Publications

A file with all of our references is available as: teamusec.bib

2025

"I’m pretty expert and I still screw it up": Qualitative Insights into Experiences and Challenges of Designing and Implementing Cryptographic Library APIs

Juliane Schmüser, Philip Klostermeyer, Kay Friedrich and Sascha Fahl. In 46th IEEE Symposium on Security and Privacy, IEEE S&P 2025, May 12-14, 2025

Website Abstract Cite URL

Transparency in Usable Privacy and Security Research: Scholars’ Perspectives, Practices, and Recommendations

Jan H. Klemmer, Juliane Schmüser, Byron M. Lowens, Fabian Fischer, Lea Schmüser, Florian Schaub and Sascha Fahl. In 46th IEEE Symposium on Security and Privacy, IEEE S&P 2025, May 12-15, 2025

Abstract Cite

2024

Passwords To-Go: Investigating Multi-faceted Challenges for Password Managers in the Android Ecosystem

Nicolas Huaman, Marten Oltrogge, Sabrina Amft, Yannick Evers and Sascha Fahl. 40th Annual Computer Security Applications Conference, ACSAC'24, Dec 11-13, 2024

Abstract Cite URL

Skipping the Security Side Quests: A Qualitative Study on Security Practices and Challenges in Game Development

Philip Klostermeyer, Sabrina Amft, Sandra Höltervennhoff, Alexander Krause, Niklas Busch and Sascha Fahl. In 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24), October 14--18, 2024, Salt Lake City, UT, USA

Website Abstract Cite URL

Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns

Jan H. Klemmer, Stefan Albert Horstmann, Nikhil Patnaik, Cordelia Ludden, Cordell Burton Jr, Carson Powers, Fabio Massacci, Akond Rahman, Daniel Votipka, Heather Richter Lipford, Awais Rashid, Alena Naiakshina and Sascha Fahl. In 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24), October 14--18, 2024, Salt Lake City, UT, USA

PDF Abstract Cite URL

"There were Sacrifices to reach that Deadline": Security Challenges in Game Development

Philip Klostermeyer, Sabrina Amft, Alexander Krause and Sascha Fahl. At devcom Developer Conference 2024, Cologne, Germany, August 18-20, 2024

Abstract Cite URL

A Mixed-Methods Study on User Experiences and Challenges of Recovery Codes for an End-to-End Encrypted Service

Sandra Höltervennhoff, Noah Wöhler, Arne Möhle, Marten Oltrogge, Yasemin Acar, Oliver Wiese and Sascha Fahl. In 33rd USENIX Security Symposium, USENIX Security '24, August 14-16, 2024

PDF Abstract Cite URL

On The Challenges of Bringing Cryptography from Papers to Products: Results from an Interview Study with Experts

Konstantin Fischer, Ivana Trummová, Phillip Gajland, Yasemin Acar, Sascha Fahl and Angela Sasse. In 33rd USENIX Security Symposium, USENIX Security '24, August 14-16, 2024

Website PDF Abstract Cite URL

“You Received $100,000 From Johnny”: A Mixed-Methods Study on Push Notification Security and Privacy in Android Apps

Thomas Neteler, Sascha Fahl and Luigi Lo Iacono. IEEE Access, 12, p. 112499-112516, 2024.

PDF Abstract Cite DOI

“You have to read 50 different RFCs that contradict each other”: An Interview Study on the Experiences of Implementing Cryptographic Standards

Nicolas Huaman, Jacques Suray, Jan H. Klemmer, Marcel Fourné, Sabrina Amft, Ivana Trummová, Yasemin Acar and Sascha Fahl. In 33rd USENIX Security Symposium, USENIX Security '24, Philadelphia, PA, USA, August 14-16, 2024

Website PDF Abstract Cite URL

Everyone for Themselves? A Qualitative Study about Individual Security Setups of Open Source Software Contributors

Sabrina Amft, Sandra Höltervennhoff, Rebecca Panskus, Karola Marky and Sascha Fahl. In 45th IEEE Symposium on Security and Privacy, IEEE S&P 2024, May 20-23, 2024, San Francisco, USA

PDF Abstract Cite URL

Analyzing Security and Privacy Advice During the 2022 Russian Invasion of Ukraine on Twitter

