literature:bibliography
@InProceedings{LePochat2019_tranco,
author = {{Le Pochat}, Victor and {Van Goethem}, Tom and Tajalizadehkhoob, Samaneh and Korczy\'{n}ski, Maciej and Joosen, Wouter},
title = {Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation},
booktitle = {Proceedings of the 26th Annual Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
month = 2,
doi = {10.14722/ndss.2019.23386},
}
@InProceedings{ruth2022_toppling,
author = {Ruth, Kimberly and Kumar, Deepak and Wang, Brandon and Valenta, Luke and Durumeric, Zakir},
title = {Toppling Top Lists: Evaluating the Accuracy of Popular Website Lists},
booktitle = {Proceedings of the 22nd ACM Internet Measurement Conference},
year = {2022},
series = {IMC '22},
pages = {374–387},
address = {New York, NY, USA},
publisher = {Association for Computing Machinery},
doi = {10.1145/3517745.3561444},
isbn = {9781450392594},
location = {Nice, France},
numpages = {14},
url = {https://doi.org/10.1145/3517745.3561444},
}
@inproceedings{xie2024_crawling,
title={Crawling to the Top: An Empirical Evaluation of Top List Use},
author={Xie, Qinge and Li, Frank},
booktitle={International Conference on Passive and Active Network Measurement},
pages={277--306},
year={2024},
organization={Springer}
}
@inproceedings{scheitle2018_long,
author = {Scheitle, Quirin and Hohlfeld, Oliver and Gamba, Julien and Jelten, Jonas and Zimmermann, Torsten and Strowes, Stephen D. and Vallina-Rodriguez, Narseo},
title = {A Long Way to the Top: Significance, Structure, and Stability of Internet Top Lists},
year = {2018},
isbn = {9781450356190},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3278532.3278574},
doi = {10.1145/3278532.3278574},
booktitle = {Proceedings of the Internet Measurement Conference 2018},
pages = {478–493},
numpages = {16},
location = {Boston, MA, USA},
series = {IMC '18}
}
@inproceedings{xie2022_building,
title={Building an Open, Robust, and Stable Voting-Based Domain Top List},
author={Xie, Qinge and Tang, Shujun and Zheng, Xiaofeng and Lin, Qingran and Liu, Baojun and Duan, Haixin and Li, Frank},
booktitle={31st USENIX Security Symposium (USENIX Security 22)},
pages={625--642},
year={2022}
}
@inproceedings{vallina2020_misshapes,
author = {Vallina, Pelayo and Le Pochat, Victor and Feal, \'{A}lvaro and Paraschiv, Marius and Gamba, Julien and Burke, Tim and Hohlfeld, Oliver and Tapiador, Juan and Vallina-Rodriguez, Narseo},
title = {Mis-shapes, Mistakes, Misfits: An Analysis of Domain Classification Services},
year = {2020},
isbn = {9781450381383},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3419394.3423660},
doi = {10.1145/3419394.3423660},
abstract = {Domain classification services have applications in multiple areas, including cybersecurity, content blocking, and targeted advertising. Yet, these services are often a black box in terms of their methodology to classifying domains, which makes it difficult to assess their strengths, aptness for specific applications, and limitations. In this work, we perform a large-scale analysis of 13 popular domain classification services on more than 4.4M hostnames. Our study empirically explores their methodologies, scalability limitations, label constellations, and their suitability to academic research as well as other practical applications such as content filtering. We find that the coverage varies enormously across providers, ranging from over 90\% to below 1\%. All services deviate from their documented taxonomy, hampering sound usage for research. Further, labels are highly inconsistent across providers, who show little agreement over domains, making it difficult to compare or combine these services. We also show how the dynamics of crowd-sourced efforts may be obstructed by scalability and coverage aspects as well as subjective disagreements among human labelers. Finally, through case studies, we showcase that most services are not fit for detecting specialized content for research or content-blocking purposes. We conclude with actionable recommendations on their usage based on our empirical insights and experience. Particularly, we focus on how users should handle the significant disparities observed across services both in technical solutions and in research.},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
pages = {598–618},
numpages = {21},
location = {Virtual Event, USA},
series = {IMC '20}
}
@article{snyder2020_who,
author = {Snyder, Peter and Vastel, Antoine and Livshits, Ben},
title = {Who Filters the Filters: Understanding the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking},
year = {2020},
issue_date = {June 2020},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {4},
number = {2},
url = {https://doi.org/10.1145/3392144},
doi = {10.1145/3392144},
journal = {Proc. ACM Meas. Anal. Comput. Syst.},
month = jun,
articleno = {26},
numpages = {24},
keywords = {web privacy, web measurement, filter lists, easylist}
}
@inproceedings{iqbal2020_adgraph,
author={Iqbal, Umar and Snyder, Peter and Zhu, Shitong and Livshits, Benjamin and Qian, Zhiyun and Shafiq, Zubair},
booktitle={2020 IEEE Symposium on Security and Privacy (SP)},
title={AdGraph: A Graph-Based Approach to Ad and Tracker Blocking},
year={2020},
volume={},
number={},
pages={763-776},
keywords={Advertising;Chromium;Uniform resource locators;Browsers;Privacy;Tools;Robustness},
doi={10.1109/SP40000.2020.00005}
}
@inproceedings{siby2022_webgraph,
author = {Sandra Siby and Umar Iqbal and Steven Englehardt and Zubair Shafiq and Carmela Troncoso},
title = {{WebGraph}: Capturing Advertising and Tracking Information Flows for Robust Blocking},
booktitle = {31st USENIX Security Symposium (USENIX Security 22)},
year = {2022},
isbn = {978-1-939133-31-1},
address = {Boston, MA},
pages = {2875--2892},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/siby},
publisher = {USENIX Association},
month = aug
}
@inproceedings{iqbal2022_khaleesi,
author = {Umar Iqbal and Charlie Wolfe and Charles Nguyen and Steven Englehardt and Zubair Shafiq},
title = {Khaleesi: Breaker of Advertising and Tracking Request Chains},
booktitle = {31st USENIX Security Symposium (USENIX Security 22)},
year = {2022},
isbn = {978-1-939133-31-1},
address = {Boston, MA},
pages = {2911--2928},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/iqbal},
publisher = {USENIX Association},
month = aug
}
@article{mhaidli2023researchers,
title={Researchers’ Experiences in Analyzing Privacy Policies: Challenges and Opportunities},
author={Mhaidli, Abraham and Fidan, Selin and Doan, An and Herakovic, Gina and Srinath, Mukund and Matheson, Lee and Wilson, Shomir and Schaub, Florian},
journal={Proceedings on Privacy Enhancing Technologies},
issue={4},
number={},
volume={2023},
pages={287--305},
year={2023},
doi={10.56553/popets-2023-0111},
url={https://petsymposium.org/popets/2023/popets-2023-0111.php},
}
@article{hosseini2021unifying,
title={Unifying privacy policy detection},
author={Hosseini, Henry and Degeling, Martin and Utz, Christine and Hupperich, Thomas},
journal={Proceedings on Privacy Enhancing Technologies},
doi={10.2478/popets-2021-0081},
issue={4},
volume={2021},
pages={480–499},
year={2021}
}
@inproceedings{roesner2012_detecting,
author = {Franziska Roesner and Tadayoshi Kohno and David Wetherall},
title = {Detecting and Defending Against {Third-Party} Tracking on the Web},
booktitle = {9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12)},
year = {2012},
isbn = {978-931971-92-8},
address = {San Jose, CA},
pages = {155--168},
url = {https://www.usenix.org/conference/nsdi12/technical-sessions/presentation/roesner},
publisher = {USENIX Association},
month = apr
}
@article{solomos2019_clash,
title={Clash of the trackers: Measuring the evolution of the online tracking ecosystem},
author={Solomos, Konstantinos and Ilia, Panagiotis and Ioannidis, Sotiris and Kourtellis, Nicolas},
booktitle = {Measurement and Analysis Conference (TMA'20)},
publisher = {IFIP Open Digital Library},
isbn = {978-3-903176-27-0},
year={2020},
address = {Berlin, Germany},
}
@inproceedings{sanchezrola2019can,
author = {Sanchez-Rola, Iskander and Dell'Amico, Matteo and Kotzias, Platon and Balzarotti, Davide and Bilge, Leyla and Vervier, Pierre-Antoine and Santos, Igor},
title = {Can I Opt Out Yet? GDPR and the Global Illusion of Cookie Control},
year = {2019},
isbn = {9781450367523},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3321705.3329806},
doi = {10.1145/3321705.3329806},
pages = {340–351},
numpages = {12},
keywords = {GDPR, browser cookies, user privacy},
location = {Auckland, New Zealand},
series = {Asia CCS '19}
}
@article{calzavara2015supervised,
author = {Calzavara, Stefano and Tolomei, Gabriele and Casini, Andrea and Bugliesi, Michele and Orlando, Salvatore},
title = {A Supervised Learning Approach to Protect Client Authentication on the Web},
year = {2015},
issue_date = {June 2015},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {9},
number = {3},
issn = {1559-1131},
url = {https://doi.org/10.1145/2754933},
doi = {10.1145/2754933},
journal = {ACM Trans. Web},
month = jun,
articleno = {15},
numpages = {30},
keywords = {Web security, authentication cookies, classification}
}
@inproceedings{hu2021cccc,
author = {Hu, Xuehui and Sastry, Nishanth and Mondal, Mainack},
title = {CCCC: Corralling Cookies into Categories with CookieMonster},
year = {2021},
isbn = {9781450383301},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3447535.3462509},
doi = {10.1145/3447535.3462509},
booktitle = {Proceedings of the 13th ACM Web Science Conference 2021},
pages = {234–242},
numpages = {9},
keywords = {Web tracking, Third-Party Cookie, Cookie Categorisation},
location = {Virtual Event, United Kingdom},
series = {WebSci '21}
}
@inproceedings{shaoor2023cookiegraph,
author = {Munir, Shaoor and Siby, Sandra and Iqbal, Umar and Englehardt, Steven and Shafiq, Zubair and Troncoso, Carmela},
title = {CookieGraph: Understanding and Detecting First-Party Tracking Cookies},
year = {2023},
isbn = {9798400700507},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3576915.3616586},
doi = {10.1145/3576915.3616586},
pages = {3490–3504},
numpages = {15},
keywords = {cookies, machine learning, privacy, tracking, web security},
location = {Copenhagen, Denmark},
series = {CCS '23}
}
@inproceedings{bollinger2022automating,
author = {Dino Bollinger and Karel Kubicek and Carlos Cotrini and David Basin},
title = {Automating Cookie Consent and GDPR Violation Detection},
booktitle = {31st USENIX Security Symposium (USENIX Security 22)},
year = {2022},
month = aug,
pages = {2893--2910},
isbn = {978-1-939133-31-1},
publisher = {USENIX Association},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/bollinger},
address = {Boston, MA},
}
@inproceedings{lin2024it,
author = {Kyi, Lin and Mhaidli, Abraham and Santos, Cristiana Teixeira and Roesner, Franziska and Biega, Asia J.},
title = {“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes},
year = {2024},
isbn = {9798400703300},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3613904.3642260},
doi = {10.1145/3613904.3642260},
booktitle = {Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems},
articleno = {984},
numpages = {12},
keywords = {GDPR, personal data, privacy, purposes, qualitative methods, tracking},
location = {Honolulu, HI, USA},
series = {CHI '24}
}
@article{jiwani2024crumbling,
title={Crumbling Cookie Categories: Deconstructing Common Cookie Categories to Create Categories that People Understand},
author={Jiwani, Soha and Sasheendran, Rachna and Abhyankar, Adhishree and Bouma-Sims, Elijah and Cranor, Lorrie},
journal={Proceedings on Privacy Enhancing Technologies},
year={2024},
doi={10.56553/popets-2024-0093}
}
@inproceedings{shaoor2024purl,
author = {Shaoor Munir and Patrick Lee and Umar Iqbal and Zubair Shafiq and Sandra Siby},
title = {{PURL}: Safe and Effective Sanitization of Link Decoration},
booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
year = {2024},
isbn = {978-1-939133-44-1},
address = {Philadelphia, PA},
pages = {4103--4120},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/munir},
publisher = {USENIX Association},
month = aug
}
