SoK: SSL and HTTPS: Revisiting Past Challenges and Evaluating Certificate Trust Model Enhancements

Why phishing works

Dhamija, R., Tygar, J. D., & Hearst, M. (2006) · Proceedings of the SIGCHI Conference on Human Factors in Computing Systems · doi:10.1145/1124772.1124861 · Cited by 1,376 · see citing works

The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes

Bonneau, J., Herley, C., Oorschot, P. C. V., & Stajano, F. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.44 · Cited by 1,110 · see citing works

A concrete security treatment of symmetric encryption

Mihir Bellare, Y., Desai, A., Jokipii, E., & Rogaway, P. (2002) · Annual Symposium on Foundations of Computer Science · doi:10.1109/sfcs.1997.646128 · Cited by 932 · see citing works

Remote timing attacks are practical

Brumley, D., & Boneh, D. (2005) · Computer Networks · doi:10.1016/j.comnet.2005.01.010 · Cited by 875 · see citing works

Parallel Collision Search with Cryptanalytic Applications

van Oorschot, P. C., & Wiener, M. J. (1999) · Journal of Cryptology · doi:10.1007/pl00003816 · Cited by 639 · see citing works

Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1

Bleichenbacher, D. (1998) · Lecture notes in computer science · doi:10.1007/bfb0055716 · Cited by 589 · see citing works

Why eve and mallory love android

Fahl, S., Harbach, M., Muders, T., Baumgärtner, L., Freisleben, B., & Smith, M. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382205 · Cited by 492 · see citing works

The battle against phishing

Dhamija, R., & Tygar, J. D. (2005) · doi:10.1145/1073001.1073009 · Cited by 446 · see citing works

SSL and TLS: Designing and Building Secure Systems

Rescorla, E. (2000) · Cited by 420 · see citing works

The most dangerous code in the world

Georgiev, M., Iyengar, S., Jana, S., Anubhai, R., Boneh, D., & Shmatikov, V. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382204 · Cited by 413 · see citing works

Cryptographic Extraction and Key Derivation: The HKDF Scheme

Krawczyk, H. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14623-7_34 · Cited by 411 · see citing works

The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?)

Krawczyk, H. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44647-8_19 · Cited by 395 · see citing works

Lucky Thirteen: Breaking the TLS and DTLS Record Protocols

Fardan, N. J. A., & Paterson, K. G. (2013) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2013.42 · Cited by 364 · see citing works

Analysis of the SSL 3.0 protocol

Wagner, D. A., & Schneier, B. (1996) · Cited by 351 · see citing works

Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices

Heninger, N., Durumeric, Z., Wustrow, E., & Halderman, J. A. (2013) · Cited by 346 · see citing works

Crying Wolf: An Empirical Study of SSL Warning Effectiveness

Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., & Cranor, L. F. (2018) · KiltHub Repository · doi:10.1184/r1/6621806 · Cited by 331 · see citing works

Security Flaws Induced by CBC Padding — Applications to SSL, IPSEC, WTLS...

Serge Vaudenay, B. (2002) · Lecture notes in computer science · doi:10.1007/3-540-46035-7_35 · Cited by 329 · see citing works

Remote Timing Attacks Are Still Practical

Brumley, B. B., & Tuveri, N. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-23822-2_20 · Cited by 241 · see citing works

Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing

Wendlandt, D., Andersen, D. G., & Perrig, A. (2018) · doi:10.1184/r1/6608366 · Cited by 236 · see citing works

On the Security of TLS-DHE in the Standard Model

Jager, T., Kohlar, F., Schäge, S., & Schwenk, J. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-32009-5_17 · Cited by 213 · see citing works

Phoolproof Phishing Prevention

Parno, B. J., Kuo, C., & Perrig, A. (2006) · Lecture notes in computer science · doi:10.1007/11889663_1 · Cited by 204 · see citing works

The SSL landscape

Holz, R., Braun, L., Kammenhuber, N., & Carle, G. (2011) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2068816.2068856 · Cited by 192 · see citing works

Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

Barker, E. B., & Roginsky, A. L. (2015) · doi:10.6028/nist.sp.800-131ar1 · Cited by 191 · see citing works

Password Interception in a SSL/TLS Channel

Canvel, B., Hiltgen, A. P., Serge Vaudenay, B., & Vuagnoux, M. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45146-4_34 · Cited by 182 · see citing works

Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate

Stevens, M., Sotirov, A., Appelbaum, J., Lenstra, A. K., Molnár, D., Osvik, D. A., & de Weger, B. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-03356-8_4 · Cited by 182 · see citing works

Can we eliminate certificate revocation lists?