Juliane Schmüser, Harshini Sri Ramulu, Noah Wöhler, Christian Stransky, Felix Bensmann, Dimitar Dimitrov, Sebastian Schellhammer, Dominik Wermke, Stefan Dietze, Yasemin Acar and Sascha Fahl. In Proceedings of the CHI Conference on Human Factors in Computing Systems (CHI '24), May 11--16, 2024, Honolulu, HI, USA

PDF Abstract Cite URL

Mental Models, Expectations and Implications of Client-Side Scanning: An Interview Study with Experts

Divyanshu Bhardwaj, Carolyn Guthoff, Adrian Dabrowski, Sascha Fahl and Katharina Krombholz. In Proceedings of the CHI Conference on Human Factors in Computing Systems (CHI '24), May 11--16, 2024, Honolulu, HI, USA

PDF Abstract Cite URL

2023

“Make Them Change it Every Week!”: A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication

Jan H. Klemmer, Marco Gutfleisch, Christian Stransky, Yasemin Acar, M. Angela Sasse and Sascha Fahl. In 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23), November 26–30, 2023, Copenhagen, Denmark

PDF Abstract Cite URL

“We’ve Disabled MFA for You”: An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

Sabrina Amft, Sandra Höltervennhoff, Nicolas Huaman, Alexander Krause, Lucy Simko, Yasemin Acar and Sascha Fahl. In 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS '23), November 26–30, 2023, Copenhagen, Denmark

PDF Abstract Cite URL

"I wouldn’t want my unsafe code to run my pacemaker": An Interview Study on the Use, Comprehension, and Perceived Risks of Unsafe Rust

Sandra Höltervennhoff, Philip Klostermeyer, Noah Wöhler, Sascha Fahl and Yasemin Acar. In 32nd USENIX Security Symposium, USENIX Security '23, Anaheim, CA, USA, August 9-11, 2023

PDF Abstract Cite URL

Poster: Pixelated Protection - Identifying Security Challenges in Game Development Processes

Philip Klostermeyer, Sabrina Amft, Alexander Krause, Niklas Busch and Sascha Fahl. In 32nd USENIX Security Symposium, USENIX 2023, Anaheim CA, USA, August 9-11, 2023

Website PDF Abstract Poster Cite URL

"Security is not my field, I’m a stats guy": A Qualitative Root Cause Analysis of Barriers to Adversarial Machine Learning Defenses in Industry

Jaron Mink, Harjot Kaur, Juliane Schmüser, Sascha Fahl and Yasemin Acar. In 32nd USENIX Security Symposium, USENIX 2023, Anaheim CA, USA, August 9-11, 2023

PDF Abstract Cite URL

Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories

Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar and Sascha Fahl. In 32nd USENIX Security Symposium, USENIX 2023, Anaheim CA, USA, August 9-11, 2023

Website PDF Abstract Cite URL

Poster: Pushed by Accident – Prevention and Remediation Strategies Against Secret Leakage

Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar and Sascha Fahl. In 19th Symposium on Usable Privacy and Security, SOUPS 2023, Anaheim CA, USA, August 6-8, 2023

Abstract Poster Cite

“Would You Give the Same Priority to the Bank and a Game? I Do Not!” Exploring Credential Management Strategies and Obstacles during Password Manager Setup

Sabrina Amft, Sandra Höltervennhoff, Nicolas Huaman, Yasemin Acar and Sascha Fahl. In 19th Symposium on Usable Privacy and Security, SOUPS 2023, Anaheim CA, USA, August 6-8, 2023

Website PDF Abstract Cite URL

Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites

Christine Utz, Sabrina Amft, Martin Degeling, Thorsten Holz, Sascha Fahl and Florian Schaub. In Privacy Enhancing Technologies Symposium, PETS 2023, July 10-12, 2023

PDF Abstract Cite URL

Talk: Video Game Development from the Perspective of Security Research

Philip Klostermeyer, Sabrina Amft, Alexander Krause and Sascha Fahl. At GermanDevDays'23, Frankfurt, Germany, June 6-7, 2023

PDF Abstract Cite URL

"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain

Dominik Wermke, Jan H. Klemmer, Noah Wöhler, Juliane Schmüser, Harshini Sri Ramulu, Yasemin Acar and Sascha Fahl. In 44th IEEE Symposium on Security and Privacy, IEEE S&P 2023, May 22-25, 2023