@inproceedings{hantke2023you,
author = {Hantke, Florian and Calzavara, Stefano and Wilhelm, Moritz and Rabitti, Alvise and Stock, Ben},
title = {You Call This Archaeology? Evaluating Web Archives for Reproducible Web Security Measurements},
year = {2023},
isbn = {9798400700507},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3576915.3616688},
doi = {10.1145/3576915.3616688},
booktitle = {Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security},
pages = {3168–3182},
numpages = {15},
keywords = {reproducibility, web measurement, web privacy, web security},
location = {Copenhagen, Denmark},
series = {CCS '23}
}
@inproceedings{hantke2025web,
author = {Hantke, Florian and Snyder, Peter and Haddadi, Hamed and Stock, Ben},
title = {Web Execution Bundles: Reproducible, Accurate, and Archivable Web Measurements},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/hantke},
}
@inproceedings{lerner2016internet,
title={Internet Jones and the Raiders of the lost trackers: An archaeological study of web tracking from 1996 to 2016},
author={Lerner, Ada and Simpson, Anna Kornfeld and Kohno, Tadayoshi and Roesner, Franziska},
booktitle={25th USENIX Security Symposium (USENIX Security 16)},
year={2016},
url={https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/lerner}
}
@article{jha2024privacy,
title={Privacy Policies and Consent Management Platforms: Growth and Users' Interactions over Time},
author={Jha, Nikhil and Trevisan, Martino and Mellia, Marco and Fernandez, Daniel and Irarrazaval, Rodrigo},
journal={arXiv preprint arXiv:2402.18321},
year={2024}
}
@inproceedings{amos2021privacy,
author = {Amos, Ryan and Acar, Gunes and Lucherini, Eli and Kshirsagar, Mihir and Narayanan, Arvind and Mayer, Jonathan},
title = {Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset},
year = {2021},
isbn = {9781450383127},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3442381.3450048},
doi = {10.1145/3442381.3450048},
booktitle = {Proceedings of the Web Conference 2021},
pages = {2165–2176},
numpages = {12},
keywords = {web tracking, privacy policy, open dataset, data protection},
location = {Ljubljana, Slovenia},
series = {WWW '21}
}
@article{dimova2021cname,
title={The CNAME of the game: Large-scale analysis of DNS-based tracking evasion},
author={Dimova, Yana and Acar, Gunes and Olejnik, Lukasz and Joosen, Wouter and Van Goethem, Tom},
journal={Proceedings on Privacy Enhancing Technologies},
doi={10.2478/popets-2021-0053},
url={https://doi.org/10.2478/popets-2021-0053},
volume={2021},
issue={3},
pages={394–412},
year={2021}
}
@inproceedings{pletinckx2021out,
title={Out of sight, out of mind: Detecting orphaned web pages at internet-scale},
author={Pletinckx, Stijn and Borgolte, Kevin and Fiebig, Tobias},
year = {2021},
isbn = {9781450384544},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3460120.3485367},
doi = {10.1145/3460120.3485367},
booktitle = {Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security},
pages = {21–35},
numpages = {15},
keywords = {measurement, orphaned resources, web security},
location = {Virtual Event, Republic of Korea},
series = {CCS '21}
}
@inproceedings{roth2020complex,
title={Complex security policy? A longitudinal analysis of deployed content security policies},
author={Roth, Sebastian and Barron, Timothy and Calzavara, Stefano and Nikiforakis, Nick and Stock, Ben},
booktitle={Proceedings of the 27th Network and Distributed System Security Symposium (NDSS)},
year={2020}
}
@inproceedings{stock2017web,
title={How the Web Tangled Itself: Uncovering the History of Client-Side Web (In) Security},
author={Stock, Ben and Johns, Martin and Steffens, Marius and Backes, Michael},
booktitle = {26th USENIX Security Symposium (USENIX Security 17)},
year = {2017},
isbn = {978-1-931971-40-9},
address = {Vancouver, BC},
pages = {971--987},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/stock},
publisher = {USENIX Association},
month = aug
}
}
@inproceedings{bouhoula2024automated,
author = {Ahmed Bouhoula and Karel Kubicek and Amit Zac and Carlos Cotrini and David Basin},
title = {Automated Large-Scale Analysis of Cookie Notice Compliance},
booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
year = {2024},
isbn = {978-1-939133-44-1},
address = {Philadelphia, PA},
pages = {1723--1739},
url = {https://ahmedbouhoula.github.io/post/automated.html},
publisher = {USENIX Association},
month = aug
}
@inproceedings{khandelwal2023automated,
author = {Rishabh Khandelwal and Asmit Nayak and Hamza Harkous and Kassem Fawaz},
title = {Automated Cookie Notice Analysis and Enforcement},
booktitle = {32nd USENIX Security Symposium (USENIX Security 23)},
year = {2023},
isbn = {978-1-939133-37-3},
address = {Anaheim, CA},
pages = {1109--1126},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/khandelwal},
publisher = {USENIX Association},
month = aug
}
@inproceedings{urban2020beyond,
author = {Urban, Tobias and Degeling, Martin and Holz, Thorsten and Pohlmann, Norbert},
title = {Beyond the Front Page:Measuring Third Party Dynamics in the Field},
year = {2020},
isbn = {9781450370233},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3366423.3380203},
doi = {10.1145/3366423.3380203},
booktitle = {Proceedings of The Web Conference 2020},
pages = {1275–1286},
numpages = {12},
keywords = {cookies, privacy, third parties, web measurement},
location = {Taipei, Taiwan},
series = {WWW '20}
}
@inproceedings{zeber2020representativeness,
author = {Zeber, David and Bird, Sarah and Oliveira, Camila and Rudametkin, Walter and Segall, Ilana and Wolls\'{e}n, Fredrik and Lopatka, Martin},
title = {The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing},
year = {2020},
isbn = {9781450370233},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/3366423.3380104},
doi = {10.1145/3366423.3380104},
booktitle = {Proceedings of The Web Conference 2020},
pages = {167–178},
numpages = {12},
keywords = {Browser Fingerprinting, Online Privacy, Tracking, Web Crawling, World Wide Web},
location = {Taipei, Taiwan},
series = {WWW '20}
}
@inproceedings{englehardt2016online,
author = {Englehardt, Steven and Narayanan, Arvind},
title = {Online Tracking: A 1-million-site Measurement and Analysis},
year = {2016},
isbn = {9781450341394},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
url = {https://doi.org/10.1145/2976749.2978313},
doi = {10.1145/2976749.2978313},
booktitle = {Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security},
pages = {1388–1401},
numpages = {14},
keywords = {web tracking, web privacy, web measurement, online advertising, measurement, device fingerprinting, browser security, browser privacy, browser fingerprinting},
location = {Vienna, Austria},
series = {CCS '16}
}
@inproceedings{bashir2016tracing,
title={Tracing information flows between ad exchanges using retargeted ads},
author={Bashir, Muhammad Ahmad and Arshad, Sajjad and Robertson, William and Wilson, Christo},
booktitle={25th USENIX Security Symposium (USENIX Security 16)},
pages={481--496},
year={2016},
url={https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/bashir}
}
@inproceedings{fouad2022my,
title={My Cookie is a phoenix: Detection, measurement, and lawfulness of cookie respawning with browser fingerprinting},
author={Fouad, Imane and Santos, Cristiana and Legout, Arnaud and Bielova, Nataliia},
booktitle={PETS 2022-22nd Privacy Enhancing Technologies Symposium},
year={2022},
doi={10.56553/popets-2022-0063},
url={https://doi.org/10.56553/popets-2022-0063},
}
@inproceedings{jueckstock2021_realistic,
author = {Jueckstock, Jordan and Sarker, Shaown and Snyder, Peter and Beggs, Aidan and Papadopoulos, Panagiotis and Varvello, Matteo and Livshits, Benjamin and Kapravelos, Alexandros},
title = {Towards Realistic and Reproducible Web Crawl Measurements},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450050},
}
@inproceedings{demir2022_reproducibility,
author = {Demir, Nurullah and Große-Kampmann, Matteo and Urban, Tobias and Wressnegger, Christian and Holz, Thorsten and Pohlmann, Norbert},
title = {Reproducibility and Replicability of Web Measurement Studies},
booktitle = {Proceedings of the ACM Web Conference},
year = {2022},
series = {TheWebConf 2022},
doi = {10.1145/3485447.3512214},
}
@inproceedings{mcdonald2018_forbidden,
author = {McDonald, Allison and Bernhard, Matthew and Valenta, Luke and VanderSloot, Benjamin and Scott, Will and Sullivan, Nick and Halderman, J. Alex and Ensafi, Roya},
title = {403 Forbidden: A Global View of CDN Geoblocking},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278552},
}
@inproceedings{weinberg2018_catch,
author = {Weinberg, Zachary and Cho, Shinyoung and Christin, Nicolas and Sekar, Vyas and Gill, Phillipa},
title = {How to Catch when Proxies Lie: Verifying the Physical Locations of Network Proxies with Active Geolocation},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278551},
}
@inproceedings{iordanou2018_tracing,
author = {Iordanou, Costas and Smaragdakis, Georgios and Poese, Ingmar and Laoutaris, Nikolaos},
title = {Tracing Cross Border Web Tracking},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278561},
}
@inproceedings{khattak2016_differential,
author = {Khattak, Sheharbano and Fifield, David and Afroz, Sadia and Javed, Mobin and Sundaresan, Srikanth and McCoy, Damon and Paxson, Vern and Murdoch, Steven J.},
title = {Do You See What I See? Differential Treatment of Anonymous Users},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2016},
series = {NDSS 2016},
url = {https://www.ndss-symposium.org/wp-content/uploads/2017/09/do-you-see-what-i-see-differential-treatment-anonymous-users.pdf},
}
@inproceedings{kumar2022_investigation,
author = {Kumar, Renuka and Virkud, Apurva and Sundara Raman, Ram and Prakash, Atul and Ensafi, Roya},
title = {A Large-scale Investigation into Geodifferences in Mobile Apps},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/kumar},
}
@inproceedings{mi2019_resident,
author = {Mi, Xianghang and Feng, Xuan and Liao, Xiaojing and Liu, Baojun and Wang, XiaoFeng and Qian, Feng and Li, Zhou and Alrwais, Sumayah A. and Sun, Limin and Liu, Ying},
title = {Resident Evil: Understanding Residential IP Proxy as a Dark Service},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2019},
series = {IEEE S&P 2019},
doi = {10.1109/sp.2019.00011},
}
@inproceedings{klimansilver2015_location,
author = {Kliman-Silver, Chloe and Hannak, Aniko and Lazer, David and Wilson, Christo and Mislove, Alan},
title = {Location, Location, Location: The Impact of Geolocation on Web Search Personalization},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2015},
series = {IMC 2015},
doi = {10.1145/2815675.2815714},
}
@inproceedings{ogut2024_dissecting,
author = {Ogut, Aysun and Turanlioglu, Berke and Metiner, Doruk Can and Levi, Albert and Yilmaz, Cemal and Cetin, Orcun and Uluagac, Selcuk},
title = {Dissecting Privacy Perspectives of Websites Around the World: "Aceptar Todo, Alle Akzeptieren, Accept All..."},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/ogut},
}
@inproceedings{demir2024_bannertools,
author = {Demir, Nurullah and Urban, Tobias and Pohlmann, Norbert and Wressnegger, Christian},
title = {A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
volume = {2024},
number = {1},
pages = {5--20},
doi = {10.56553/popets-2024-0002},
}
@inproceedings{matte2020_cookie,
author = {Matte, Célestin and Bielova, Nataliia and Santos, Cristiana Teixeira},
title = {Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2020},
series = {IEEE S&P 2020},
doi = {10.1109/sp40000.2020.00076},
}
@inproceedings{vaneijk2019_location,
author = {van Eijk, Rob and Asghari, Hadi and Winter, Philipp and Narayanan, Arvind},
title = {The Impact of User Location on Cookie Notices (Inside and Outside of the European Union)},
booktitle = {Workshop on Technology and Consumer Protection (ConPro), IEEE Security and Privacy Workshops},
year = {2019},
series = {ConPro 2019},
url = {https://www.ieee-security.org/TC/SPW2019/ConPro/papers/vaneijk-conpro19.pdf},
}
@inproceedings{nikiforakis2013_cookieless,
author = {Nikiforakis, Nick and Kapravelos, Alexandros and Joosen, Wouter and Kruegel, Christopher and Piessens, Frank and Vigna, Giovanni},