Rivest, R. L. (1998) · Lecture notes in computer science · doi:10.1007/bfb0055482 · Cited by 180 · see citing works

Trusted paths for browsers

Ye, Z., Smith, S. W., & Anthony, D. (2005) · ACM Transactions on Information and System Security · doi:10.1145/1065545.1065546 · Cited by 175 · see citing works

When private keys are public

Yilek, S., Rescorla, E. K., Shacham, H., Enright, B., & Savage, S. (2009) · ACM Internet Measurement Conference (IMC) · doi:10.1145/1644893.1644896 · Cited by 165 · see citing works

The multi-principal OS construction of the gazelle web browser

Wang, H. J., Grier, C., Moshchuk, A., King, S. T., Choudhury, P., & Venter, H. (2009) · Cited by 164 · see citing works

Finite-state analysis of SSL 3.0

Mitchell, J. C., Shmatikov, V., & Stern, U. (1998) · Cited by 159 · see citing works

Chosen-Prefix Collisions for MD5 and Colliding X.509 Certificates for Different Identities

Stevens, M., Lenstra, A. K., & de Weger, B. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-72540-4_1 · Cited by 158 · see citing works

Inductive analysis of the Internet protocol TLS

Paulson, L. C. (1999) · ACM Transactions on Information and System Security · doi:10.1145/322510.322530 · Cited by 147 · see citing works

Man-in-the-Middle Attack

Desmedt, Y. (2006) · Springer eBooks · doi:10.1007/0-387-23483-7_241 · Cited by 141 · see citing works

Web Spoofing: An Internet Con Game

Felten, E. W., Balfanz, D., Dean, D., & Wallach, D. S. (1997) · Cited by 137 · see citing works

Users' conceptions of web security

Friedman, B., Hurley, D. A., Howe, D. C., Felten, E. W., & Nissenbaum, H. F. (2002) · CHI Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA) · doi:10.1145/506443.506577 · Cited by 124 · see citing works

An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks

Jackson, C., Simon, D. R., Tan, D. S., & Barth, A. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-77366-5_27 · Cited by 123 · see citing works

Gathering evidence: use of visual security cues in web browsers

Whalen, T., & Inkpen, K. M. (2005) · Cited by 121 · see citing works

A modular correctness proof of IEEE 802.11i and TLS

He, C., Sundararajan, M., Datta, A., Derek, A., & Mitchell, J. C. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102124 · Cited by 121 · see citing works

The Emperor's New Security Indicators An evaluation of website authentication and the effect of role playing on usability studies †

Schechter, S., Dhamija, R., Ozment, A., & Fischer, I. (2007) · Cited by 118 · see citing works

Certified Lies: Detecting and Defeating Government Interception Attacks against SSL (Short Paper)

Soghoian, C., & Stamm, S. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-27576-0_20 · Cited by 109 · see citing works

Cryptographically verified implementations for TLS

Bhargavan, K., Cédric Fournet, A., Corin, R., & Zălinescu, E. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455828 · Cited by 109 · see citing works

The Hitchhiker’s Guide to DNS Cache Poisoning

Son, S., & Shmatikov, V. (2010) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-642-16161-2_27 · Cited by 102 · see citing works

Certified Lies: Detecting and Defeating Government Interception Attacks Against SSLPreprint

Soghoian, C., & Stamm, S. (2010) · SSRN Electronic Journal · doi:10.2139/ssrn.1591033 · Cited by 98 · see citing works

Forcehttps

Jackson, C., & Barth, A. (2008) · International World Wide Web Conference (WWW) · doi:10.1145/1367497.1367569 · Cited by 95 · see citing works

Compression and Information Leakage of Plaintext

Kelsey, J. M. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45661-9_21 · Cited by 94 · see citing works

A Modular Security Analysis of the TLS Handshake Protocol

Morrissey, P., Smart, N. P., & Warinschi, B. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-89255-7_5 · Cited by 93 · see citing works

Ceremony Design and Analysis.

Ellison, C. M. (2007) · Cited by 93 · see citing works

Universally Composable Security Analysis of TLS

Gajek, S., Manulis, M., Pereira, O., Sadeghi, A., & Schwenk, J. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-88733-1_22 · Cited by 90 · see citing works

On the challenges in usable security lab studies

Sotirakopoulos, A., Hawkey, K., & Beznosov, K. (2011) · Symposium On Usable Privacy and Security · doi:10.1145/2078827.2078831 · Cited by 87 · see citing works

Public Keys

Lenstra, A. K., Hughes, J. P., Augier, M., Bos, J. W., Kleinjung, T., & Wachter, C. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-32009-5_37 · Cited by 79 · see citing works

SSL/TLS session-aware user authentication – Or how to effectively thwart the man-in-the-middle

Oppliger, R., Hauser, R. C., & Basin, D. (2006) · Computer Communications · doi:10.1016/j.comcom.2006.03.004 · Cited by 71 · see citing works

The Inconvenient Truth About Web Certificates

Vratonjić, N., Freudiger, J., Bindschaedler, V., & Hubaux, J. (2012) · Springer eBooks · doi:10.1007/978-1-4614-1981-5_5 · Cited by 70 · see citing works

Improving Brumley and Boneh timing attack on unprotected SSL implementations

Acıiçmez, O., Schindler, W., & Koç, Ç. K. (2005) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/1102120.1102140 · Cited by 69 · see citing works

A cross-protocol attack on the TLS protocol

Mavrogiannopoulos, N., Vercauteren, F., Velichkov, V., & Bart Preneel, A. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382206 · Cited by 66 · see citing works