Website PDF Abstract Cite URL

It's like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security

Marcel Fourné, Dominik Wermke, William Enck, Sascha Fahl and Yasemin Acar. In 44th IEEE Symposium on Security and Privacy, IEEE S&P 2023, May 22-25, 2023

Website PDF Abstract Cite URL

2022

If You Can’t Get Them to the Lab: Evaluating a Virtual Study Environment with Security Information Workers

Nicolas Huaman, Alexander Krause, Dominik Wermke, Jan H. Klemmer, Christian Stransky, Yasemin Acar and Sascha Fahl. Eighteenth Symposium on Usable Privacy and Security, SOUPS 2022, Boston MA, USA, August 8-9, 2022

Website PDF Abstract Cite URL

Where to Recruit for Security Development Studies: Comparing Six Software Developer Samples

Harjot Kaur, Sabrina Amft, Daniel Votipka, Yasemin Acar and Sascha Fahl. In 31st USENIX Security Symposium, USENIX Security '22, Boston MA, USA, August 10-12, 2022

Website PDF Abstract Cite URL

Poster: User Awareness of Phishing and WebAuthn

Mindy Tran, Sabrina Amft and Dominik Wermke. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022

PDF Abstract Poster Cite URL

Poster: Committed by Accident – Prevention and Remediation Strategies Against Secret Leakage

Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar and Sascha Fahl. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022

PDF Abstract Poster Cite URL

Poster: They Would do Better if They Worked Together The Case of Interaction Problems Between Password Managers and Websites

Nicolas Huaman, Sabrina Amft, Marten Oltrogge, Yasemin Acar and Sascha Fahl. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022

PDF Abstract Poster Cite URL

Poster: Unsafe Rust - Conscious Choice or Spiky Shortcut?

Sandra Höltervennhoff, Philip Klostermeyer, Noah Wöhler, Yasemin Acar and Sascha Fahl. In 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 23-26, 2022

PDF Abstract Poster Cite URL

27 Years and 81 Million Opportunities Later: Investigating the Use of Email Encryption for an Entire University

Christian Stransky, Oliver Wiese, Volker Roth, Yasemin Acar and Sascha Fahl. 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 22-26, 2022

Website PDF Abstract Cite

Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects

Dominik Wermke, Noah Wöhler, Jan H. Klemmer, Marcel Fourné, Yasemin Acar and Sascha Fahl. 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 22-26, 2022

Website PDF Abstract Cite URL

How Does Usable Security (Not) End Up in Software Products? Results From a Qualitative Interview Study

Marco Gutfleisch, Jan H. Klemmer, Niklas Busch, Yasemin Acar, M. Angela Sasse and Sascha Fahl. 43rd IEEE Symposium on Security and Privacy, IEEE S&P 2022, May 22-26, 2022

Website PDF Abstract Cite

2021

A Large-Scale Interview Study on Information Security in and Attacks against Small and Medium-sized Enterprises

Nicolas Huaman, Bennet von Skarczinski, Dominik Wermke, Christian Stransky, Yasemin Acar, Arne Dreißigacker and Sascha Fahl. In 30th USENIX Security Symposium, USENIX Security '21, Vancouver, B.C., Canada, August 11-13, 2021

Website PDF Abstract Cite URL

Never ever or no matter what: Investigating Adoption Intentions and Misconceptions about the Corona-Warn-App in Germany

Maximilian Häring, Eva Gerlitz, Christian Tiefenau, Matthew Smith, Dominik Wermke, Sascha Fahl and Yasemin Acar. Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021

Website PDF Abstract Cite URL

On the Limited Impact of Visualizing Encryption: Perceptions of E2E Messaging Security

Christian Stransky, Dominik Wermke, Johanna Schrader, Nicolas Huaman, Yasemin Acar, Anna Lena Fehlhaber, Miranda Wei, Blase Ur and Sascha Fahl. Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021

Website PDF Abstract Cite URL

Poster: Cybercrime in Small and Medium-sized Enterprises

Nicolas Huaman, Alexander Krause, Bennet von Skarczinski, Christian Stransky, Dominik Wermke, Yasemin Acar, Arne Dreißigacker and Sascha Fahl. In Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021

Poster Cite URL

Poster: They Would do Better if They Worked Together The Case of Interaction Problems Between Password Managers and Websites