title = {Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2013},
series = {IEEE S&P 2013},
doi = {10.1109/sp.2013.43},
}
@inproceedings{acar2014_never,
author = {Acar, Gunes and Eubank, Christian and Englehardt, Steven and Juarez, Marc and Narayanan, Arvind and Díaz, Claudia},
title = {The Web Never Forgets: Persistent Tracking Mechanisms in the Wild},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2014},
series = {CCS 2014},
doi = {10.1145/2660267.2660347},
}
@inproceedings{nikiforakis2015_privaricator,
author = {Nikiforakis, Nick and Joosen, Wouter and Livshits, Benjamin},
title = {PriVaricator: Deceiving Fingerprinters with Little White Lies},
booktitle = {Proceedings of the ACM Web Conference},
year = {2015},
series = {TheWebConf 2015},
doi = {10.1145/2736277.2741090},
}
@inproceedings{gulyas2016_near,
author = {Gulyás, Gábor György and Ács, Gergely and Castelluccia, Claude},
title = {Near-Optimal Fingerprinting with Constraints},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2016},
series = {PoPETs 2016},
doi = {10.1515/popets-2016-0051},
}
@inproceedings{lerner2016_internet,
author = {Lerner, Ada and Simpson, Anna Kornfeld and Kohno, Tadayoshi and Roesner, Franziska},
title = {Internet Jones and the Raiders of the Lost Trackers: An Archaeological Study of Web Tracking from 1996 to 2016},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2016},
series = {USENIX Security 2016},
url = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/lerner},
}
@inproceedings{vastel2018_stalker,
author = {Vastel, Antoine and Laperdrix, Pierre and Rudametkin, Walter and Rouvoy, Romain},
title = {FP-STALKER: Tracking Browser Fingerprint Evolutions},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2018},
series = {IEEE S&P 2018},
doi = {10.1109/sp.2018.00008},
}
@inproceedings{vastel2018_scanner,
author = {Vastel, Antoine and Laperdrix, Pierre and Rudametkin, Walter and Rouvoy, Romain},
title = {Fp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2018},
series = {USENIX Security 2018},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/vastel},
}
@inproceedings{gomezboix2018_hiding,
author = {Gómez-Boix, Alejandro and Laperdrix, Pierre and Baudry, Benoit},
title = {Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale},
booktitle = {Proceedings of the ACM Web Conference},
year = {2018},
series = {TheWebConf 2018},
doi = {10.1145/3178876.3186097},
}
@inproceedings{karami2020_carnus,
author = {Karami, Soroush and Ilia, Panagiotis and Solomos, Konstantinos and Polakis, Jason},
title = {Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2020},
series = {NDSS 2020},
url = {https://www.ndss-symposium.org/ndss-paper/carnus-exploring-the-privacy-threats-of-browser-extension-fingerprinting/},
}
@inproceedings{pugliese2020_long,
author = {Pugliese, Gaston and Riess, Christian and Gassmann, Freya and Benenson, Zinaida},
title = {Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0041},
}
@inproceedings{iqbal2021_fingerprinting,
author = {Iqbal, Umar and Englehardt, Steven and Shafiq, Zubair},
title = {Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2021},
series = {IEEE S&P 2021},
doi = {10.1109/sp40001.2021.00017},
}
@inproceedings{rizzo2021_unveiling,
author = {Rizzo, Valentino and Traverso, Stefano and Mellia, Marco},
title = {Unveiling Web Fingerprinting in the Wild Via Code Mining and Machine Learning},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2021},
series = {PoPETs 2021},
doi = {10.2478/popets-2021-0004},
}
@inproceedings{laperdrix2021_fingerprinting,
author = {Laperdrix, Pierre and Starov, Oleksii and Chen, Quan and Kapravelos, Alexandros and Nikiforakis, Nick},
title = {Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/laperdrix},
}
@inproceedings{bahrami2022_radar,
author = {Bahrami, Pouneh Nikkhah and Iqbal, Umar and Shafiq, Zubair},
title = {FP-Radar: Longitudinal Measurement and Early Detection of Browser Fingerprinting},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.2478/popets-2022-0056},
}
@inproceedings{cassel2022_omnicrawl,
author = {Cassel, Darion and Lin, Su-Chin and Buraggina, Alessio and Wang, William and Zhang, Andrew and Bauer, Lujo and Hsiao, Hsu-Chun and Jia, Limin and Libert, Timothy},
title = {OmniCrawl: Comprehensive Measurement of Web Tracking With Real Desktop and Mobile Browsers},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.2478/popets-2022-0012},
}
@inproceedings{chalise2022_webaudio,
author = {Chalise, Shekhar and Nguyen, Hoang Dai and Vadrevu, Phani},
title = {Your speaker or my snooper?: measuring the effectiveness of web audio browser fingerprints},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561435},
}
@inproceedings{laor2022_drawn,
author = {Laor, Tomer and Mehanna, Naif and Durey, Antonin and Dyadyuk, Vitaly and Laperdrix, Pierre and Maurice, Clémentine and Oren, Yossi and Rouvoy, Romain and Rudametkin, Walter and Yarom, Yuval},
title = {DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2022},
series = {NDSS 2022},
url = {https://www.ndss-symposium.org/ndss-paper/drawn-apart-a-device-identification-technique-based-on-remote-gpu-fingerprinting/},
}
@inproceedings{sanchezrola2023_rods,
author = {Sánchez-Rola, Iskander and Bilge, Leyla and Balzarotti, Davide and Buescher, Armin and Efstathopoulos, Petros},
title = {Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/sanchez-rola},
}
@inproceedings{wu2023_manyfaces,
author = {Wu, Shujiang and Sun, Pengfei and Zhao, Yao and Cao, Yinzhi},
title = {Him of Many Faces: Characterizing Billion-scale Adversarial and Benign Browser Fingerprints on Commercial Websites},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2023},
series = {NDSS 2023},
url = {https://www.ndss-symposium.org/ndss-paper/him-of-many-faces-characterizing-billion-scale-adversarial-and-benign-browser-fingerprints-on-commercial-websites/},
}
@inproceedings{su2023_automatic,
author = {Su, Junhua and Kapravelos, Alexandros},
title = {Automatic Discovery of Emerging Browser Fingerprinting Techniques},
booktitle = {Proceedings of the ACM Web Conference},
year = {2023},
series = {TheWebConf 2023},
doi = {10.1145/3543507.3583333},
}
@inproceedings{annamalai2024_fpfed,
author = {Annamalai, Meenatchi Sundaram Muthu Selva and Bilogrevic, Igor and Cristofaro, Emiliano De},
title = {FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2024},
series = {NDSS 2024},
url = {https://www.ndss-symposium.org/ndss-paper/fp-fed-privacy-preserving-federated-detection-of-browser-fingerprinting/},
}
@inproceedings{boussaha2024_tracer,
author = {Boussaha, Soumaya and Hock, Lukas and Bermejo, Miguel and Rumín, Rubén Cuevas and Rumín, Ángel Cuevas and Klein, David and Johns, Martin and Compagna, Luca and Antonioli, Daniele and Barber, Thomas},
title = {FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Entropy-based Thresholds},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0092},
}
@inproceedings{agarwal2024_peeking,
author = {Agarwal, Shubham and Fass, Aurore and Stock, Ben},
title = {Peeking through the window: Fingerprinting Browser Extensions through Page-Visible Execution Traces and Interactions},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2024},
series = {CCS 2024},
doi = {10.1145/3658644.3670339},
}
@inproceedings{datta2019_evaluating,
author = {Datta, Amit and Lu, Jianan and Tschantz, Michael Carl},
title = {Evaluating Anti-Fingerprinting Privacy Enhancing Technologies},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313703},
}
@article{laperdrix2020_survey,
author = {Laperdrix, Pierre and Bielova, Nataliia and Baudry, Benoit and Avoine, Gildas},
title = {Browser Fingerprinting: A Survey},
journal = {ACM Transactions on the Web},
volume = {14},
number = {2},
articleno = {8},
numpages = {33},
year = {2020},
doi = {10.1145/3386040},
}
@inproceedings{eckersley2010_unique,
author = {Eckersley, Peter},
title = {How Unique Is Your Web Browser?},
booktitle = {Proceedings of the Privacy Enhancing Technologies Symposium},
series = {PETS 2010},
pages = {1--18},
year = {2010},
doi = {10.1007/978-3-642-14527-8_1},
}
@article{berke2025_demographics,
author = {Berke, Alex and Calacci, Dan and Mahari, Robert and Yabe, Takahiro and Larson, Kent and Pentland, Sandy},
title = {How Unique is Whose Web Browser? The Role of Demographics in Browser Fingerprinting Among US Users},
journal = {Proceedings on Privacy Enhancing Technologies},
volume = {2025},
number = {1},
pages = {720--758},
year = {2025},
doi = {10.56553/popets-2025-0038},
}
@inproceedings{zhang2022_spartacus,
author = {Zhang, Penghui and Sun, Zhibo and Kyung, Sukwha and Behrens, Hans Walter and Basque, Zion Leonahenahe and Cho, Haehyun and Oest, Adam and Wang, Ruoyu and Bao, Tiffany and Shoshitaishvili, Yan and Ahn, Gail-Joon and Doupé, Adam},
title = {I'm SPARTACUS, No, I'm SPARTACUS: Proactively Protecting Users from Phishing by Intentionally Triggering Cloaking Behavior},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2022},
series = {CCS 2022},
doi = {10.1145/3548606.3559334},
}
@inproceedings{papadogiannakis2021_user,
author = {Papadogiannakis, Emmanouil and Papadopoulos, Panagiotis and Kourtellis, Nicolas and Markatos, Evangelos P.},
title = {User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450056},
}
@inproceedings{jueckstock2019_visiblev8,
author = {Jueckstock, Jordan and Kapravelos, Alexandros},
title = {VisibleV8: In-browser Monitoring of JavaScript in the Wild},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355599},
}
@inproceedings{kanyal2024_panoptichrome,
author = {Kanyal, Rahul and Sarangi, Smruti R.},
title = {PanoptiChrome: A Modern In-browser Taint Analysis Framework},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645699},
}
@inproceedings{krumnow2022_gullible,
author = {Krumnow, Benjamin and Jonker, Hugo and Karsch, Stefan},
title = {How gullible are web measurement tools?},
booktitle = {Proceedings of the 18th International Conference on Emerging Networking EXperiments and Technologies},
year = {2022},
series = {CoNEXT 2022},
pages = {171--186},
doi = {10.1145/3555050.3569131},
}
@inproceedings{klein2022_handsanitizers,
author = {Klein, David and Barber, Thomas and Bensalim, Souphiane and Stock, Ben and Johns, Martin},
title = {Hand Sanitizers in the Wild: A Large-scale Study of Custom JavaScript Sanitizer Functions},
booktitle = {2022 IEEE 7th European Symposium on Security and Privacy (EuroS\&P)},
year = {2022},
pages = {236--250},
doi = {10.1109/EuroSP53844.2022.00023},
}
@article{libert2015_invisible,
author = {Libert, Timothy},
title = {Exposing the Invisible Web: An Analysis of Third-Party HTTP Requests on 1 Million Websites},
journal = {International Journal of Communication},
volume = {9},
year = {2015},
url = {https://ijoc.org/index.php/ijoc/article/view/3646},
}
@inproceedings{gharaibeh2017_look,
author = {Gharaibeh, Manaf and Shah, Anant and Huffaker, Bradley and Zhang, Han and Ensafi, Roya and Papadopoulos, Christos},
title = {A Look at Router Geolocation in Public and Commercial Databases},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2017},
series = {IMC 2017},
doi = {10.1145/3131365.3131380},
}
@inproceedings{darwich2023_replication,
author = {Darwich, Omar and Rimlinger, Hugo and Dreyfus, Milo and Gouel, Matthieu and Vermeulen, Kevin},
title = {Replication: Towards a Publicly Available Internet Scale IP Geolocation Dataset},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624801},
}
@inproceedings{richter2016_multi,
author = {Richter, Philipp and Wohlfart, Florian and Vallina-Rodriguez, Narseo and Allman, Mark and Bush, Randy and Feldmann, Anja and Kreibich, Christian and Weaver, Nicholas and Paxson, Vern},
title = {A Multi-perspective Analysis of Carrier-Grade NAT Deployment},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2016},
series = {IMC 2016},
doi = {10.1145/2987443.2987474},
}
@inproceedings{rye2023_ipvseeyou,
author = {Rye, Erik C. and Beverly, Robert},
title = {IPvSeeYou: Exploiting Leaked Identifiers in IPv6 for Street-Level Geolocation},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S\&P 2023},
doi = {10.1109/sp46215.2023.10179376},
}