Origin-bound certificates: a fresh approach to strong client authentication for the web

Dietz, M., Czeskis, A., Balfanz, D., & Wallach, D. S. (2012) · USENIX Security Symposium · Cited by 65 · see citing works

Trust No One Else: Detecting MITM Attacks against SSL/TLS without Third-Parties

Dacosta, I., Ahamad, M., & Traynor, P. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-33167-1_12 · Cited by 65 · see citing works

Transitions :

Barker, E. B., & Roginsky, A. L. (2011) · doi:10.6028/nist.sp.800-131a · Cited by 65 · see citing works

Cryptographic strength of ssl/tls servers

Lee, H. K., Malkin, T., & Nahum, E. (2007) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298318 · Cited by 63 · see citing works

Conditioned-safe ceremonies and a user study of an application to web authentication

Karlof, C., Tygar, J. D., & Wagner, D. (2009) · Symposium On Usable Privacy and Security · doi:10.1145/1572532.1572578 · Cited by 58 · see citing works

Revocation: Options and Challenges

Myers, M. D. (1998) · Financial Cryptography · Cited by 54 · see citing works

DoubleCheck: Multi-path verification against man-in-the-middle attacks

Alicherry, M., & Keromytis, A. D. (2009) · Proceedings - IEEE Symposium on Computers and Communications/IEEE Symposium on Computers and Communications · doi:10.1109/iscc.2009.5202224 · Cited by 54 · see citing works

On the Security of RSA Encryption in TLS

Jönsson, J., & Kaliski, B. S. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45708-9_9 · Cited by 52 · see citing works

PKI Layer Cake: New Collision Attacks against the Global X.509 Infrastructure

Kaminsky, D., Patterson, M. L., & Sassaman, L. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14577-3_22 · Cited by 52 · see citing works

On the security of TLS renegotiation

Giesen, F., Kohlar, F., & Stebila, D. (2013) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2508859.2516694 · Cited by 52 · see citing works

Certificate revocation: Mechanics and meaning

Fox, B. L., & LaMacchia, B. A. (1998) · Lecture notes in computer science · doi:10.1007/bfb0055479 · Cited by 50 · see citing works

A CHALLENGING BUT FEASIBLE BLOCKWISE-ADAPTIVE CHOSEN-PLAINTEXT ATTACK ON SSL

Bard, G. V. (2006) · International Conference on Security and Cryptography · doi:10.5220/0002104100990109 · Cited by 48 · see citing works

Exploring User Reactions to New Browser Cues for Extended Validation Certificates

Sobey, J., Biddle, R., van Oorschot, P. C., & Patrick, A. S. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-88313-5_27 · Cited by 45 · see citing works

Visual Spoofing of SSL Protected Web Sites and Effective Countermeasures

Adelsbach, A., Gajek, S., & Schwenk, J. (2005) · Lecture notes in computer science · doi:10.1007/978-3-540-31979-5_18 · Cited by 42 · see citing works

Deploying a New Hash Algorithm

Bellovin, S. M., & Rescorla, E. K. (2005) · doi:10.7916/d85149f0 · Cited by 42 · see citing works

Building Certifications Paths: Forward vs. Reverse.

Elley, Y., Anderson, A. H., Hanna, S., Mullan, S., Perlman, R., & Proctor, S. (2001) · Network and Distributed System Security Symposium · Cited by 41 · see citing works

The Vulnerability of SSL to Chosen Plaintext Attack.

Bard, G. V. (2004) · Cited by 40 · see citing works

Ceremony Analysis: Strengths and Weaknesses

Radke, K., Boyd, C., Nieto, J. G., & Brereton, M. F. (2011) · IFIP International Federation for Information Processing/IFIP · doi:10.1007/978-3-642-21424-0_9 · Cited by 32 · see citing works

Measuring SSL Indicators on Mobile Browsers: Extended Life, or End of the Road?

Amrutkar, C., Traynor, P., & van Oorschot, P. C. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-33383-5_6 · Cited by 29 · see citing works

Provably secure browser-based user-aware mutual authentication over TLS

Gajek, S., Manulis, M., Sadeghi, A., & Schwenk, J. (2008) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1368310.1368354 · Cited by 29 · see citing works

An empirical study of visual security cues to prevent the SSLstripping attack

Shin, D., & Lopes, R. (2011) · Annual Computer Security Applications Conference · doi:10.1145/2076732.2076773 · Cited by 26 · see citing works

Revocatoin: Options and challenges

Myers, M. D. (1998) · Lecture notes in computer science · doi:10.1007/bfb0055480 · Cited by 25 · see citing works

Two Years of Broken Crypto: Debian's Dress Rehearsal for a Global PKI Compromise

Ahmad, D. (2008) · IEEE Security & Privacy · doi:10.1109/msp.2008.131 · Cited by 21 · see citing works

Reinforcing bad behaviour

Stebila, D. (2010) · Australian Conference on Computer-Human Interaction (OzCHI) · doi:10.1145/1952222.1952275 · Cited by 20 · see citing works

Cut-&-Paste Attacks with JAVA

Lefranc, S., & Naccache, D. (2003) · Lecture notes in computer science · doi:10.1007/3-540-36552-4_1 · Cited by 9 · see citing works

Sub-Prime PKI: Attacking Extended Validation SSL

Zusman, M., & Sotirov, A. (2009) · Cited by 5 · see citing works

Stone Knives and Bear Skins: Why Does the Internet Run on Pre-historic Cryptography?