Nicolas Huaman, Sabrina Amft, Marten Oltrogge, Yasemin Acar and Sascha Fahl. In Seventeenth Symposium on Usable Privacy and Security, SOUPS 2021, August 8-10, 2021

Poster Cite URL

Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications

Marten Oltrogge, Nicolas Huaman, Sabrina Amft, Yasemin Acar, Michael Backes and Sascha Fahl. In 30th USENIX Security Symposium, USENIX Security '21, Vancouver, B.C., Canada, August 11-13, 2021

PDF Abstract Cite URL

They Would do Better if They Worked Together: The Case of Interaction Problems Between Password Managers and Websites

Nicolas Huaman, Sabrina Amft, Marten Oltrogge, Yasemin Acar and Sascha Fahl. 42nd IEEE Symposium on Security and Privacy, IEEE S&P 2021, May 24-27, 2021

Website PDF Abstract Cite URL

2020

Cloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations of Security and Privacy in Cloud Office Suites

Dominik Wermke, Christian Stransky, Nicolas Huaman, Niklas Busch, Yasemin Acar and Sascha Fahl. Sixteenth Symposium on Usable Privacy and Security, SOUPS 2020, August 12-14, 2020

Website PDF Abstract Cite URL

From Needs to Actions to Secure Apps? The Effect of Requirements and Developer Practices on App Security

Charles Weir, Ben Hermann and Sascha Fahl. 29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020

PDF Abstract Cite URL

Poster: Perceptions of Handling Sensitive Data in Cloud Office Applications

Dominik Wermke, Christian Stransky, Nicolas Huaman, Niklas Busch, Alexander Krause, Yasemin Acar and Sascha Fahl. In 41st IEEE Symposium on Security and Privacy, IEEE S&P 2020, May 18-20, 2020

PDF Abstract Poster Cite URL

Poster: When Brave Hurts Privacy: Why Too Many Choices do More Harm Than Good

Anna Lena Fehlhaber, Marco Gutfleisch, Daniel Theis, Florian Wallkoetter, Yasemin Acar and Sascha Fahl. In 41st IEEE Symposium on Security and Privacy, IEEE S&P 2020, May 18-20, 2020

PDF Cite URL

Listen to Developers! A Participatory Design Study on Security Warnings for Cryptographic APIs

Peter Leo Gorski, Yasemin Acar, Luigi Lo Iacono and Sascha Fahl. CHI '20: CHI Conference on Human Factors in Computing Systems, Honolulu, HI, USA, April 25-30, 2020

PDF Abstract Cite DOI

2019

"Get a Free Item Pack with Every Activation!"

Karoline Busse, Sabrina Amft, Daniel Hecker and Emanuel von Zezschwitz. i-com, 18 (3), p. 217-236, 2019.

Preprint Abstract Cite DOI

(Un)informed Consent: Studying GDPR Consent Notices in the Field

Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub and Thorsten Holz. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, London, UK, November 11-15, 2019

PDF Abstract Cite DOI

Poster: Towards Understanding the WhatsApp Dilemma

Christian Stransky, Dominik Wermke, Johanna Schrader, Nicolas Huaman, Anna Lena Fehlhaber, Yasemin Acar and Sascha Fahl. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019

Poster Cite URL

Poster: A Large Scale Investigation of Obfuscation Use in Google Play

Dominik Wermke, Nicolas Huaman, Yasemin Acar, Bradley Reaves, Patrick Traynor and Sascha Fahl. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019

PDF Abstract Poster Cite URL

Poster: Project Leine - A Virtualized Study Infrastructure

Dominik Wermke, Nicolas Huaman, Christian Stransky, Yasemin Acar and Sascha Fahl. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019

PDF Abstract Poster Cite URL

Replication: Do We Snooze If We Can't Lose? Modelling Risk with Incentives in Habituation User Studies

Karoline Busse, Dominik Wermke, Sabrina Amft, Sascha Fahl, Emanuel von Zezschwitz and Matthew Smith. Proceedings of the 2019 Workshop on Usable Security (USEC), USEC 2019, San Diego, CA, USA, February 24, 2019

PDF Abstract Cite DOI

2018

A Large Scale Investigation of Obfuscation Use in Google Play

Dominik Wermke, Nicolas Huaman, Yasemin Acar, Bradley Reaves, Patrick Traynor and Sascha Fahl. Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, PR, USA, December 03-07, 2018