@inproceedings{khan2018_commercial,
author = {Khan, Mohammad Taha and DeBlasio, Joe and Voelker, Geoffrey M. and Snoeren, Alex C. and Kanich, Chris and Vallina-Rodriguez, Narseo},
title = {An Empirical Analysis of the Commercial VPN Ecosystem},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278570},
}
@inproceedings{kumar2024_choices,
author = {Kumar, Rashna and Carisimo, Esteban and De Angelis Riva, Lukas and Buzzone, Mauricio and Bustamante, Fabi{\'a}n E. and Qazi, Ihsan Ayyub and Beir{\'o}, Mariano G.},
title = {Of Choices and Control -- A Comparative Analysis of Government Hosting},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3688447},
}
@inproceedings{nemmi2021_parallel,
author = {Nemmi, Eugenio Nerio and Sassi, Francesco and La Morgia, Massimo and Testart, Cecilia and Mei, Alessandro and Dainotti, Alberto},
title = {The Parallel Lives of Autonomous Systems: ASN Allocations vs. BGP},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487838},
}
@inproceedings{gamerogarrido2022_using,
author = {Gamero-Garrido, Alexander and Belding, Elizabeth M. and Choffnes, David R.},
title = {Using Reverse IP Geolocation to Identify Institutional Networks},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3563021},
}
@inproceedings{yang2022_extensive,
author = {Yang, Mingshuo and Yu, Yunnan and Mi, Xianghang and Tang, Shujun and Guo, Shanqing and Li, Yilin and Zheng, Xiaofeng and Duan, Haixin},
title = {An Extensive Study of Residential Proxies in China},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2022},
series = {CCS 2022},
doi = {10.1145/3548606.3559377},
}
@inproceedings{mi2021_your,
author = {Mi, Xianghang and Tang, Siyuan and Li, Zhengyi and Liao, Xiaojing and Qian, Feng and Wang, XiaoFeng},
title = {Your Phone is My Proxy: Detecting and Understanding Mobile Proxy Networks},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/your-phone-is-my-proxy-detecting-and-understanding-mobile-proxy-networks/},
}
@inproceedings{ramesh2024_calculatency,
author = {Ramesh, Reethika and Winter, Philipp and Korman, Sam and Ensafi, Roya},
title = {CalcuLatency: Leveraging Cross-Layer Network Latency Measurements to Detect Proxy-Enabled Abuse},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/ramesh},
}
@article{poese2011_unreliable,
author = {Poese, Ingmar and Uhlig, Steve and Kaafar, Mohamed Ali and Donnet, Beno{\^i}t and Gueye, Bamba},
title = {IP Geolocation Databases: Unreliable?},
journal = {ACM SIGCOMM Computer Communication Review},
volume = {41},
number = {2},
pages = {53--56},
year = {2011},
doi = {10.1145/1971162.1971171},
}
@article{shavitt2011_geodb,
author = {Shavitt, Yuval and Zilberman, Noa},
title = {A Geolocation Databases Study},
journal = {IEEE Journal on Selected Areas in Communications},
volume = {29},
number = {10},
pages = {2044--2056},
year = {2011},
doi = {10.1109/JSAC.2011.111214},
}
@article{zilberman2025_survey,
author = {Zilberman, Aviram and Offer, Adi and Pincu, Bar and Glickshtein, Yoni and Kant, Roi and Brodt, Oleg and Otung, Andikan and Puzis, Rami and Shabtai, Asaf and Elovici, Yuval},
title = {A Survey on Geolocation on the Internet},
journal = {IEEE Communications Surveys \& Tutorials},
volume = {27},
number = {5},
pages = {3339--3381},
year = {2025},
doi = {10.1109/COMST.2024.3518398},
}
@article{livadariu2024_geofeeds,
author = {Livadariu, Ioana and Vermeulen, Kevin and Mouchet, Maxime and Giotsas, Vasileios},
title = {Geofeeds: Revolutionizing IP Geolocation or Illusionary Promises?},
journal = {Proceedings of the ACM on Networking},
volume = {2},
number = {CoNEXT3},
pages = {1--21},
year = {2024},
doi = {10.1145/3676869},
}
@inproceedings{padmanabhan2020_dynamips,
author = {Padmanabhan, Ramakrishna and Rula, John P. and Richter, Philipp and Strowes, Stephen D. and Dainotti, Alberto},
title = {DynamIPs: Analyzing Address Assignment Practices in IPv4 and IPv6},
booktitle = {Proceedings of the 16th International Conference on Emerging Networking Experiments and Technologies},
year = {2020},
series = {CoNEXT 2020},
pages = {55--70},
doi = {10.1145/3386367.3431314},
}
@inproceedings{luckie2021_hoiho,
author = {Luckie, Matthew and Huffaker, Bradley and Marder, Alexander and Bischof, Zachary and Fletcher, Marianne and Claffy, KC},
title = {Learning to Extract Geographic Information from Internet Router Hostnames},
booktitle = {Proceedings of the 17th International Conference on Emerging Networking Experiments and Technologies},
year = {2021},
series = {CoNEXT 2021},
pages = {440--453},
doi = {10.1145/3485983.3494869},
}
@article{du2020_ipmap,
author = {Du, Ben and Candela, Massimo and Huffaker, Bradley and Snoeren, Alex C. and Claffy, KC},
title = {RIPE IPmap Active Geolocation: Mechanism and Performance Evaluation},
journal = {ACM SIGCOMM Computer Communication Review},
volume = {50},
number = {2},
pages = {3--10},
year = {2020},
doi = {10.1145/3402413.3402415},
}
@inproceedings{ziv2021_asdb,
author = {Ziv, Maya and Izhikevich, Liz and Ruth, Kimberly and Izhikevich, Katherine and Durumeric, Zakir},
title = {ASdb: A System for Classifying Owners of Autonomous Systems},
booktitle = {Proceedings of the 21st ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
pages = {703--719},
doi = {10.1145/3487552.3487853},
}
@inproceedings{selmo2025_borges,
author = {Selmo, Carlos and Carisimo, Esteban and Bustamante, Fabi{\'a}n E. and Alvarez-Hamelin, J. Ignacio},
title = {Learning AS-to-Organization Mappings with Borges},
booktitle = {Proceedings of the 2025 ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
pages = {120--133},
doi = {10.1145/3730567.3732918},
}
@inproceedings{gueye2004_cbg,
author = {Gueye, Bamba and Ziviani, Artur and Crovella, Mark and Fdida, Serge},
title = {Constraint-Based Geolocation of Internet Hosts},
booktitle = {Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement},
year = {2004},
series = {IMC 2004},
pages = {288--293},
doi = {10.1145/1028788.1028828},
}
@inproceedings{sommese2020_manycast2,
author = {Sommese, Raffaele and Bertholdo, Leandro and Akiwate, Gautam and Jonker, Mattijs and van Rijswijk-Deij, Roland and Dainotti, Alberto and Claffy, KC and Sperotto, Anna},
title = {MAnycast2: Using Anycast to Measure Anycast},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
pages = {456--463},
doi = {10.1145/3419394.3423646},
}
@misc{nabi2026_lostprefix,
author = {Nabi, Syed Tauhidun and Bliton, Jocelyn and Chung, Tijay and Hasan, Shaddi},
title = {Lost in the Prefix: Revisiting IP Geolocation Accuracy Across Networks and Geographies},
year = {2026},
note = {arXiv preprint, not peer reviewed},
howpublished = {arXiv:2605.21937},
url = {https://arxiv.org/abs/2605.21937},
}
@inproceedings{gegenhuber2023_mobileatlas,
author = {Gegenhuber, Gabriel K. and Mayer, Wilfried and Weippl, Edgar and Dabrowski, Adrian},
title = {MobileAtlas: Geographically Decoupled Measurements in Cellular Networks for Security and Privacy Research},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/gegenhuber},
}
@inproceedings{chiapponi2023_poster,
author = {Chiapponi, Elisa and Dacier, Marc and Thonnard, Olivier},
title = {Poster: The Impact of the Client Environment on Residential IP Proxies Detection},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624993},
}
@inproceedings{amjad2024_notjs,
author = {Amjad, Abdul Haddi and Munir, Shaoor and Shafiq, Zubair and Gulzar, Muhammad Ali},
title = {Blocking Tracking JavaScript at the Function Granularity},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2024},
series = {CCS 2024},
doi = {10.1145/3658644.3670329},
}
@inproceedings{amjad2021_trackersift,
author = {Amjad, Abdul Haddi and Saleem, Danial and Gulzar, Muhammad Ali and Shafiq, Zubair and Zaffar, Fareed},
title = {TrackerSift: untangling mixed tracking and functional web resources},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487855},
}
@inproceedings{amjad2023_blocking,
author = {Amjad, Abdul Haddi and Shafiq, Zubair and Gulzar, Muhammad Ali},
title = {Blocking JavaScript Without Breaking the Web: An Empirical Investigation},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
series = {PoPETs 2023},
doi = {10.56553/popets-2023-0087},
}
@inproceedings{ghasemisharif2023_bytecode,
author = {Ghasemisharif, Mohammad and Polakis, Jason},
title = {Read Between the Lines: Detecting Tracking JavaScript with Bytecode Classification},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2023},
series = {CCS 2023},
doi = {10.1145/3576915.3616637},
}
@inproceedings{skolka2019_anything,
author = {Skolka, Philippe and Staicu, Cristian-Alexandru and Pradel, Michael},
title = {Anything to Hide? Studying Minified and Obfuscated Code in the Web},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313752},
}
@inproceedings{sarker2020_hiding,
author = {Sarker, Shaown and Jueckstock, Jordan and Kapravelos, Alexandros},
title = {Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
doi = {10.1145/3419394.3423616},
}
@inproceedings{rack2023_jackinthebox,
author = {Rack, Jeremy and Staicu, Cristian-Alexandru},
title = {Jack-in-the-box: An Empirical Study of JavaScript Bundling on the Web and its Security Implications},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2023},
series = {CCS 2023},
doi = {10.1145/3576915.3623140},
}
@inproceedings{lauinger2017_thou,
author = {Lauinger, Tobias and Chaabane, Abdelberi and Arshad, Sajjad and Robertson, William and Wilson, Christo and Kirda, Engin},
title = {Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2017},
series = {NDSS 2017},
url = {https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/thou-shalt-not-depend-me-analysing-use-outdated-javascript-libraries-web/},
}
@inproceedings{li2024_selfdeleting,
author = {Wang, Xinzhe and Zhuang, Zeyang and Meng, Wei and Cheng, James},
title = {Detecting and Understanding Self-Deleting JavaScript Code},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645540},
}
@inproceedings{kupoluyi2022_muzeel,
author = {Kupoluyi, Jesutofunmi and Chaqfeh, Moumena and Varvello, Matteo and Coke, Russell and Hashmi, Waleed and Subramanian, Lakshmi and Zaki, Yasir},
title = {Muzeel: assessing the impact of JavaScript dead code elimination on mobile web performance},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561427},
}
@inproceedings{lee2024_adflush,
author = {Lee, Kiho and Lim, Chaejin and Jin, Beomjin and Kim, Taeyoung and Kim, Hyoungshick},
title = {AdFlush: A Real-World Deployable Machine Learning Solution for Effective Advertisement and Web Tracker Prevention},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645698},
}
@inproceedings{smith2021_sugarcoat,
author = {Smith, Michael and Snyder, Peter and Livshits, Benjamin and Stefan, Deian},
title = {SugarCoat: Programmatically Generating Privacy-Preserving, Web-Compatible Resource Replacements for Content Blocking},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2021},
series = {CCS 2021},
doi = {10.1145/3460120.3484578},
}
@inproceedings{pantelaios2024_fv8,
author = {Pantelaios, Nikolaos and Kapravelos, Alexandros},
title = {FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/pantelaios},
}
@inproceedings{lekies2015_dynamic,
author = {Lekies, Sebastian and Stock, Ben and Wentzel, Martin and Johns, Martin},
title = {The Unexpected Dangers of Dynamic JavaScript},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2015},
series = {USENIX Security 2015},
url = {https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/lekies},
}
@inproceedings{soni2015_sicilian,
author = {Soni, Pratik and Budianto, Enrico and Saxena, Prateek},
title = {The SICILIAN Defense: Signature-based Whitelisting of Web JavaScript},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2015},
series = {CCS 2015},
doi = {10.1145/2810103.2813710},
}
@inproceedings{ikram2017_seamless,
author = {Ikram, Muhammad and Asghar, Hassan Jameel and Kaafar, Mohamed Ali and Mahanti, Anirban and Krishnamurthy, Balachander},
title = {Towards Seamless Tracking-Free Web: Improved Detection of Trackers via One-class Learning},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2017},
series = {PoPETs 2017},
doi = {10.1515/popets-2017-0006},
}
@inproceedings{zafar2025_samescript,