Rescorla, E. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-25578-6_24 · Cited by 2 · see citing works

Web Sites Should Not Need to Rely On Users to Secure Communications

Ozment, A., Schechter, S. E., & Dhamija, R. (2006) · Cited by 1 · see citing works

Beyond the Basics of HTTPS Serving.

Langley, A. (2011) · Cited by 1 · see citing works

On the Security of TLS Renegotiation.

Giesen, F., Kohlar, F., & Stebila, D. (2012) · QUT ePrints (Queensland University of Technology) · Cited by 1 · see citing works

A Survey of Man in the Middle Attacks

Conti, M., Dragoni, N., & Lesyk, V. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2016.2548426 · Cited by 724 · see citing works

SoK: Security Evaluation of Home-Based IoT Deployments

Alrawi, O., Lever, C., Antonakakis, M., & Monrose, F. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00013 · Cited by 405 · see citing works

Cyber security: State of the art, challenges and future directions

Admass, W. S., Munaye, Y. Y., & Diro, A. A. (2023) · Cyber Security and Applications · doi:10.1016/j.csa.2023.100031 · Cited by 302 · see citing works

Datanet: Deep Learning Based Encrypted Network Traffic Classification in SDN Home Gateway

Wang, P., Ye, F., Chen, X., & Qian, Y. (2018) · IEEE Access · doi:10.1109/access.2018.2872430 · Cited by 257 · see citing works

Keeping Authorities “Honest or Bust” with Decentralized Witness Cosigning

Syta, E., Tamas, I., Visher, D., Wolinsky, D. I., Jovanovic, P., Gasser, L., Gailly, N., Khoffi, I., & Ford, B. (2016) · Infoscience (Ecole Polytechnique Fédérale de Lausanne) · doi:10.1109/sp.2016.38 · Cited by 253 · see citing works

Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations

Brubaker, C., Jana, S., Ray, B., Khurshid, S., & Shmatikov, V. (2014) · 2014 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2014.15 · Cited by 218 · see citing works

Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS

Bhargavan, K., Lavaud, A. D., Fournet, C., Pironti, A., & Strub, P. Y. (2014) · 2014 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2014.14 · Cited by 173 · see citing works

SoK: Secure Messaging

Unger, N., Dechand, S., Bonneau, J., Fahl, S., Perl, H., Goldberg, I., & Smith, M. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.22 · Cited by 171 · see citing works

SMV-HUNTER: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps

Sounthiraraj, D., Sahs, J., Greenwood, G., Lin, Z., & Khan, L. R. (2014) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23205 · Cited by 154 · see citing works

What the App is That? Deception and Countermeasures in the Android User Interface

Bianchi, A., Corbetta, J., Invernizzi, L., Fratantonio, Y., Kruegel, C., & Vigna, G. (2015) · 2015 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2015.62 · Cited by 147 · see citing works

SoK: Computer-Aided Cryptography

Barbosa, M., Barthe, G., Bhargavan, K., Blanchet, B., Cremers, C., Liao, K., & Parno, B. (2021) · 2021 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40001.2021.00008 · Cited by 143 · see citing works

Enhanced Certificate Transparency and End-to-End Encrypted Mail

Ryan, M. D. (2014) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23379 · Cited by 139 · see citing works

Post-Quantum Cryptosystems for Internet-of-Things: A Survey on Lattice-Based Algorithms

Asif, R. (2021) · IoT · doi:10.3390/iot2010005 · Cited by 156 · see citing works

CryptoGuard

Rahaman, S., Xiao, Y., Afrose, S., Shaon, F., Tian, K., Frantz, M., Kantarcıoğlu, M., & Yao, D. D. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3345659 · Cited by 136 · see citing works

Blockchain-Based Certificate Transparency and Revocation Transparency

Wang, Z., Lin, J., Cai, Q., Wang, Q., Zha, D., & Jing, J. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.2983022 · Cited by 130 · see citing works

How Secure and Quick is QUIC? Provable Security and Performance Analyses

Lychev, R., Jero, S., Boldyreva, A., & Nita-Rotaru, C. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.21 · Cited by 111 · see citing works

When HTTPS Meets CDN: A Case of Authentication in Delegated Service

Liang, J., Jiang, J. W., Duan, H., Li, K., Wan, T., & Wu, J. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.12 · Cited by 109 · see citing works

World-Driven Access Control for Continuous Sensing

Roesner, F., Molnár, D., Moshchuk, A., Kohno, T., & Wang, H. J. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660319 · Cited by 104 · see citing works

The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information

Sivakorn, S., Polakis, I., & Keromytis, A. D. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.49 · Cited by 100 · see citing works

Cybersecurity Challenges Associated With the Internet of Things in a Post-Quantum World

Althobaiti, O. S., & Döhler, M. (2020) · IEEE Access · doi:10.1109/access.2020.3019345 · Cited by 100 · see citing works

Upgrading HTTPS in mid-air: An Empirical Study of Strict Transport Security and Key Pinning

Kranch, M. J., & Bonneau, J. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23162 · Cited by 92 · see citing works

Studying TLS Usage in Android Apps

Razaghpanah, A., Niaki, A. A., Vallina-Rodríguez, N., Sundaresan, S., Amann, J., & Gill, P. (2017) · Conference on Emerging Network Experiment and Technology · doi:10.1145/3143361.3143400 · Cited by 26 · see citing works

Mission accomplished?