PDF Abstract Cite DOI

Better managed than memorized? Studying the Impact of Managers on Password Strength and Reuse

Sanam Ghorbani Lyastani, Michael Schilling, Sascha Fahl, Michael Backes and Sven Bugiel. 27th USENIX Security Symposium, USENIX Security 2018, Baltimore, MD, USA, August 15-17, 2018

PDF Abstract Cite URL

Developers Deserve Security Warnings, Too: On the Effect of Integrated Security Advice on Cryptographic API Misuse

Peter Leo Gorski, Luigi Lo Iacono, Dominik Wermke, Christian Stransky, Sebastian Möller, Yasemin Acar and Sascha Fahl. Fourteenth Symposium on Usable Privacy and Security, SOUPS 2018, Baltimore, MD, USA, August 12-14, 2018

PDF Abstract Cite URL

Poster: Replication: Do We Snooze If We Can't Lose? Modelling Risk with Incentives in Habituation User Studies

Karoline Busse, Dominik Wermke, Sabrina Amft, Sascha Fahl, Emanuel von Zezschwitz and Matthew Smith. In Fourteenth Symposium on Usable Privacy and Security, SOUPS 2018, Baltimore, MD, USA, August 12-14, 2018

PDF Abstract Cite URL

Poster: On the Effect of Security Warnings on Cryptographic API Misuse

Peter Leo Gorski, Luigi Lo Iacono, Yasemin Acar, Sebastian Moeller, Christian Stransky and Sascha Fahl. In 39th IEEE Symposium on Security and Privacy, IEEE S&P 2018, San Francisco, CA, USA, May 21-23, 2018

PDF Abstract Cite URL

The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators

Marten Oltrogge, Erik Derr, Christian Stransky, Yasemin Acar, Sascha Fahl, Christian Rossow, Giancarlo Pellegrino, Sven Bugiel and Michael Backes. 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA

PDF Abstract Cite DOI

Your Secrets Are Safe: How Browsers' Explanations Impact Misconceptions About Private Browsing Mode

Yuxi Wu, Panya Gupta, Miranda Wei, Yasemin Acar, Sascha Fahl and Blase Ur. Proceedings of the 2018 World Wide Web Conference on World Wide Web, WWW 2018, Lyon, France, April 23-27, 2018

PDF Abstract Cite DOI

2017

A Stitch in Time: Supporting Android Developers in WritingSecure Code

Duc Cuong Nguyen, Dominik Wermke, Yasemin Acar, Michael Backes, Charles Weir and Sascha Fahl. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017

PDF Abstract Cite DOI

Keep me Updated: An Empirical Study of Third-Party Library Updatability on Android

Erik Derr, Sven Bugiel, Sascha Fahl, Yasemin Acar and Michael Backes. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017

PDF Abstract Cite DOI

Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors

Mustafa Emre Acer, Emily Stark, Adrienne Porter Felt, Sascha Fahl, Radhika Bhargava, Bhanu Dev, Matt Braithwaite, Ryan Sleevi and Parisa Tabriz. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017

PDF Abstract Cite DOI

Developers Need Support, Too: A Survey of Security Advice for Software Developers

Yasemin Acar, Christian Stransky, Dominik Wermke, Charles Weir, Michelle L. Mazurek and Sascha Fahl. IEEE Cybersecurity Development, SecDev 2017, Cambridge, MA, USA, September 24-26, 2017

PDF Abstract Cite DOI

Lessons Learned from Using an Online Platform to Conduct Large-Scale, Online Controlled Security Experiments with Software Developers

Christian Stransky, Yasemin Acar, Duc Cuong Nguyen, Dominik Wermke, Doowon Kim, Elissa M. Redmiles, Michael Backes, Simson L. Garfinkel, Michelle L. Mazurek and Sascha Fahl. 10th USENIX Workshop on Cyber Security Experimentation and Test, CSET 2017, Vancouver, BC, Canada, August 14, 2017

PDF Abstract Cite URL

Security Developer Studies with GitHub Users: Exploring a Convenience Sample

Yasemin Acar, Christian Stransky, Dominik Wermke, Michelle L. Mazurek and Sascha Fahl. Thirteenth Symposium on Usable Privacy and Security, SOUPS 2017, Santa Clara, CA, USA, July 12-14, 2017

PDF Abstract Cite URL

Comparing the Usability of Cryptographic APIs

Yasemin Acar, Michael Backes, Sascha Fahl, Simson L. Garfinkel, Doowon Kim, Michelle L. Mazurek and Christian Stransky. 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017

PDF Abstract Cite DOI

Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security

Felix Fischer, Konstantin Böttinger, Huang Xiao, Christian Stransky, Yasemin Acar, Michael Backes and Sascha Fahl. 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017

PDF Abstract Cite DOI

How Internet Resources Might Be Helping You Develop Faster but Less Securely

Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek and Christian Stransky. IEEE Secur. Priv., 15 (2), p. 50-60, 2017.