author = {Zafar, Ahsan and Su, Junhua and Datta, Sohom and Kapravelos, Alexandros and Das, Anupam},
title = {Same Script, Different Behavior: Characterizing Divergent JavaScript Execution Across Different Device Platforms},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765202},
}
@inproceedings{bahrami2025_bytedefender,
author = {Nikkhah Bahrami, Pouneh and Cutler, Dylan and Bilogrevic, Igor},
title = {Byte by Byte: Unmasking Browser Fingerprinting at the Function Level Using V8 Bytecode Transformers},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765158},
}
@inproceedings{rieder2026_sok,
author = {Rieder, Wolf and Raschke, Philip and Cory, Thomas and Sechting, Christian Ren\'e and Kumar, Aditya and K\"upper, Axel},
title = {SoK: After Decades of Web Tracker Detection, What's Next?},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2026},
series = {IEEE S\&P 2026},
url = {https://arxiv.org/abs/2605.02982},
}
@misc{vekaria2025_soktracking,
author = {Vekaria, Yash and Beugin, Yohan and Munir, Shaoor and Acar, Gunes and Bielova, Nataliia and Englehardt, Steven and Iqbal, Umar and Kapravelos, Alexandros and Laperdrix, Pierre and Nikiforakis, Nick and Polakis, Jason and Roesner, Franziska and Shafiq, Zubair and Zimmeck, Sebastian},
title = {SoK: Advances and Open Problems in Web Tracking},
year = {2025},
howpublished = {arXiv preprint arXiv:2506.14057},
url = {https://arxiv.org/abs/2506.14057},
}
@inproceedings{calzavara2026_syntactic,
author = {Calzavara, Stefano and Casarin, Samuele and Squarcina, Marco and Maffei, Matteo},
title = {From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PoPETs 2026},
url = {https://petsymposium.org/2026/paperlist.php},
}
@inproceedings{lukic2026_mv3,
author = {Luki\'c, Karlo and Papadopoulos, Lazaros},
title = {Privacy vs. Profit: The Impact of Google's Manifest Version 3 (MV3) Update on Ad Blocker Effectiveness},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PoPETs 2026},
url = {https://petsymposium.org/popets/2026/popets-2026-0027.pdf},
}
@inproceedings{ruth2022_world,
author = {Ruth, Kimberly and Fass, Aurore and Azose, Jonathan and Pearson, Mark and Thomas, Emma and Sadowski, Caitlin and Durumeric, Zakir},
title = {A World Wide View of Browsing the World Wide Web},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
pages = {317--336},
doi = {10.1145/3517745.3561418},
}
@article{jha2023_topics,
author = {Jha, Nikhil and Trevisan, Martino and Leonardi, Emilio and Mellia, Marco},
title = {On the Robustness of Topics {API} to a Re-Identification Attack},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {4},
pages = {66--78},
doi = {10.56553/popets-2023-0098},
}
@inproceedings{lugeon2022_homepage2vec,
author = {Lugeon, Sylvain and Piccardi, Tiziano and West, Robert},
title = {Homepage2Vec: Language-Agnostic Website Embedding and Classification},
booktitle = {Proceedings of the International AAAI Conference on Web and Social Media},
year = {2022},
series = {ICWSM 2022},
volume = {16},
pages = {1285--1291},
doi = {10.1609/icwsm.v16i1.19380},
}
@article{ye2024_multilingual,
author = {Ye, Eric and Bai, Xiao and O'Hare, Neil and Asgarieh, Eliyar and Thadani, Kapil and Perez-Sorrosal, Francisco and Adiga, Sujyothi},
title = {Multilingual Taxonomic Web Page Categorization Through Ensemble Knowledge Distillation},
journal = {IEEE Transactions on Knowledge and Data Engineering},
year = {2024},
volume = {36},
number = {11},
pages = {6614--6627},
doi = {10.1109/TKDE.2024.3406368},
}
@misc{bozzolan2026_llmweb,
author = {Bozzolan, Simone and Calzavara, Stefano and Cazzaro, Lorenzo},
title = {{LLM}-Assisted Web Measurements},
year = {2026},
note = {arXiv:2510.08101, v3, 30 April 2026},
eprint = {2510.08101},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2510.08101},
}
@inproceedings{tsai2025_harmful,
author = {Tsai, Elisa and Mangaokar, Neal and Zheng, Boyuan and Zheng, Haizhong and Prakash, Atul},
title = {Harmful Terms and Where to Find Them: Measuring and Modeling Unfavorable Financial Terms and Conditions in Shopping Websites at Scale},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714573},
}
@inproceedings{luo2025_canvassing,
author = {Luo, Elisa and Ritter, Tom and Savage, Stefan and Voelker, Geoffrey M.},
title = {Canvassing the Fingerprinters: Characterizing Canvas Fingerprinting Use Across the Web},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764500},
}
@inproceedings{annamalai2025_beyond,
author = {Annamalai, Meenatchi Sundaram Muthu Selva and De Cristofaro, Emiliano and Bilogrevic, Igor},
title = {Beyond the Crawl: Unmasking Browser Fingerprinting in Real User Interactions},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714871},
}
@inproceedings{iqbal2017_wars,
author = {Iqbal, Umar and Shafiq, Zubair and Qian, Zhiyun},
title = {The ad wars: retrospective measurement and analysis of anti-adblock filter lists},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2017},
series = {IMC 2017},
doi = {10.1145/3131365.3131387},
}
@inproceedings{mughees2017_detecting,
author = {Mughees, Muhammad Haris and Qian, Zhiyun and Shafiq, Zubair},
title = {Detecting Anti Ad-blockers in the Wild},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2017},
series = {PoPETs 2017},
volume = {2017},
number = {3},
pages = {130--146},
doi = {10.1515/popets-2017-0032},
}
@inproceedings{tramer2019_adversarial,
author = {Tram\`er, Florian and Dupr\'e, Pascal and Rusak, Gili and Pellegrino, Giancarlo and Boneh, Dan},
title = {AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2019},
series = {CCS 2019},
doi = {10.1145/3319535.3354222},
}
@inproceedings{fouad2020_missed,
author = {Fouad, Imane and Bielova, Nataliia and Legout, Arnaud and Sarafijanovic-Djukic, Natasa},
title = {Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
volume = {2020},
number = {2},
pages = {499--518},
doi = {10.2478/popets-2020-0038},
}
@inproceedings{sjosten2020_filter,
author = {Sj\"osten, Alexander and Snyder, Peter and Pastor, Antonio and Papadopoulos, Panagiotis and Livshits, Benjamin},
title = {Filter List Generation for Underserved Regions},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380239},
}
@inproceedings{chen2021_detecting,
author = {Chen, Quan and Snyder, Peter and Livshits, Ben and Kapravelos, Alexandros},
title = {Detecting Filter List Evasion with Event-Loop-Turn Granularity JavaScript Signatures},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2021},
series = {IEEE S&P 2021},
doi = {10.1109/sp40001.2021.00007},
}
@inproceedings{le2021_inspector,
author = {Le, Hieu and Markopoulou, Athina and Shafiq, Zubair},
title = {CV-Inspector: Towards Automating Detection of Adblock Circumvention},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/cv-inspector-towards-automating-detection-of-adblock-circumvention/},
}
@inproceedings{lin2022_investigating,
author = {Lin, Su-Chin and Chou, Kai-Hsiang and Chen, Yen and Hsiao, Hsu-Chun and Cassel, Darion and Bauer, Lujo and Jia, Limin},
title = {Investigating Advertisers' Domain-changing Behaviors and Their Impacts on Ad-blocker Filter Lists},
booktitle = {Proceedings of the ACM Web Conference},
year = {2022},
series = {TheWebConf 2022},
doi = {10.1145/3485447.3512218},
}
@inproceedings{yang2022_wtagraph,
author = {Yang, Zhiju and Pei, Weiping and Chen, Monchu and Yue, Chuan},
title = {WTAGRAPH: Web Tracking and Advertising Detection using Graph Neural Networks},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2022},
series = {IEEE S&P 2022},
doi = {10.1109/sp46214.2022.9833670},
}
@inproceedings{le2023_autofr,
author = {Le, Hieu and Elmalaki, Salma and Markopoulou, Athina and Shafiq, Zubair},
title = {AutoFR: Automated Filter Rule Generation for Adblocking},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/le},
}
@inproceedings{lee2023_track,
author = {Lee, Dongkeun and Joo, Minwoo and Lee, Wonjun},
title = {Net-track: Generic Web Tracking Detection Using Packet Metadata},
booktitle = {Proceedings of the ACM Web Conference},
year = {2023},
series = {TheWebConf 2023},
doi = {10.1145/3543507.3583372},
}
@inproceedings{rasaii2023_thou,
author = {Rasaii, Ali and Gosain, Devashish and Gasser, Oliver},
title = {Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624846},
}
@inproceedings{bottger2025_regional,
author = {B\"ottger, Christian and Demir, Nurullah and H\"ornemann, Jan and Acharya, Bhupendra and Pohlmann, Norbert and Holz, Thorsten and Grosse-Kampmann, Matteo and Urban, Tobias},
title = {Understanding Regional Filter Lists: Efficacy and Impact},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {2},
pages = {309--325},
doi = {10.56553/popets-2025-0063},
}
@inproceedings{rasaii2025_crumbs,
author = {Rasaii, Ali and Dao, Ha and Feldmann, Anja and Javid, Mohammadmahdi and Gasser, Oliver and Gosain, Devashish},
title = {Intractable Cookie Crumbs: Unveiling the Nexus of Stateful Banner Interaction and Tracking Cookies},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {4},
pages = {429--445},
doi = {10.56553/popets-2025-0138},
}
@inproceedings{rieder2025_beyond,
author = {Rieder, Wolf and Raschke, Philip and Cory, Thomas},
title = {Beyond the Request: Harnessing HTTP Response Headers for Cross-Browser Web Tracker Detection in an Imbalanced Setting},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {1},
pages = {100--117},
doi = {10.56553/popets-2025-0007},
}
@inproceedings{shuang2025_duumviri,
author = {Shuang, He and Zhao, Lianying and Lie, David},
title = {Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/duumviri-detecting-trackers-and-mixed-trackers-with-a-breakage-detector/},
}
@inproceedings{tang2025_navigating,
author = {Tang, Brian and Bui, Duc and Shin, Kang G.},
title = {Navigating Cookie Consent Violations Across the Globe},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/tang},
}
@inproceedings{xiong2026_tgnn,
author = {Xiong, Shenping and Wang, Xutong and Jin, Ze and Liu, Xinyu and Wang, Haoqiang and Chen, Zhen and Tan, Ru and Liu, Qixu},
title = {TGNN: Enhancing Pixel Tracking Detection via LLM-driven Annotation and GAT-powered Structural Representation},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792149},
}
@inproceedings{lim2026_adversa,
author = {Lim, Chaejin and Lee, Kiho and Jin, Beomjin and Baek, Heewon and Kim, Hyoungshick},
title = {AdVersa: Adversarially-Robust and Practical Ad and Tracker Blocking in the Wild},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
pages = {3519--3530},
doi = {10.1145/3774904.3792735},
}
@inproceedings{intumwayase2025_continents,
author = {Intumwayase, Jean Luc and Fouad, Imane and Laperdrix, Pierre and Rouvoy, Romain},
title = {Exploring the Enforcement of Cookie Notices across Continents: An Empirical Study},
booktitle = {Proceedings of the 24th Workshop on Privacy in the Electronic Society},
year = {2025},
series = {WPES 2025},
doi = {10.1145/3733802.3764052},
}
@inproceedings{aqeel2020_landing,
author = {Aqeel, Waqar and Chandrasekaran, Balakrishnan and Feldmann, Anja and Maggs, Bruce M.},
title = {On Landing and Internal Web Pages: The Strange Case of Jekyll and Hyde in Web Performance Measurement},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
pages = {680--695},
doi = {10.1145/3419394.3423626},
}
@inproceedings{ahmad2020_apophanies,
author = {Ahmad, Syed Suleman and Dar, Muhammad Daniyal and Zaffar, Muhammad Fareed and Vallina-Rodriguez, Narseo and Nithyanand, Rishab},
title = {Apophanies or Epiphanies? How Crawlers Impact Our Understanding of the Web},
booktitle = {Proceedings of The Web Conference},
year = {2020},
series = {WWW 2020},
pages = {271--280},
doi = {10.1145/3366423.3380113},
}
@inproceedings{demir2023_similarity,
author = {Demir, Nurullah and H{\"o}rnemann, Jan and Gro{\ss}e-Kampmann, Matteo and Urban, Tobias and Pohlmann, Norbert and Holz, Thorsten and Wressnegger, Christian},
title = {On the Similarity of Web Measurements Under Different Experimental Setups},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
pages = {356--369},
doi = {10.60882/cispa.32825669},
note = {ACM DOI 10.1145/3618257.3624795 is listed by DBLP but was not registered with the DOI resolver as of 2026-08-12; the DOI above resolves to the authors' institutional record of the same paper},
