@swiefling@hci.social
@swiefling@hci.social avatar

swiefling

@swiefling@hci.social

🔑 Research in Usable #Security and #Privacy, #Authentication.
💼 Senior SWE @ Vodafone. Past: Meta, H-BRS, TH Köln.
🎓 Dr.-Ing. from Ruhr University Bochum.

Views expressed are my own and not necessarily those of my employer.

#Science #InfoSec #UX #HCI #WebDev #Password #FIDO2 #WebAuthN #DataScience #UsableSecurity #Data #fedi22 #searchable

This profile is from a federated server and may be incomplete. Browse more on the original instance.

swiefling, (edited ) to security
@swiefling@hci.social avatar

Privacy matters! But what if the tools meant to protect us are being misused? Our latest study (to appear ARES '24) reveals surprising facts about HTTP Client Hints (HTTP CHs) on the Web. [THREAD]

Paper + Website: https://rbainfo.org/clienthints

swiefling,
@swiefling@hci.social avatar

HTTP CHs aim to replace the traditional user agent string (UAS) with privacy-by-default (i.e., servers have to explicitly request the information they like to get about your web browser). Although they are designed to enhance privacy, their real-world use paints a different picture. (2/n)

swiefling,
@swiefling@hci.social avatar

We analyzed the 8 million top websites to find out how they use HTTP CHs, particularly on login pages. The good? Websites using risk-based authentication now start using HTTP CHs to keep our user accounts safe. The bad? Worrying interconnections to third-party trackers requesting high-entropy data on many login pages. (3/n)

image/png

swiefling,
@swiefling@hci.social avatar

Switching from UAS to HTTP CHs can be a step towards more privacy. But with trackers and ad networks potentially exploiting this feature, it's time to rethink. Especially since at least 78% of desktop and 69% of mobile users are trackable with HTTP CHs.

It's time for a change. We need more control over our data and privacy-friendly default settings in browsers. (4/n)

Paper + Website: https://riskbasedauthentication.org/clienthints

swiefling,
@swiefling@hci.social avatar

@freddy At least @mozilla and seem to have a clear stance on HTTP client hints.

swiefling, to Cybersecurity German
@swiefling@hci.social avatar

Worried about account takeover? You're not alone! Attackers often misuse the "forgot password" mechanism to hack us.

Our latest study revealed a game-changer to counter this: Risk-Based Account Recovery! Platforms like Google now tailor recovery mechanisms based on your device and location context, making it hard for bad actors but easy for legitimate users.

Read more in our paper: https://riskbasedauthentication.org/state-of-practice/account-recovery/

Is It Really You Who Forgot the Password? When Account Recovery Meets Risk-Based Authentication Abstract Risk-based authentication (RBA) is used in online services to protect user accounts from unauthorized takeover. RBA commonly uses contextual features that indicate a suspicious login attempt when the characteristic attributes of the login context deviate from known and thus expected values. Previous research on RBA and anomaly detection in authentication has mainly focused on the login process. However, recent attacks have revealed vulnerabilities in other parts of the authentication process, specifically in the account recovery function. Consequently, to ensure comprehensive authentication security, the use of anomaly detection in the context of account recovery must also be investigated. This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild. We analyzed the adoption of RBAR by five prominent online services (that are known to use RBA). Our findings confirm the use of RBAR at Google, LinkedIn, and Amazon. Furthermore, we provide insights into the different RBAR mechanisms of these services and explore the impact of multi-factor authentication on them. Based on our findings, we create a first maturity model for RBAR challenges. The goal of our work is to help developers, administrators, and policy-makers gain an initial understanding of RBAR...

swiefling, to python
@swiefling@hci.social avatar

The third issue of our book "Programmieren trainieren" (Exercise programming) has just been released. It contains 150 coding exercises in Java and Python. One of them I was even given myself in a job interview at a well-known company. Therefore, this book might help to grow your coding skills.

This time, we have 20 new exercises and a foreword by game developer Kathrin Radtke (Spellgarden Games).

More information: https://protrain.github.io/

swiefling,
@swiefling@hci.social avatar

Wow, that was unexpected! Thanks to everyone for making our coding book #1 in the Amazon charts for Java and #6 for Python.

If you haven't bought it, you can still do so here: h
https://www.hanser-fachbuch.de/fachbuch/artikel/9783446477667

alarith, to random German
@alarith@hci.social avatar

Two personal updates: I have passed my defense yesterday at the University of Siegen! I am quite happy and relieved that everything worked well. Many thanks to my defense committee, Marc Hassenzahl, Susanne Boll, and Gunnar Stevens!

In other news I will start a postdoc position at the University of Tokyo in two weeks! I was accepted for this position a few months ago under the condition that I pass my defense, so I guess now it's official! 😊 I will work with Hideaki Kuzuoka and at Tokyo College

swiefling,
@swiefling@hci.social avatar

@alarith Congratulations!!

m33x, to random
@m33x@mastodon.social avatar

Super proud: Alexandra Nisenoff just presented our paper on password reuse at the university of Chicago at . This has been a 6 years long lasting effort. Very happy the paper has won a distinguished paper award 🥇
Summary: https://www.usenix.org/publications/loginonline/measuring-risk-password-reuse-poses-university
Full paper: https://www.usenix.org/conference/usenixsecurity23/presentation/nisenoff-retrospective

swiefling,
@swiefling@hci.social avatar

@m33x Congratulations, well deserved! The long work was worth it.

swiefling, to UX
@swiefling@hci.social avatar

My PhD thesis on the usability, security, and privacy of Risk-Based Authentication (RBA) is now published. For free, for everyone, as I believe that publicly funded research should be open to the public.

On 239 pages, you will learn how to strengthen password-based authentication with RBA while being privacy-enhanced and accepted by users.

Thesis PDF: https://doi.org/10.13154/294-9901

Defense Slides: https://www.stephanwiefling.de/slides/rba-thesis-defense23.pdf

Three softcover books of the dissertation "Usability, Security, and Privacy of Risk-Based Authentication" in front of a building showing the logo of Ruhr University Bochum on a sunny day.

swiefling,
@swiefling@hci.social avatar

@harney Still not too widespread in 2022 based on the replication study by Gavazzi et al. 1. You have to consider that this research work started in 2017, when RBA was not a public topic at all. We observed a greater public RBA awareness after Bruce Schneier blogged about our RBA usability study in 2020 2.

swiefling, to random
@swiefling@hci.social avatar

Happy to annouce that I successfully defended my doctoral thesis "Usability, Security, and Privacy of Risk-Based Authentication" at Ruhr University Bochum.

It started in 2017 with a study on RBA use on popular websites. Never thought that this would end in 7 publications, >125 citations, public recognition by people I'm a big fan of, a DAAD RISE Germany scholarship, an internship at Meta, and the Open Data Impact Award 2022.

swiefling,
@swiefling@hci.social avatar

@andresmh Thanks, also includes the very important RBA risk score from low (green) to high (red) on top

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • cubers
  • DreamBathrooms
  • tacticalgear
  • magazineikmin
  • mdbf
  • Youngstown
  • everett
  • slotface
  • ngwrru68w68
  • rosin
  • thenastyranch
  • kavyap
  • khanakhh
  • JUstTest
  • tester
  • InstantRegret
  • cisconetworking
  • Durango
  • ethstaker
  • osvaldo12
  • GTA5RPClips
  • modclub
  • Leos
  • provamag3
  • normalnudes
  • anitta
  • lostlight
  • All magazines
    •