Amann, J., Gasser, O., Scheitle, Q., Brent, L., Carle, G., & Holz, R. (2017) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3131365.3131401 · Cited by 85 · see citing works

Systematizing Decentralization and Privacy: Lessons from 15 Years of Research and Deployments

Troncoso, C., Isaakidis, M., Danezis, G., & Halpin, H. (2017) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2017-0056 · Cited by 88 · see citing works

PoliCert

Szałachowski, P., Matsumoto, S., & Perrig, A. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660355 · Cited by 76 · see citing works

Coming of Age

Kotzias, P., Razaghpanah, A., Amann, J., Paterson, K. G., Vallina-Rodríguez, N., & Caballero, J. (2018) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3278532.3278568 · Cited by 75 · see citing works

SoK

Eskandari, S., Salehi, M., Gu, W. C., & Clark, J. (2021) · ACM Conference on Advances in Financial Technologies (AFT) · doi:10.1145/3479722.3480994 · Cited by 82 · see citing works

Modelling Analysis and Auto-detection of Cryptographic Misuse in Android Applications

Shao, S., Guowei, D., Tao, G., Tianchang, Y., & Chenjie, S. (2014) · IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/dasc.2014.22 · Cited by 73 · see citing works

HVLearn: Automated Black-Box Analysis of Hostname Verification in SSL/TLS Implementations

Sivakorn, S., Argyros, G., Pei, K., Keromytis, A. D., & Jana, S. (2017) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2017.46 · Cited by 73 · see citing works

A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3

Kohlios, C. P., & Hayajneh, T. (2018) · Electronics · doi:10.3390/electronics7110284 · Cited by 77 · see citing works

Efficient gossip protocols for verifying the consistency of Certificate logs

Chuat, L., Szałachowski, P., Perrig, A., Laurie, B., & Messeri, E. (2015) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2015.7346853 · Cited by 71 · see citing works

A First Look at Certification Authority Authorization (CAA)

Scheitle, Q., Chung, T., Hiller, J., Gasser, O., Naab, J., van Rijswijk-Deij, R., Hohlfeld, O., Holz, R., Choffnes, D., Mislove, A. E., et al. (2018) · ACM SIGCOMM Computer Communication Review · doi:10.1145/3213232.3213235 · Cited by 70 · see citing works

Blockchain-Based Certificate Transparency and Revocation Transparency

Wang, Z., Lin, J., Cai, Q., Wang, Q., Jing, J., & Zha, D. (2019) · Lecture notes in computer science · doi:10.1007/978-3-662-58820-8_11 · Cited by 69 · see citing works

Remotegrity: Design and Use of an End-to-End Verifiable Remote Voting System

Zagórski, F., Carback, R., Chaum, D., Clark, J., Essex, A., & Vora, P. L. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-38980-1_28 · Cited by 69 · see citing works

Killed by Proxy: Analyzing Client-end TLS Interception Software

de Carnavalet, X. D. C., & Mannan, M. (2016) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23374 · Cited by 69 · see citing works

Survivable zero trust for cloud computing environments

Ferretti, L., Magnanini, F., Andreolini, M., & Colajanni, M. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102419 · Cited by 69 · see citing works

Understanding the Evolution of Android App Vulnerabilities

Gao, J., Li, L., Kong, P., Bissyandé, T. F., & Klein, J. (2019) · IEEE Transactions on Reliability · doi:10.1109/tr.2019.2956690 · Cited by 61 · see citing works

"Alexa, stop spying on me!"

Sun, K., Chen, C., & Zhang, X. (2020) · ACM Conference on Embedded Networked Sensor Systems (SenSys) · doi:10.1145/3384419.3430727 · Cited by 61 · see citing works

PQCAIE: Post quantum cryptographic authentication scheme for IoT-based e-health systems

Mansoor, K., Afzal, M., Iqbal, W., Abbas, Y., Mussiraliyeva, S., & Chehri, A. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101228 · Cited by 59 · see citing works

Vetting SSL Usage in Applications with SSLINT

He, B., Rastogi, V., Cao, Y., Chen, Y., Venkatakrishnan, V. N., Yang, R., & Zhang, Z. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.38 · Cited by 59 · see citing works

A Survey on X.509 Public-Key Infrastructure, Certificate Revocation, and Their Modern Implementation on Blockchain and Ledger Technologies

Khan, S., Luo, F., Zhang, Z., Ullah, F., Amin, F., Qadri, S. F., Heyat, M. B. B., Ruby, R., Wang, L., Ullah, S., et al. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3323640 · Cited by 58 · see citing works