PDF Abstract Cite DOI

2016

You are Not Your Developer, Either: A Research Agenda for Usable Security and Privacy Research Beyond End Users

Yasemin Acar, Sascha Fahl and Michelle L. Mazurek. IEEE Cybersecurity Development, SecDev 2016, Boston, MA, USA, November 3-4, 2016

PDF Abstract Cite DOI

An Empirical Study of Textual Key-Fingerprint Representations

Sergej Dechand, Dominik Schürmann, Karoline Busse, Yasemin Acar, Sascha Fahl and Matthew Smith. 25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016

Cite URL

SoK: Lessons Learned from Android Security Research for Appified Software Platforms

Yasemin Acar, Michael Backes, Sven Bugiel, Sascha Fahl, Patrick D. McDaniel and Matthew Smith. IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016

PDF Abstract Cite DOI

You Get Where You're Looking for: The Impact of Information Sources on Code Security

Yasemin Acar, Michael Backes, Sascha Fahl, Doowon Kim, Michelle L. Mazurek and Christian Stransky. IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016

PDF Abstract Cite DOI

Poster: Towards Ecological Validity for Password Alternative User Studies

Yasemin Acar, Michael Backes, Sascha Fahl, Maximilian Koch and Christian Stransky. In 1st IEEE European Symposium on Security and Privacy, IEEE EuroS&P 2016, Saarbrücken, Germany, March 21-24, 2016

Cite URL

Poster: When Laziness Snaps Back – The Impact of Code Generators on App (In)Security

Yasemin Acar, Michael Backes, Sascha Fahl and Christian Stransky. In 1st IEEE European Symposium on Security and Privacy, IEEE EuroS&P 2016, Saarbrücken, Germany, March 21-24, 2016

Cite URL

2015

VCCFinder: Finding Potential Vulnerabilities in Open-Source Projects to Assist Code Audits

Henning Perl, Sergej Dechand, Matthew Smith, Daniel Arp, Fabian Yamaguchi, Konrad Rieck, Sascha Fahl and Yasemin Acar. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, October 12-16, 2015

PDF Abstract Cite DOI

To Pin or Not to Pin-Helping App Developers Bullet Proof Their TLS Connections

Marten Oltrogge, Yasemin Acar, Sergej Dechand, Matthew Smith and Sascha Fahl. 24th USENIX Security Symposium, USENIX Security 15, Washington, D.C., USA, August 12-14, 2015

PDF Abstract Cite URL

SoK: Secure Messaging

Nik Unger, Sergej Dechand, Joseph Bonneau, Sascha Fahl, Henning Perl, Ian Goldberg and Matthew Smith. 2015 IEEE Symposium on Security and Privacy, SP 2015, San Jose, CA, USA, May 17-21, 2015

PDF Abstract Cite DOI

2014

Hey, NSA: Stay Away from my Market! Future Proofing App Markets against Powerful Attackers

Sascha Fahl, Sergej Dechand, Henning Perl, Felix Fischer, Jaromir Smrcek and Matthew Smith. Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA, November 3-7, 2014

PDF Abstract Cite DOI

Who's Afraid of Which Bad Wolf? A Survey of IT Security Risk Awareness

Marian Harbach, Sascha Fahl and Matthew Smith. IEEE 27th Computer Security Foundations Symposium, CSF 2014, Vienna, Austria, 19-22 July, 2014

PDF Abstract Cite DOI

Why eve and mallory (also) love webmasters: a study on the root causes of SSL misconfigurations

Sascha Fahl, Yasemin Acar, Henning Perl and Matthew Smith. 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS '14, Kyoto, Japan - June 03 - 06, 2014

PDF Abstract Cite DOI

You Won't Be Needing These Any More: On Removing Unused Certificates from Trust Stores