}
@inproceedings{ukani2025_local,
author = {Ukani, Alisha and Haddadi, Hamed and Snoeren, Alex C. and Snyder, Peter},
title = {Local Frames: Exploiting Inherited Origins to Bypass Content Blockers},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
pages = {1349--1363},
doi = {10.1145/3719027.3744843},
}
@inproceedings{zhu2025_toward,
author = {Zhu, Jingyuan and Sun, Huanchen and Madhyastha, Harsha V.},
title = {Toward Better Efficiency vs. Fidelity Tradeoffs in Web Archives},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
pages = {1025--1031},
doi = {10.1145/3730567.3764507},
}
@article{nenadic2026_swiss,
author = {Nenadi{\'c}, Luka and Rodriguez, David and Calandrino, Joseph A.},
title = {Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {4},
pages = {703--723},
doi = {10.56553/popets-2026-0141},
}
@inproceedings{cuevas2026_chameleon,
author = {Cuevas, Alejandro and Ribeiro, Manoel Horta and Christin, Nicolas},
title = {Chameleon Channels: Measuring YouTube Accounts Repurposed for Deception and Profit},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/cuevas},
}
@inproceedings{hantke2024_redlines,
author = {Hantke, Florian and Roth, Sebastian and Mrowczynski, Rafael and Utz, Christine and Stock, Ben},
title = {Where Are the Red Lines? Towards Ethical Server-Side Scans in Security and Privacy Research},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00104},
}
@inproceedings{klemmer2025_transparency,
author = {Klemmer, Jan H. and Schmüser, Juliane and Lowens, Byron M. and Fischer, Fabian and Schmüser, Lea and Schaub, Florian and Fahl, Sascha},
title = {Transparency in Usable Privacy and Security Research: Scholars' Perspectives, Practices, and Recommendations},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00038},
}
@inproceedings{frank2024_representative,
author = {Frank, Joel and Herbert, Franziska and Ricker, Jonas and Schönherr, Lea and Eisenhofer, Thorsten and Fischer, Asja and Dürmuth, Markus and Holz, Thorsten},
title = {A Representative Study on Human Detection of Artificially Generated Media Across Countries},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00159},
}
@inproceedings{story2022_nudges,
author = {Story, Peter and Smullen, Daniel and Chen, Rex and Yao, Yaxing and Acquisti, Alessandro and Cranor, Lorrie Faith and Sadeh, Norman and Schaub, Florian},
title = {Increasing Adoption of Tor Browser Using Informational and Planning Nudges},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.2478/popets-2022-0040},
}
@inproceedings{akgul2025_vpnads,
author = {Akgul, Omer and Roberts, Richard and Shroyer, Emma and Levin, Dave and Mazurek, Michelle L.},
title = {As Advertised? Understanding the Impact of Influencer VPN Ads},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/akgul},
}
@inproceedings{lee2023_adtargeting,
author = {Lee, Hao-Ping (Hank) and Logas, Jacob and Yang, Stephanie S. and Li, Zhouyu and Barbosa, Natã M. and Wang, Yang and Das, Sauvik},
title = {When and Why Do People Want Ad Targeting Explanations? Evidence from a Four-Week, Mixed-Methods Field Study},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S&P 2023},
doi = {10.1109/sp46215.2023.10179452},
}
@inproceedings{crowder2024_simply,
author = {Crowder, Rachel and Price, George and Groß, Thomas},
title = {Simply tell me how---On Trustworthiness and Technology Acceptance of Attribute-Based Credentials},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0129},
}
@inproceedings{petelka2025_restricting,
author = {Petelka, Justin and Berens, Benjamin and Sugatan, Carlo and Volkamer, Melanie and Schaub, Florian},
title = {Restricting the Link: Effects of Focused Attention and Time Delay on Phishing Warning Effectiveness},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00007},
}
@inproceedings{elbitar2025_rationales,
author = {Elbitar, Yusra and Hart, Alexander and Bugiel, Sven},
title = {The Power of Words: A Comprehensive Analysis of Rationales and Their Effects on Users' Permission Decisions},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/the-power-of-words-a-comprehensive-analysis-of-rationales-and-their-effects-on-users-permission-decisions/},
}
@inproceedings{chen2025_parents,
author = {Chen, Xiaowei and Distler, Verena and Gordon, Chloe and Yao, Yaxing and Teuber, Ziwen},
title = {Empowering Parents to Support Children's Online Security and Privacy: Findings from a Randomized Controlled Trial},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765214},
}
@inproceedings{hsieh2025_collusions,
author = {Hsieh, Jhih-Yi and Raghunathan, Aditi and Shah, Nihar B.},
title = {Vulnerability of Text-Matching in ML/AI Conference Reviewer Assignments to Collusions},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/hsieh},
}
@inproceedings{roch2026_xai,
author = {Roch, Neele and Sievers, Hannah and Zufferey, Noé and Zimmermann, Verena},
title = {You Know Why, but Still Rely: The Impact of Explainable AI on Trust, Task Load, and Performance in Cybersecurity Decision-Making},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/roch},
}
@inproceedings{wei2024_solk,
author = {Wei, Miranda and Mink, Jaron and Eiger, Yael and Kohno, Tadayoshi and Redmiles, Elissa M. and Roesner, Franziska},
title = {SoK (or SoLK?): On the Quantitative Study of Sociodemographic Factors and Computer Security Behaviors},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/wei-miranda-solk},
}
@inproceedings{zimmermann2025_visual,
author = {Zimmermann, Verena and Toth, Adrienn and Sievers, Hannah and Fanconi, Linda and Isenring, Yanis and Henz, Mona and Stöver, Alina and Gerber, Nina},
title = {Let's Get Visual - Testing Visual Analogies and Metaphors for Conveying Privacy Policies and Data Handling Information},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00240},
}
@inproceedings{seong2026_maca,
author = {Seong, Youn Jun and Oh, Ha Young},
title = {MACA: A Multi-Agent Cognitive Adaptation Framework for Human-Agent Collaborative Decision Making},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792921},
}
@inproceedings{gross2021_iuipc,
author = {Groß, Thomas},
title = {Validity and Reliability of the Scale Internet Users' Information Privacy Concerns (IUIPC)},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2021},
series = {PoPETs 2021},
doi = {10.2478/popets-2021-0026},
}
@inproceedings{tang2021_defining,
author = {Tang, Jenny and Shoemaker, Hannah and Lerner, Ada and Birrell, Eleanor},
title = {Defining Privacy: How Users Interpret Technical Terms in Privacy Policies},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2021},
series = {PoPETs 2021},
doi = {10.2478/popets-2021-0038},
}
@inproceedings{cockburn2018_hark,
author = {Cockburn, Andy and Gutwin, Carl and Dix, Alan},
title = {HARK No More: On the Preregistration of CHI Experiments},
booktitle = {Proceedings of the CHI Conference on Human Factors in Computing Systems},
year = {2018},
series = {CHI 2018},
doi = {10.1145/3173574.3173715},
}
@article{chambers2022_registered,
author = {Chambers, Christopher D. and Tzavella, Loukia},
title = {The past, present and future of Registered Reports},
journal = {Nature Human Behaviour},
volume = {6},
number = {1},
pages = {29--42},
year = {2022},
doi = {10.1038/s41562-021-01193-7},
}
@inproceedings{lecuyer2015_sunlight,
author = {Lécuyer, Mathias and Spahn, Riley and Spiliopolous, Yannis and Chaintreau, Augustin and Geambasu, Roxana and Hsu, Daniel J.},
title = {Sunlight: Fine-grained Targeting Detection at Scale with Statistical Confidence},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2015},
series = {CCS 2015},
doi = {10.1145/2810103.2813614},
}
@inproceedings{datta2015_automated,
author = {Datta, Amit and Tschantz, Michael Carl and Datta, Anupam},
title = {Automated Experiments on Ad Privacy Settings},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2015},
series = {PoPETs 2015},
doi = {10.1515/popets-2015-0007},
}
@inproceedings{weinberg2017_topics,
author = {Weinberg, Zachary and Sharif, Mahmood and Szurdi, Janos and Christin, Nicolas},
title = {Topics of Controversy: An Empirical Analysis of Web Censorship Lists},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2017},
series = {PoPETs 2017},
doi = {10.1515/popets-2017-0004},
}
@inproceedings{zimmeck2024_website,
author = {Zimmeck, Sebastian and Goldelman, Daniel and Kaplan, Owen and Brown, Logan and Casler, Justin and Jean-Charles, Judeley and Champeau, Joe and Harkous, Hamza},
title = {Website Data Transparency in the Browser},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0048},
}
@inproceedings{valapu2025_binary,
author = {Valapu, Sulyab Thottungal and Heidemann, John S.},
title = {Towards a Non-Binary View of IPv6 Adoption},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764467},
}
@inproceedings{maass2021_effective,
author = {Maass, Max and Stöver, Alina and Pridöhl, Henning and Bretthauer, Sebastian and Herrmann, Dominik and Hollick, Matthias and Spiecker, Indra},
title = {Effective Notification Campaigns on the Web: A Matter of Trust, Framing, and Support},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/maass},
}
@inproceedings{liu2024_opted,
author = {Liu, Zengrui and Iqbal, Umar and Saxena, Nitesh},
title = {Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0016},
}
@inproceedings{bouhoula2024_automated,
author = {Bouhoula, Ahmed and Kubicek, Karel and Zac, Amit and Cotrini, Carlos and Basin, David},
title = {Automated Large-Scale Analysis of Cookie Notice Compliance},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/bouhoula},
}
@inproceedings{bobek2026_community,
author = {Bobek, Michelle and Pröllochs, Nicolas},
title = {Community Fact-Checks Do Not Break Follower Loyalty},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792984},
}
@inproceedings{boettger2025_regional,
author = {Böttger, Christian and Demir, Nurullah and Hörnemann, Jan and Acharya, Bhupendra and Pohlmann, Norbert and Holz, Thorsten and Grosse-Kampmann, Matteo and Urban, Tobias},
title = {Understanding Regional Filter Lists: Efficacy and Impact},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
doi = {10.56553/popets-2025-0063},
}
@inproceedings{naji2025_responsibility,
author = {Naji, Houda and Reichmann, Felix and Bruns, Tobias and Sasse, M. Angela and Naiakshina, Alena},
title = {"It's not my responsibility to write them": An Empirical Study of Software Product Managers and Security Requirements},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/naji},
}
@inproceedings{goetzen2022_ctrl,
author = {Goetzen, Angelica and Dooley, Samuel and Redmiles, Elissa M.},
title = {Ctrl-Shift: How Privacy Sentiment Changed from 2019 to 2021},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0118},
}
@inproceedings{pu2016_model,
author = {Pu, Yu and Grossklags, Jens},
title = {Towards a Model on the Factors Influencing Social App Users' Valuation of Interdependent Privacy},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2016},
series = {PoPETs 2016},
doi = {10.1515/popets-2016-0005},
}
@inproceedings{ho2025_efficacy,
author = {Ho, Grant and Mirian, Ariana and Luo, Elisa and Tong, Khang and Lee, Euyhyun and Liu, Lin and Longhurst, Christopher A. and Dameff, Christian and Savage, Stefan and Voelker, Geoffrey M.},
title = {Understanding the Efficacy of Phishing Training in Practice},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00076},
}
@inproceedings{despres2024_best,
author = {Despres, Tess and Constantino, Marcelino Ayala and Lizola, Naomi Zacarias and Romero, Gerardo Sánchez and He, Shijing and Zhan, Xiao and Abdi, Noura and Abu-Salma, Ruba and Such, Jose and Bernd, Julia},
title = {"My Best Friend's Husband Sees and Knows Everything": A Cross-Contextual and Cross-Country Approach to Understanding Smart Home Privacy},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0124},
}
@inproceedings{kablo2023_privacy,
author = {Kablo, Emiram and Cabarcos, Patricia Arias},
title = {Privacy in the Age of Neurotechnology: Investigating Public Attitudes towards Brain Data Collection and Use},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2023},
series = {CCS 2023},
doi = {10.1145/3576915.3623164},