STACCO

Xiao, Y., Li, M., Chen, S., & Zhang, Y. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134016 · Cited by 57 · see citing works

TLS/PKI Challenges and Certificate Pinning Techniques for IoT and M2M Secure Communications

Díaz-Sánchez, D., Marín, A., Almenárez, F., Arias-Cabarcos, P., & Sherratt, R. S. (2019) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2019.2914453 · Cited by 57 · see citing works

Tracking the deployment of TLS 1.3 on the web

Holz, R., Hiller, J., Amann, J., Razaghpanah, A., Jost, T., Vallina-Rodríguez, N., & Hohlfeld, O. (2020) · ACM SIGCOMM Computer Communication Review · doi:10.1145/3411740.3411742 · Cited by 57 · see citing works

DTKI: A New Formalized PKI with Verifiable Trusted Parties

Yu, J., Cheval, V., & Ryan, M. D. (2016) · The Computer Journal · doi:10.1093/comjnl/bxw039 · Cited by 57 · see citing works

Cinderella: Turning Shabby X.509 Certificates into Elegant Anonymous Credentials with the Magic of Verifiable Computation

Delignat-Lavaud, A., Cédric Fournet, A., Kohlweiss, M., & Parno, B. J. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.22 · Cited by 56 · see citing works

TLS Proxies

O'Neill, M., Ruoti, S., Seamons, K. E., & Zappala, D. (2016) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2987443.2987488 · Cited by 54 · see citing works

Certificate Transparency with Privacy

Eskandarian, S., Messeri, E., Bonneau, J., & Boneh, D. (2017) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2017-0052 · Cited by 50 · see citing works

How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security

Stock, B., Johns, M., Steffens, M., & Michael Backes, A. (2017) · Publications of the UdS (Saarland University) · doi:10.22028/d291-47403 · Cited by 47 · see citing works

"I have no idea what i'm doing": on the usability of deploying HTTPS

Krombholz, K., Mayer, W., Schmiedecker, M., & Weippl, E. R. (2017) · USENIX Security Symposium · Cited by 45 · see citing works

Deniable Key Exchanges for Secure Messaging

Unger, N., & Goldberg, I. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2813616 · Cited by 46 · see citing works

In Log We Trust: Revealing Poor Security Practices with Certificate Transparency Logs and Internet Measurements

Gasser, O., Hof, B., Helm, M., Korczyński, M., Holz, R., & Carle, G. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-76481-8_13 · Cited by 44 · see citing works

Identifying vulnerabilities of SSL/TLS certificate verification in Android apps with static and dynamic analysis

Wang, Y., Xu, G., Liu, X., Mao, W., Si, C., Pedrycz, W., & Wang, W. (2020) · Journal of Systems and Software · doi:10.1016/j.jss.2020.110609 · Cited by 43 · see citing works

A technique to circumvent SSL/TLS validations on iOS devices

D’Orazio, C., & Choo, K. R. (2016) · Future Generation Computer Systems · doi:10.1016/j.future.2016.08.019 · Cited by 42 · see citing works

A global perspective on an emotional learning model proposal

Faria, A. R., Almeida, A. M. L., Martins, C. L., Gonçalves, R., Martins, J., & Branco, F. (2016) · Telematics and Informatics · doi:10.1016/j.tele.2016.08.007 · Cited by 42 · see citing works

Regulating ARM TrustZone Devices in Restricted Spaces

Brasser, F., Kim, D.-Y., Liebchen, C., Ganapathy, V., Iftode, L., & Sadeghi, A. (2016) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/2906388.2906390 · Cited by 41 · see citing works

Automatically Detecting Error Handling Bugs Using Error Specifications

Jana, S., Kang, Y., Roth, S., & Ray, B. (2016) · USENIX Security Symposium · Cited by 40 · see citing works

Does Certificate Transparency Break the Web? Measuring Adoption and Error Rate

Stark, E., Sleevi, R., Muminovic, R., O’Brien, D., Messeri, E., Felt, A. P., McMillion, B., & Tabriz, P. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00027 · Cited by 40 · see citing works

Security of Open Radio Access Networks

Mimran, D., Bitton, R., Kfir, Y., Klevansky, E., Brodt, O., Lehmann, H., Elovici, Y., & Shabtai, A. (2022) · Computers & Security · doi:10.1016/j.cose.2022.102890 · Cited by 38 · see citing works

A Survey and Analysis of TLS Interception Mechanisms and Motivations: Exploring how end-to-end TLS is made “end-to-me” for web traffic

de Carnavalet, X. D. C., & van Oorschot, P. (2020) · ACM Computing Surveys · doi:10.1145/3580522 · Cited by 31 · see citing works

Securing SSL Certificate Verification through Dynamic Linking

Bates, A., Pletcher, J., Nichols, T., Hollembaek, B., Tian, D. J., Butler, K. R. B., & Alkhelaifi, A. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660338 · Cited by 37 · see citing works

Efficient, Scalable, and Resilient Vehicle-Centric Certificate Revocation List Distribution in VANETs

