurity Development, SecDev 2017, Cambridge, MA, USA, September 24-26, 2017
PDF Abstract Cite DOI
Lessons Learned from Using an Online Platform to Conduct Large-Scale, Online Controlled Security Experiments with Software Developers
Christian Stransky, Yasemin Acar, Duc Cuong Nguyen, Dominik Wermke, Doowon Kim, Elissa M. Redmiles, Michael Backes, Simson L. Garfinkel, Michelle L. Mazurek and Sascha Fahl. 10th USENIX Workshop on Cyber Security Experimentation and Test, CSET 2017, Vancouver, BC, Canada, August 14, 2017
PDF Abstract Cite URL
Security Developer Studies with GitHub Users: Exploring a Convenience Sample
Yasemin Acar, Christian Stransky, Dominik Wermke, Michelle L. Mazurek and Sascha Fahl. Thirteenth Symposium on Usable Privacy and Security, SOUPS 2017, Santa Clara, CA, USA, July 12-14, 2017
PDF Abstract Cite URL
Comparing the Usability of Cryptographic APIs
Yasemin Acar, Michael Backes, Sascha Fahl, Simson L. Garfinkel, Doowon Kim, Michelle L. Mazurek and Christian Stransky. 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017
PDF Abstract Cite DOI
Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security
Felix Fischer, Konstantin Böttinger, Huang Xiao, Christian Stransky, Yasemin Acar, Michael Backes and Sascha Fahl. 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017
PDF Abstract Cite DOI
How Internet Resources Might Be Helping You Develop Faster but Less Securely
Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek and Christian Stransky. IEEE Secur. Priv., 15 (2), p. 50-60, 2017.
PDF Abstract Cite DOI

2016

You are Not Your Developer, Either: A Research Agenda for Usable Security and Privacy Research Beyond End Users
Yasemin Acar, Sascha Fahl and Michelle L. Mazurek. IEEE Cybersecurity Development, SecDev 2016, Boston, MA, USA, November 3-4, 2016
PDF Abstract Cite DOI
An Empirical Study of Textual Key-Fingerprint Representations
Sergej Dechand, Dominik Schürmann, Karoline Busse, Yasemin Acar, Sascha Fahl and Matthew Smith. 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016
Cite URL
SoK: Lessons Learned from Android Security Research for Appified Software Platforms
Yasemin Acar, Michael Backes, Sven Bugiel, Sascha Fahl, Patrick D. McDaniel and Matthew Smith. IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016
PDF Abstract Cite DOI
You Get Where You're Looking for: The Impact of Information Sources on Code Security
Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek and Christian Stransky. IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016
PDF Abstract Cite DOI
Poster: Towards Ecological Validity for Password Alternative User Studies
Yasemin Acar, Michael Backes, Sascha Fahl, Maximilian Koch and Christian Stransky. In 1st IEEE European Symposium on Security and Privacy, IEEE EuroS&P 2016, Saarbrücken, Germany, March 21-24, 2016
Cite URL
Poster: When Laziness Snaps Back – The Impact of Code Generators on App (In)Security
Yasemin Acar, Michael Backes, Sascha Fahl and Christian Stransky. In 1st IEEE European Symposium on Security and Privacy, IEEE EuroS&P 2016, Saarbrücken, Germany, March 21-24, 2016
Cite URL

2015

VCCFinder: Finding Potential Vulnerabilities in Open-Source Projects to Assist Code Audits
Henning Perl, Sergej Dechand, Matthew Smith, Daniel Arp, Fabian Yamaguchi, Konrad Rieck, Sascha Fahl and Yasemin Acar. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12-16, 2015
PDF Abstract Cite DOI
To Pin or Not to Pin-Helping App Developers Bullet Proof Their TLS Connections
Marten Oltrogge, Yasemin Acar, Sergej Dechand, Matthew Smith and Sascha Fahl. 24th USENIX Security Symposium, USENIX Security 15, Washington, D.C., USA, August 12-14, 2015
PDF Abstract Cite URL
SoK: Secure Messaging
Nik Unger, Sergej Dechand, Joseph Bonneau, Sascha Fahl, Henning Perl, Ian Goldberg and Matthew Smith. 2015 IEEE Symposium on Security and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015
PDF Abstract Cite DOI