Henning Perl, Sascha Fahl and Matthew Smith. Financial Cryptography and Data Security - 18th International Conference, FC 2014, Christ Church, Barbados, March 3-7, 2014, Revised Selected Papers

PDF Abstract Cite DOI

2013

Rethinking SSL development in an appified world

Sascha Fahl, Marian Harbach, Henning Perl, Markus Koetter and Matthew Smith. 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS'13, Berlin, Germany, November 4-8, 2013

PDF Abstract Cite DOI

On the Acceptance of Privacy-Preserving Authentication Technology: The Curious Case of National Identity Cards

Marian Harbach, Sascha Fahl, Matthias Rieger and Matthew Smith. Privacy Enhancing Technologies - 13th International Symposium, PETS 2013, Bloomington, IN, USA, July 10-12, 2013. Proceedings

PDF Abstract Cite DOI

On the ecological validity of a password study

Sascha Fahl, Marian Harbach, Yasemin Acar and Matthew Smith. Symposium On Usable Privacy and Security, SOUPS '13, Newcastle, United Kingdom, July 24-26, 2013

PDF Abstract Cite DOI

Hey, You, Get Off of My Clipboard - On How Usability Trumps Security in Android Password Managers

Sascha Fahl, Marian Harbach, Marten Oltrogge, Thomas Muders and Matthew Smith. Financial Cryptography and Data Security - 17th International Conference, FC 2013, Okinawa, Japan, April 1-5, 2013, Revised Selected Papers

PDF Abstract Cite DOI

Sorry, I Don't Get It: An Analysis of Warning Message Texts

Marian Harbach, Sascha Fahl, Polina Yakovleva and Matthew Smith. Financial Cryptography and Data Security - FC 2013 Workshops, USEC and WAHC 2013, Okinawa, Japan, April 1, 2013, Revised Selected Papers

Cite DOI

2012

Towards measuring warning readability

Marian Harbach, Sascha Fahl, Thomas Muders and Matthew Smith. the ACM Conference on Computer and Communications Security, CCS'12, Raleigh, NC, USA, October 16-18, 2012

Cite DOI

Why eve and mallory love android: an analysis of android SSL (in)security

Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith, Lars Baumgärtner and Bernd Freisleben. the ACM Conference on Computer and Communications Security, CCS'12, Raleigh, NC, USA, October 16-18, 2012

PDF Abstract Cite DOI

Helping Johnny 2.0 to encrypt his Facebook conversations

Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith and Uwe Sander. Symposium On Usable Privacy and Security, SOUPS '12, Washington, DC, USA - July 11 - 13, 2012

PDF Abstract Cite DOI

Towards privacy-preserving access control with hidden policies, hidden credentials and hidden decisions

Marian Harbach, Sascha Fahl, Michael Brenner, Thomas Muders and Matthew Smith. Tenth Annual International Conference on Privacy, Security and Trust, PST 2012, Paris, France, July 16-18, 2012

Cite DOI

Confidentiality as a Service - Usable Security for the Cloud

Sascha Fahl, Marian Harbach, Thomas Muders and Matthew Smith. 11th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2012, Liverpool, United Kingdom, June 25-27, 2012

Cite DOI

Human-centric visual access control for clinical data management

Sascha Fahl, Marian Harbach and Matthew Smith. 6th IEEE International Conference on Digital Ecosystems and Technologies, DEST 2012, Campione d'Italia, Italy, June 18-20, 2012

Cite DOI

TrustSplit: usable confidentiality for social network messaging

Sascha Fahl, Marian Harbach, Thomas Muders and Matthew Smith. 23rd ACM Conference on Hypertext and Social Media, HT '12, Milwaukee, WI, USA, June 25-28, 2012

Cite DOI

All our messages are belong to us: usable confidentiality in social networks

Marian Harbach, Sascha Fahl, Thomas Muders and Matthew Smith. Proceedings of the 21st World Wide Web Conference, WWW 2012, Lyon, France, April 16-20, 2012 (Companion Volume)

Cite DOI

2011

TrustBox: A Security Architecture for Preventing Data Breaches

Matthias Schmidt, Sascha Fahl, Roland Schwarzkopf and Bernd Freisleben. Proceedings of the 19th International Euromicro Conference on Parallel, Distributed and Network-based Processing, PDP 2011, Ayia Napa, Cyprus, 9-11 February 2011

Cite DOI