Khodaei, M., & Papadimitratos, P. (2018) · ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) · doi:10.1145/3212480.3212481 · Cited by 37 · see citing works

No attack necessary

Amann, J., Sommer, R., Vallentin, M., & Hall, S. (2013) · Annual Computer Security Applications Conference · doi:10.1145/2523649.2523665 · Cited by 37 · see citing works

On the effective prevention of TLS man-in-the-middle attacks in web applications

Karapanos, N., & Čapkun, S. (2014) · Cited by 36 · see citing works

Taxonomy of cyber security metrics to measure strength of cyber security

Bhol, S. G., Mohanty, J., & Pattnaik, P. K. (2021) · Materials Today Proceedings · doi:10.1016/j.matpr.2021.06.228 · Cited by 36 · see citing works

Weighing Context and Trade-offs: How Suburban Adults Selected Their Online Security Posture.

Ruoti, S., Monson, T., Wu, J., Zappala, D., & Seamons, K. E. (2017) · Symposium On Usable Privacy and Security · Cited by 34 · see citing works

Efficiently bypassing SNI-based HTTPS filtering

Shbair, W. M., Cholez, T., Goichot, A., & Chrisment, I. (2015) · IFIP/IEEE International Symposium on Integrated Network Management (IM) · doi:10.1109/inm.2015.7140423 · Cited by 31 · see citing works

The Lifetime of Android API Vulnerabilities: Case Study on the JavaScript-to-Java Interface

Thomas, D., Beresford, A. R., Coudray, T., Sutcliffe, T., & Taylor, A. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26096-9_13 · Cited by 30 · see citing works

SoK: Delegation and Revocation, the Missing Links in the Web's Chain of Trust

Chuat, L., Abdou, A., Sasse, R., Sprenger, C., Basin, D., & Perrig, A. (2020) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp48549.2020.00046 · Cited by 30 · see citing works

An Adversary-Centric Behavior Modeling of DDoS Attacks

Wang, A., Mohaisen, A., & Chen, S. (2017) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2017.213 · Cited by 29 · see citing works

A Dangerous Mix: Large-Scale Analysis of Mixed-Content Websites

Chen, P., Nikiforakis, N., Huygens, C., & Desmet, L. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-27659-5_25 · Cited by 29 · see citing works

What’s in a Downgrade? A Taxonomy of Downgrade Attacks in the TLS Protocol and Application Protocols Using TLS

Alashwali, E. S., & Rasmussen, K. (2018) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-030-01704-0_27 · Cited by 27 · see citing works

Vulnerability Prioritization, Root Cause Analysis, and Mitigation of Secure Data Analytic Framework Implemented with MongoDB on Singularity Linux Containers

Mailewa, A. B., Mengel, S. A., Gittner, L. S., & Khan, H. (2020) · International Conference on Compute and Data Analysis (ICCDA) · doi:10.1145/3388142.3388168 · Cited by 25 · see citing works

A Survey on TLS-Encrypted Malware Network Traffic Analysis Applicable to Security Operations Centers

Oh, C., Ha, J., & Roh, H. (2021) · Applied Sciences · doi:10.3390/app12010155 · Cited by 25 · see citing works

Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates

Borgolte, K., Fiebig, T., Hao, S., Kruegel, C., & Vigna, G. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23327 · Cited by 25 · see citing works

Laribus: privacy-preserving detection of fake SSL certificates with a social P2P notary network

Fuchs, K.-P., Herrmann, D., Micheloni, A., & Federrath, H. (2015) · EURASIP Journal on Information Security · doi:10.1186/s13635-014-0018-0 · Cited by 22 · see citing works

Forced Perspectives

Bates, A., Pletcher, J., Nichols, T., Hollembaek, B., & Butler, K. R. B. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663759 · Cited by 22 · see citing works

No Need for Black Chambers: Testing TLS in the E-mail Ecosystem at Large

Mayer, W., Zauner, A., Schmiedecker, M., & Huber, M. (2016) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2016.11 · Cited by 22 · see citing works

Measuring Popularity of Cryptographic Libraries in Internet-Wide Scans

Nemec, M., Klinec, D., Švenda, P., Sekan, P., & Matyáš, V. (2017) · Annual Computer Security Applications Conference · doi:10.1145/3134600.3134612 · Cited by 22 · see citing works

Scaling pseudonymous authentication for large mobile systems

Khodaei, M., Noroozi, H., & Papadimitratos, P. (2019) · ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) · doi:10.1145/3317549.3323410 · Cited by 22 · see citing works

A Polynomial-Time Key-Recovery Attack on MQQ Cryptosystems

Faugère, J., Gligoroski, D., Perret, L., Samardjiska, S., & Thomae, E. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-46447-2_7 · Cited by 22 · see citing works

Designing Media Provenance Indicators to Combat Fake Media

Sherman, I. N., Stokes, J. W., & Redmiles, E. M. (2021) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3471621.3471860 · Cited by 21 · see citing works

Automatically Detecting SSL Error-Handling Vulnerabilities in Hybrid Mobile Web Apps