}
@article{holm1979_sequentially,
author = {Holm, Sture},
title = {A Simple Sequentially Rejective Multiple Test Procedure},
journal = {Scandinavian Journal of Statistics},
volume = {6},
pages = {65--70},
year = {1979},
url = {https://www.jstor.org/stable/4615733},
note = {No DOI: the identifier 10.2307/4615733 reported by OpenAlex is not a registered handle},
}
@article{benjamini1995_controlling,
author = {Benjamini, Yoav and Hochberg, Yosef},
title = {Controlling the False Discovery Rate: A Practical and Powerful Approach to Multiple Testing},
journal = {Journal of the Royal Statistical Society: Series B (Statistical Methodology)},
volume = {57},
number = {1},
pages = {289--300},
year = {1995},
doi = {10.1111/j.2517-6161.1995.tb02031.x},
}
@article{benjamini2001_control,
author = {Benjamini, Yoav and Yekutieli, Daniel},
title = {The Control of the False Discovery Rate in Multiple Testing under Dependency},
journal = {The Annals of Statistics},
volume = {29},
number = {4},
pages = {1165--1188},
year = {2001},
doi = {10.1214/aos/1013699998},
}
@article{storey2002_direct,
author = {Storey, John D.},
title = {A Direct Approach to False Discovery Rates},
journal = {Journal of the Royal Statistical Society: Series B (Statistical Methodology)},
volume = {64},
number = {3},
pages = {479--498},
year = {2002},
doi = {10.1111/1467-9868.00346},
}
@article{gelman2012_multiple,
author = {Gelman, Andrew and Hill, Jennifer and Yajima, Masanao},
title = {Why We (Usually) Don't Have to Worry About Multiple Comparisons},
journal = {Journal of Research on Educational Effectiveness},
volume = {5},
number = {2},
pages = {189--211},
year = {2012},
doi = {10.1080/19345747.2011.618213},
}
@article{gelman2014_statistical,
author = {Gelman, Andrew and Loken, Eric},
title = {The Statistical Crisis in Science},
journal = {American Scientist},
volume = {102},
number = {6},
pages = {460},
year = {2014},
doi = {10.1511/2014.111.460},
}
@article{wasserstein2016_asa,
author = {Wasserstein, Ronald L. and Lazar, Nicole A.},
title = {The ASA Statement on p-Values: Context, Process, and Purpose},
journal = {The American Statistician},
volume = {70},
number = {2},
pages = {129--133},
year = {2016},
doi = {10.1080/00031305.2016.1154108},
}
@article{rothman1990_adjustments,
author = {Rothman, Kenneth J.},
title = {No Adjustments Are Needed for Multiple Comparisons},
journal = {Epidemiology},
volume = {1},
number = {1},
pages = {43--46},
year = {1990},
doi = {10.1097/00001648-199001000-00010},
}
@article{perneger1998_bonferroni,
author = {Perneger, Thomas V.},
title = {What's Wrong with Bonferroni Adjustments},
journal = {BMJ},
volume = {316},
number = {7139},
pages = {1236--1238},
year = {1998},
doi = {10.1136/bmj.316.7139.1236},
}
@article{hopewell2025_consort,
author = {Hopewell, Sally and Chan, An-Wen and Collins, Gary S. and Hróbjartsson, Asbjørn and Moher, David and Schulz, Kenneth F. and others},
title = {CONSORT 2025 explanation and elaboration: updated guideline for reporting randomised trials},
journal = {BMJ},
volume = {389},
pages = {e081124},
year = {2025},
doi = {10.1136/bmj-2024-081124},
}
@article{brunner2000_nonparametric,
title = {The Nonparametric Behrens-Fisher Problem: Asymptotic Theory and a Small-Sample Approximation},
author = {Brunner, Edgar and Munzel, Ullrich},
journal = {Biometrical Journal},
volume = {42},
number = {1},
pages = {17--25},
year = {2000},
doi = {10.1002/(SICI)1521-4036(200001)42:1<17::AID-BIMJ17>3.0.CO;2-U}
}
@inproceedings{tang2025_misuse,
title = {Misuse, Misreporting, Misinterpretation of Statistical Methods in Usable Privacy and Security Papers},
author = {Tang, Jenny and Bauer, Lujo and Christin, Nicolas},
booktitle = {Proceedings of the Twenty-First Symposium on Usable Privacy and Security (SOUPS)},
pages = {475--493},
year = {2025},
publisher = {USENIX Association},
url = {https://www.usenix.org/conference/soups2025/presentation/tang}
}
@article{wilcoxon1945_individual,
author = {Wilcoxon, Frank},
title = {Individual Comparisons by Ranking Methods},
journal = {Biometrics Bulletin},
volume = {1},
number = {6},
pages = {80},
year = {1945},
publisher = {JSTOR},
doi = {10.2307/3001968}
}
@article{mannwhitney1947_test,
author = {Mann, H. B. and Whitney, D. R.},
title = {On a Test of Whether one of Two Random Variables is Stochastically Larger than the Other},
journal = {The Annals of Mathematical Statistics},
volume = {18},
number = {1},
pages = {50--60},
year = {1947},
publisher = {Institute of Mathematical Statistics},
doi = {10.1214/aoms/1177730491}
}
@article{mcnemar1947_note,
author = {McNemar, Quinn},
title = {Note on the Sampling Error of the Difference Between Correlated Proportions or Percentages},
journal = {Psychometrika},
volume = {12},
number = {2},
pages = {153--157},
year = {1947},
publisher = {Cambridge University Press (CUP)},
doi = {10.1007/bf02295996}
}
@article{cochran1950_comparison,
author = {Cochran, W. G.},
title = {The Comparison of Percentages in Matched Samples},
journal = {Biometrika},
volume = {37},
number = {3-4},
pages = {256--266},
year = {1950},
publisher = {Oxford University Press (OUP)},
doi = {10.1093/biomet/37.3-4.256}
}
@article{divine2018_wilcoxon,
author = {Divine, George W. and Norton, H. James and Barón, Anna E. and Juarez-Colunga, Elizabeth},
title = {The Wilcoxon--Mann--Whitney Procedure Fails as a Test of Medians},
journal = {The American Statistician},
volume = {72},
number = {3},
pages = {278--286},
year = {2018},
publisher = {Informa UK Limited},
doi = {10.1080/00031305.2017.1305291}
}
@article{fagerland2009_scrutiny,
author = {Fagerland, Morten W. and Sandvik, Leiv},
title = {The Wilcoxon--Mann--Whitney test under scrutiny},
journal = {Statistics in Medicine},
volume = {28},
number = {10},
pages = {1487--1497},
year = {2009},
publisher = {Wiley},
doi = {10.1002/sim.3561}
}
@article{fagerland2012_paradox,
author = {Fagerland, Morten W},
title = {t-tests, non-parametric tests, and large studies—a paradox of statistical practice?},
journal = {BMC Medical Research Methodology},
volume = {12},
number = {1},
pages = {78},
year = {2012},
publisher = {Springer Science and Business Media LLC},
doi = {10.1186/1471-2288-12-78}
}
@article{rochon2012_totest,
author = {Rochon, Justine and Gondan, Matthias and Kieser, Meinhard},
title = {To test or not to test: Preliminary assessment of normality when comparing two independent samples},
journal = {BMC Medical Research Methodology},
volume = {12},
number = {1},
year = {2012},
publisher = {Springer Science and Business Media LLC},
doi = {10.1186/1471-2288-12-81}
}
@article{rasch2011_pretesting,
author = {Rasch, Dieter and Kubinger, Klaus D. and Moder, Karl},
title = {The two-sample t test: pre-testing its assumptions does not pay off},
journal = {Statistical Papers},
volume = {52},
number = {1},
pages = {219--231},
year = {2011},
publisher = {Springer Science and Business Media LLC},
doi = {10.1007/s00362-009-0224-x}
}
@article{lumley2002_normality,
author = {Lumley, Thomas and Diehr, Paula and Emerson, Scott and Chen, Lu},
title = {The Importance of the Normality Assumption in Large Public Health Data Sets},
journal = {Annual Review of Public Health},
volume = {23},
number = {1},
pages = {151--169},
year = {2002},
publisher = {Annual Reviews},
doi = {10.1146/annurev.publhealth.23.100901.140546}
}
@article{lilliefors1967_kolmogorov,
author = {Lilliefors, Hubert W.},
title = {On the Kolmogorov-Smirnov Test for Normality with Mean and Variance Unknown},
journal = {Journal of the American Statistical Association},
volume = {62},
number = {318},
pages = {399--402},
year = {1967},
publisher = {Informa UK Limited},
doi = {10.1080/01621459.1967.10482916}
}
@article{lydersen2009_recommended,
author = {Lydersen, Stian and Fagerland, Morten W. and Laake, Petter},
title = {Recommended tests for association in 2×2 tables},
journal = {Statistics in Medicine},
volume = {28},
number = {7},
pages = {1159--1175},
year = {2009},
publisher = {Wiley},
doi = {10.1002/sim.3531}
}
@article{campbell2007_chisquared,
author = {Campbell, Ian},
title = {Chi‐squared and Fisher--Irwin tests of two‐by‐two tables with small sample recommendations},
journal = {Statistics in Medicine},
volume = {26},
number = {19},
pages = {3661--3675},
year = {2007},
publisher = {Wiley},
doi = {10.1002/sim.2832}
}
@article{cameron2015_practitioners,
author = {Colin Cameron, A. and Miller, Douglas L.},
title = {A Practitioner’s Guide to Cluster-Robust Inference},
journal = {Journal of Human Resources},
volume = {50},
number = {2},
pages = {317--372},
year = {2015},
publisher = {University of Wisconsin Press},
doi = {10.3368/jhr.50.2.317}
}
@inproceedings{sarabi2025_ransomware,
author = {Sarabi, Armin and Huang, Ziyuan and Wang, Chenlan and Karir, Tai and Liu, Mingyan},
title = {The Ransomware Decade: The Creation of a Fine-Grained Dataset and a Longitudinal Study},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/sarabi},
}
@inproceedings{mai2025_more,
author = {Mai, Cat and Coelho, Bruno and Kieserman, Julia and Matsumoto, Lexie and Spinelli, Kyle and Yang, Eric and Andreou, Athanasios and Greenstadt, Rachel and Lauinger, Tobias and McCoy, Damon},
title = {More and Scammier Ads: The Perils of YouTube's Ad Privacy Settings},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
doi = {10.56553/popets-2025-0169},
}
@inproceedings{fouad2022_cookie,
author = {Fouad, Imane and Santos, Cristiana and Legout, Arnaud and Bielova, Nataliia},
title = {My Cookie is a phoenix: detection, measurement, and lawfulness of cookie respawning with browser fingerprinting},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0063},
}
@inproceedings{zimmeck2017_privacy,
author = {Zimmeck, Sebastian and Li, Jie S. and Kim, Hyungtae and Bellovin, Steven M. and Jebara, Tony},
title = {A Privacy Analysis of Cross-device Tracking},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2017},
series = {USENIX Security 2017},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/zimmeck},
}
@inproceedings{li2017_security,
author = {Li, Frank and Paxson, Vern},
title = {A Large-Scale Empirical Study of Security Patches},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2017},
series = {CCS 2017},
doi = {10.1145/3133956.3134072},
}
@inproceedings{schiele2025_limited,
author = {Schiele, Nathan Daniel and Gadyatskaya, Olga},
title = {A limited technical background is sufficient for attack-defense tree acceptability},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/schiele},
}
@inproceedings{becerrilarreola2023_method,
author = {Becerril-Arreola, Rafael},
title = {A Method to Assess and Explain Disparate Impact in Online Retailing},
booktitle = {Proceedings of the ACM Web Conference},
year = {2023},
series = {TheWebConf 2023},
doi = {10.1145/3543507.3583270},
}
@inproceedings{schloegel2024_prudent,
author = {Schloegel, Moritz and Bars, Nils and Schiller, Nico and Bernhard, Lukas and Scharnowski, Tobias and Crump, Addison and Ebrahim, Arash Ale and Bissantz, Nicolai and Muench, Marius and Holz, Thorsten},
title = {SoK: Prudent Evaluation Practices for Fuzzing},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00137},
}
@inproceedings{klees2018_evaluating,
author = {Klees, George and Ruef, Andrew and Cooper, Benji and Wei, Shiyi and Hicks, Michael},
title = {Evaluating Fuzz Testing},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2018},
series = {CCS 2018},
doi = {10.1145/3243734.3243804},
}
@inproceedings{monzani2026_unveiling,
author = {Monzani, Andrea and Parata, Antonio and Oliveri, Andrea and Aonzo, Simone and Balzarotti, Davide and Lanzi, Andrea},
title = {Unveiling BYOVD Threats: Malware’s Use and Abuse of Kernel Drivers},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/unveiling-byovd-threats-malwares-use-and-abuse-of-kernel-drivers/},
}
@inproceedings{razuvayevskaya2026_truth,
author = {Razuvayevskaya, Olesya and Bontcheva, Kalina},
title = {Truth with a Twist: The Rhetoric of Persuasion in Professional vs. Community-Authored Fact-Checks},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792938},
}
@inproceedings{dechand2016_textual,
