As the Internet has transformed into a critical infrastructure, society has become more
vulnerable to its security flaws. Despite substantial efforts to address many of these …

Phishing is a form of deception technique that attackers often use to acquire sensitive
information related to individuals and organizations fraudulently. Although Phishing attacks …

As HTTPS deployment grows, middlebox and antivirus products are increasingly
intercepting TLS connections to retain visibility into network traffic. In this work, we present a …

The Transport Layer Security (TLS) protocol is the de-facto standard for encrypted
communication on the Internet. However, it has been plagued by a number of different …

Driven by CA compromises and the risk of man-in-the-middle attacks, new security features
have been added to TLS, HTTPS, and the web PKI over the past five years. These include …

Transport Layer Security (TLS), has become the de-facto standard for secure Internet
communication. When used correctly, it provides secure data transfer, but used incorrectly, it …

Internet-wide scanning is a commonly used research technique that has helped uncover
real-world attacks, find cryptographic weaknesses, and understand both operator and …

Certificate Authorities (CAs) regularly make mechanical errors when issuing certificates. To
quantify these errors, we introduce ZLint, a certificate linter that codifies the policies set forth …

The HTTPS certificate ecosystem has been of great interest to the measurement and security
communities. Without any ground truth, researchers have attempted to study this PKI from a …

Spear phishing has been a persistent threat to users and organizations, and yet email
providers still face key challenges to authenticate incoming emails. As a result, attackers can …