Zuo, C., Wu, J., & Guo, S. (2015) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/2714576.2714583 · Cited by 20 · see citing works

Tracing your roots

Ma, Z., Austgen, J., Mason, J., Durumeric, Z., & Bailey, M. (2021) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3487552.3487813 · Cited by 20 · see citing works

Server-Side Adoption of Certificate Transparency

Nykvist, C., Sjöström, L., Gustafsson, J., & Carlsson, N. F. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-76481-8_14 · Cited by 20 · see citing works

Education Degree Fraud Detection and Student Certificate Verification using Blockchain

Dongre, J. G. (2020) · International Journal of Engineering Research and · doi:10.17577/ijertv9is070156 · Cited by 20 · see citing works

Uncovering Security Vulnerabilities in the Belkin WeMo Home Automation Ecosystem

Liu, H., Spink, T., & Patras, P. (2019) · IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops) · doi:10.1109/percomw.2019.8730685 · Cited by 18 · see citing works

A large-scale analysis of HTTPS deployments: Challenges, solutions, and recommendations

Hu, Q., Asghar, M. R., & Brownlee, N. (2020) · Journal of Computer Security · doi:10.3233/jcs-200070 · Cited by 18 · see citing works

A Usability Evaluation of Let's Encrypt and Certbot

Tiefenau, C., von Zezschwitz, E., Häring, M., Krombholz, K., & Smith, M. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363220 · Cited by 21 · see citing works

Mathematical Attack of RSA by Extending the Sum of Squares of Primes to Factorize a Semi-Prime

Overmars, A., & Venkatraman, S. (2020) · Mathematical and Computational Applications · doi:10.3390/mca25040063 · Cited by 16 · see citing works

Security Implications of Redirection Trail in Popular Websites Worldwide

Chang, L., Hsiao, H., Jeng, W., Kim, T. H., & Lin, W.-H. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052698 · Cited by 16 · see citing works

SoK: Securing Email—A Stakeholder-Based Analysis

Clark, J., van Oorschot, P. C., Ruoti, S., Seamons, K. E., & Zappala, D. (2021) · Lecture notes in computer science · doi:10.1007/978-3-662-64322-8_18 · Cited by 15 · see citing works

Understanding Smartphone Sensor and App Data for Enhancing the Security of Secret Questions

Zhao, P., Bian, K., Zhao, T., Song, X., Park, J.-M. J., Li, X., Ye, F., & Yan, W. (2016) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2016.2546245 · Cited by 16 · see citing works

Accept the Risk and Continue

Singanamalla, S., Jang, E., Anderson, R., Kohno, T., & Heimerl, K. (2020) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3419394.3423645 · Cited by 15 · see citing works

Generating Correlated Digital Certificates: Framework and Applications

Zhu, W., & Lin, J. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2016.2516818 · Cited by 15 · see citing works

Mitigating man-in-the-middle attacks on smartphones – a discussion of SSL pinning and DNSSec

Moonsamy, V., & Batten, L. (2014) · doi:10.4225/75/57b65a25343ce · Cited by 14 · see citing works

Server Location Verification (SLV) and Server Location Pinning

Abdou, A., & van Oorschot, P. C. (2017) · ACM Transactions on Privacy and Security · doi:10.1145/3139294 · Cited by 14 · see citing works

Shedding Light on the Adoption of Let's Encrypt

Manousis, A., Ragsdale, R., Draffin, B., Agrawal, A., & Sekar, V. (2016) · arXiv · doi:10.48550/arxiv.1611.00469 · Cited by 14 · see citing works

An automatically vetting mechanism for SSL error-handling vulnerability in android hybrid Web apps

Liu, Y., Zuo, C., Zhang, Z., Guo, S., & Xu, X.-S. (2017) · World Wide Web · doi:10.1007/s11280-017-0458-9 · Cited by 13 · see citing works

Checks and balances: A tripartite public key infrastructure for secure web-based connections

Chen, J., Yao, S., Yuan, Q., Du, R., & Xue, G. (2017) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2017.8057201 · Cited by 13 · see citing works

Characterizing the HTTPS Trust Landscape: A Passive View from the Edge

Ouvrier, G., Laterman, M., Arlitt, M. F., & Carlsson, N. F. (2017) · IEEE Communications Magazine · doi:10.1109/mcom.2017.1600981 · Cited by 20 · see citing works

Certificate Authority Collapse: Regulating Systemic Vulnerabilities in the HTTPS Value ChainPreprint

Arnbak, A., & van Eijk, N. (2012) · SSRN Electronic Journal · doi:10.2139/ssrn.2031409 · Cited by 29 · see citing works

You Won’t Be Needing These Any More: On Removing Unused Certificates from Trust Stores

Perl, H., Fahl, S., & Smith, M. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-45472-5_20 · Cited by 34 · see citing works

Analysis of the HTTPS certificate ecosystem

Durumeric, Z., Kasten, J., Bailey, M., & Halderman, J. A. (2013) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2504730.2504755 · Cited by 294 · see citing works

Server Authentication on the Past, Present, and Future Internet.

Kasten Jr., J. D. (2015) · Deep Blue (University of Michigan)