2014

Hey, NSA: Stay Away from my Market! Future Proofing App Markets against Powerful Attackers
Sascha Fahl, Sergej Dechand, Henning Perl, Felix Fischer, Jaromir Smrcek and Matthew Smith. Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA, November 3-7, 2014
PDF Abstract Cite DOI
Who's Afraid of Which Bad Wolf? A Survey of IT Security Risk Awareness
Marian Harbach, Sascha Fahl and Matthew Smith. IEEE 27th Computer Security Foundations Symposium, CSF 2014, Vienna, Austria, 19-22 July, 2014
PDF Abstract Cite DOI
Why eve and mallory (also) love webmasters: a study on the root causes of SSL misconfigurations
Sascha Fahl, Yasemin Acar, Henning Perl and Matthew Smith. 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS '14, Kyoto, Japan - June 03 - 06, 2014
PDF Abstract Cite DOI
You Won't Be Needing These Any More: On Removing Unused Certificates from Trust Stores
Henning Perl, Sascha Fahl and Matthew Smith. Financial Cryptography and Data Security - 18th International Conference, FC 2014, Christ Church, Barbados, March 3-7, 2014, Revised Selected Papers
PDF Abstract Cite DOI

2013

Rethinking SSL development in an appified world
Sascha Fahl, Marian Harbach, Henning Perl, Markus Koetter and Matthew Smith. 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS'13, Berlin, Germany, November 4-8, 2013
PDF Abstract Cite DOI
On the Acceptance of Privacy-Preserving Authentication Technology: The Curious Case of National Identity Cards
Marian Harbach, Sascha Fahl, Matthias Rieger and Matthew Smith. Privacy Enhancing Technologies - 13th International Symposium, PETS 2013, Bloomington, IN, USA, July 10-12, 2013. Proceedings
PDF Abstract Cite DOI
On the ecological validity of a password study
Sascha Fahl, Marian Harbach, Yasemin Acar and Matthew Smith. Symposium On Usable Privacy and Security, SOUPS '13, Newcastle, United Kingdom, July 24-26, 2013
PDF Abstract Cite DOI
Hey, You, Get Off of My Clipboard - On How Usability Trumps Security in Android Password Managers
Sascha Fahl, Marian Harbach, Marten Oltrogge, Thomas Muders and Matthew Smith. Financial Cryptography and Data Security - 17th International Conference, FC 2013, Okinawa, Japan, April 1-5, 2013, Revised Selected Papers
PDF Abstract Cite DOI
Sorry, I Don't Get It: An Analysis of Warning Message Texts
Marian Harbach, Sascha Fahl, Polina Yakovleva and Matthew Smith. Financial Cryptography and Data Security - FC 2013 Workshops, USEC and WAHC 2013, Okinawa, Japan, April 1, 2013, Revised Selected Papers
Cite DOI

2012

Towards measuring warning readability
Marian Harbach, Sascha Fahl, Thomas Muders and Matthew Smith. the ACM Conference on Computer and Communications Security, CCS'12, Raleigh, NC, USA, October 16-18, 2012
Cite DOI
Why eve and mallory love android: an analysis of android SSL (in)security
Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith, Lars Baumgärtner and Bernd Freisleben. the ACM Conference on Computer and Communications Security, CCS'12, Raleigh, NC, USA, October 16-18, 2012
PDF Abstract Cite DOI
Helping Johnny 2.0 to encrypt his Facebook conversations
Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith and Uwe Sander. Symposium On Usable Privacy and Security, SOUPS '12, Washington, DC, USA - July 11 - 13, 2012
PDF Abstract Cite DOI
Towards privacy-preserving access control with hidden policies, hidden credentials and hidden decisions
Marian Harbach, Sascha Fahl, Michael Brenner, Thomas Muders and Matthew Smith. Tenth Annual International Conference on Privacy, Security and Trust, PST 2012, Paris, France, July 16-18, 2012
Cite DOI
Confidentiality as a Service - Usable Security for the Cloud
Sascha Fahl, Marian Harbach, Thomas Muders and Matthew Smith. 11th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2012, Liverpool, United Kingdom, June 25-27, 2012
Cite DOI
Human-centric visual access control for clinical data management
Sascha Fahl, Marian Harbach and Matthew Smith. 6th IEEE International Conference on Digital Ecosystems and Technologies, DEST 2012, Campione d'Italia, Italy, June 18-20, 2012
Cite DOI
TrustSplit: usable confidentiality for social network messaging
Sascha Fahl, Marian Harbach, Thomas Muders and Matthew Smith. 23rd ACM Conference on Hypertext and Social Media, HT '12, Milwaukee, WI, USA, June 25-28, 2012
Cite DOI
All our messages are belong to us: usable confidentiality in social networks
Marian Harbach, Sascha Fahl, Thomas Muders and Matthew Smith. Proceedings of the 21st World Wide Web Conference, WWW 2012, Lyon, France, April 16-20, 2012 (Companion Volume)
Cite DOI

2011

TrustBox: A Security Architecture for Preventing Data Breaches
Matthias Schmidt, Sascha Fahl, Roland Schwarzkopf and Bernd Freisleben. Proceedings of the 19th International Euromicro Conference on Parallel, Distributed and Network-based Processing, PDP 2011, Ayia Napa, Cyprus, 9-11 February 2011
Cite DOI