author = {Dechand, Sergej and Schürmann, Dominik and Busse, Karoline and Acar, Yasemin and Fahl, Sascha and Smith, Matthew},
title = {An Empirical Study of Textual Key-Fingerprint Representations},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2016},
series = {USENIX Security 2016},
url = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/dechand},
}
@inproceedings{umayya2023_ptperf,
author = {Umayya, Zeya and Malik, Dhruv and Gosain, Devashish and Sharma, Piyush Kumar},
title = {PTPerf: On the Performance Evaluation of Tor Pluggable Transports},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624817},
}
@inproceedings{durumeric2014_heartbleed,
author = {Durumeric, Zakir and Kasten, James and Adrian, David and Halderman, J. Alex and Bailey, Michael D. and Li, Frank and Weaver, Nicholas and Amann, Johanna and Beekman, Jethro and Payer, Mathias and Paxson, Vern},
title = {The Matter of Heartbleed},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2014},
series = {IMC 2014},
doi = {10.1145/2663716.2663755},
}
@inproceedings{canali2013_hosting,
author = {Canali, Davide and Balzarotti, Davide and Francillon, Aurélien},
title = {The Role of Web Hosting Providers in Detecting Compromised Websites},
booktitle = {Proceedings of the ACM Web Conference},
year = {2013},
series = {TheWebConf 2013},
doi = {10.1145/2488388.2488405},
}
@inproceedings{stock2016_hey,
author = {Stock, Ben and Pellegrino, Giancarlo and Rossow, Christian and Johns, Martin and Backes, Michael},
title = {Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2016},
series = {USENIX Security 2016},
url = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/stock},
}
@inproceedings{li2016_youve,
author = {Li, Frank and Durumeric, Zakir and Czyz, Jakub and Karami, Mohammad and Bailey, Michael and McCoy, Damon and Savage, Stefan and Paxson, Vern},
title = {You've Got Vulnerability: Exploring Effective Vulnerability Notifications},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2016},
series = {USENIX Security 2016},
url = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/li},
}
@inproceedings{li2016_remedying,
author = {Li, Frank and Ho, Grant and Kuan, Eric and Niu, Yuan and Ballard, Lucas and Thomas, Kurt and Bursztein, Elie and Paxson, Vern},
title = {Remedying Web Hijacking: Notification Effectiveness and Webmaster Comprehension},
booktitle = {Proceedings of the ACM Web Conference},
year = {2016},
series = {TheWebConf 2016},
doi = {10.1145/2872427.2883039},
}
@inproceedings{gamerogarrido2017_legalrisks,
author = {Gamero-Garrido, Alexander and Savage, Stefan and Levchenko, Kirill and Snoeren, Alex C.},
title = {Quantifying the Pressure of Legal Risks on Third-party Vulnerability Research},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2017},
series = {CCS 2017},
doi = {10.1145/3133956.3134047},
}
@inproceedings{stock2018_didnt,
author = {Stock, Ben and Pellegrino, Giancarlo and Li, Frank and Backes, Michael and Rossow, Christian},
title = {Didn't You Hear Me? -- Towards More Successful Web Vulnerability Notifications},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2018},
series = {NDSS 2018},
doi = {10.14722/ndss.2018.23171},
}
@inproceedings{cetin2019_cleaning,
author = {Cetin, Orcun and Gañán, Carlos and Altena, Lisette and Kasama, Takahiro and Inoue, Daisuke and Tamiya, Kazuki and Tie, Ying and Yoshioka, Katsunari and van Eeten, Michel},
title = {Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
url = {https://www.ndss-symposium.org/ndss-paper/cleaning-up-the-internet-of-evil-things-real-world-evidence-on-isp-and-consumer-efforts-to-remove-mirai/},
}
@inproceedings{lu2021_whowas,
author = {Lu, Chaoyi and Liu, Baojun and Zhang, Yiming and Li, Zhou and Zhang, Fenglu and Duan, Haixin and Liu, Ying and Chen, Joann Qiongna and Liang, Jinjin and Zhang, Zaifeng and Hao, Shuang and Yang, Min},
title = {From WHOIS to WHOWAS: A Large-Scale Measurement Study of Domain Registration Privacy under the GDPR},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr/},
}
@inproceedings{poteat2021_securitytxt,
author = {Poteat, Tara and Li, Frank},
title = {Who You Gonna Call? An Empirical Evaluation of Website security.txt Deployment},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487841},
}
@inproceedings{nguyen2021_sharefirst,
author = {Nguyen, Trung Tin and Backes, Michael and Marnau, Ninja and Stock, Ben},
title = {Share First, Ask Later (or Never?) Studying Violations of GDPR's Explicit Consent in Android Apps},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/nguyen},
}
@inproceedings{squarcina2021_subdomain,
author = {Squarcina, Marco and Tempesta, Mauro and Veronese, Lorenzo and Calzavara, Stefano and Maffei, Matteo},
title = {Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/squarcina},
}
@inproceedings{lone2022_sav,
author = {Lone, Qasim and Frik, Alisa and Luckie, Matthew and Korczyński, Maciej and van Eeten, Michel and Gañán, Carlos},
title = {Deployment of Source Address Validation by Network Operators: A Randomized Control Trial},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2022},
series = {IEEE S&P 2022},
doi = {10.1109/sp46214.2022.9833701},
}
@inproceedings{sasaki2022_ics,
author = {Sasaki, Takayuki and Fujita, Akira and Gañán, Carlos Hernandez and van Eeten, Michel and Yoshioka, Katsunari and Matsumoto, Tsutomu},
title = {Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote Management Devices},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2022},
series = {IEEE S&P 2022},
doi = {10.1109/sp46214.2022.9833730},
}
@inproceedings{bennett2022_spfail,
author = {Bennett, Nathaniel and Sowards, Rebekah and Deccio, Casey T.},
title = {SPFail: Discovering, Measuring, and Remediating Vulnerabilities in Email Sender Validation},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561468},
}
@inproceedings{utz2023_comparing,
author = {Utz, Christine and Michels, Matthias and Degeling, Martin and Marnau, Ninja and Stock, Ben},
title = {Comparing Large-Scale Privacy and Security Notifications},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
series = {PoPETs 2023},
doi = {10.56553/popets-2023-0076},
}
@inproceedings{stoever2023_owners,
author = {Stöver, Alina and Gerber, Nina and Pridöhl, Henning and Maass, Max and Bretthauer, Sebastian and Spiecker gen. Döhmann, Indra and Hollick, Matthias and Herrmann, Dominik},
title = {How Website Owners Face Privacy Issues: Thematic Analysis of Responses from a Covert Notification Study Reveals Diverse Circumstances and Challenges},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
series = {PoPETs 2023},
doi = {10.56553/popets-2023-0051},
}
@inproceedings{qin2024_rov,
author = {Qin, Lancheng and Chen, Li and Li, Dan and Ye, Honglin and Wang, Yutian},
title = {Understanding Route Origin Validation (ROV) Deployment in the Real World and Why MANRS Action 1 Is Not Followed},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2024},
series = {NDSS 2024},
url = {https://www.ndss-symposium.org/ndss-paper/understanding-route-origin-validation-rov-deployment-in-the-real-world-and-why-manrs-action-1-is-not-followed/},
}
@inproceedings{elyadmani2025_keys,
author = {El Yadmani, Soufian and Gadyatskaya, Olga and Zhauniarovich, Yury},
title = {The File That Contained the Keys Has Been Removed: An Empirical Analysis of Secret Leaks in Cloud Buckets and Responsible Disclosure Outcomes},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00009},
}
@inproceedings{munteanu2025_catch22,
author = {Munteanu, Cristian and Smaragdakis, Georgios and Feldmann, Anja and Fiebig, Tobias},
title = {Catch-22: Uncovering Compromised Hosts using SSH Public Keys},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/munteanu},
}
@inproceedings{stivala2026_behind,
author = {Stivala, Giada and Mrowczynski, Rafael and Hellenthal, Maria and Pellegrino, Giancarlo},
title = {Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2026},
series = {IEEE S&P 2026},
doi = {10.1109/sp63933.2026.00036},
}
@inproceedings{lerner2017_rewriting,
author = {Lerner, Ada and Kohno, Tadayoshi and Roesner, Franziska},
title = {Rewriting History: Changing the Archived Web from the Present},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2017},
series = {CCS 2017},
pages = {1741--1755},
doi = {10.1145/3133956.3134042},
}
@article{singh2026_empire,
author = {Singh, Sachin Kumar and Mahmud, Faisal and Ricci, Robert and Siby, Sandra},
title = {The Empire Strikes Back (at Your Privacy): An Archaeology of Tracking on Government Websites},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {2},
pages = {108--126},
doi = {10.56553/popets-2026-0039},
}
@inproceedings{roth2022_security,
author = {Roth, Sebastian and Calzavara, Stefano and Wilhelm, Moritz and Rabitti, Alvise and Stock, Ben},
title = {The Security Lottery: Measuring Client-Side Web Security Inconsistencies},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
pages = {2047--2064},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/roth},
}
@inproceedings{singanamalla2022_respect,
author = {Singanamalla, Sudheesh and Paracha, Muhammad Talha and Ahmad, Suleman and Hoyland, Jonathan and Valenta, Luke and Safronov, Yevgen and Wu, Peter and Galloni, Andrew and Heimerl, Kurtis and Sullivan, Nick and Wood, Christopher A. and Fayed, Marwan},
title = {Respect the ORIGIN!: a best-case evaluation of connection coalescing in the wild},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561453},
}
@inproceedings{figueira2024_diffaudit,
author = {Figueira, Olivia and Trimananda, Rahmadi and Markopoulou, Athina and Jordan, Scott},
title = {DiffAudit: Auditing Privacy Practices of Online Services for Children and Adolescents},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3688416},
}
@inproceedings{karnam2026_setting,
author = {Karnam, Sai Keerthana and Dash, Abhisek and Das, Antariksh and Mousavi, Sepehr and Bechtold, Stefan and Gummadi, Krishna P. and Mukherjee, Animesh and Weber, Ingmar and Zannettou, Savvas},
title = {Setting the Course, but Forgetting to Steer: Analyzing Compliance with GDPR's Right of Access to Data by Instagram, TikTok, and Youtube},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2026},
series = {IEEE S&P 2026},
doi = {10.1109/sp63933.2026.00051},
}
@inproceedings{innocenti2025_only,
author = {Innocenti, Tommaso and Jannett, Louis and Mainka, Christian and Mladenov, Vladislav and Kirda, Engin},
title = {"Only as Strong as the Weakest Link": On the Security of Brokered Single Sign-On on the Web},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00024},
}
@inproceedings{hounsel2020_comparing,
author = {Hounsel, Austin and Borgolte, Kevin and Schmitt, Paul and Holland, Jordan and Feamster, Nick},
title = {Comparing the Effects of DNS, DoT, and DoH on Web Performance},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380139},
}
@inproceedings{butkiewicz2011_website,
author = {Butkiewicz, Michael and Madhyastha, Harsha V. and Sekar, Vyas},
title = {Understanding website complexity: measurements, metrics, and implications},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2011},
series = {IMC 2011},
doi = {10.1145/2068816.2068846},
}
@inproceedings{zhang2024_quic,
author = {Zhang, Xumiao and Jin, Shuowei and He, Yi and Hassan, Ahmad and Mao, Z. Morley and Qian, Feng and Zhang, Zhi-Li},
title = {QUIC is not Quick Enough over Fast Internet},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645323},
}
@inproceedings{wang2021_just,
author = {Wang, Kailong and Zhang, Junzhe and Bai, Guangdong and Ko, Ryan K. L. and Dong, Jin Song},
title = {It's Not Just the Site, It's the Contents: Intra-domain Fingerprinting Social Media Websites Through CDN Bursts},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450008},
}
@inproceedings{muthuraj2024_replication,
author = {Muthuraj, Naveenraj and Eghbal, Nooshin and Lu, Paul},
title = {Replication: "Taking a long look at QUIC"},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3688453},
}
@inproceedings{chaqfeh2020_jscleaner,
author = {Chaqfeh, Moumena and Zaki, Yasir and Hu, Jacinta and Subramanian, Lakshmi},
title = {JSCleaner: De-Cluttering Mobile Webpages Through JavaScript Cleanup},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380157},
}
@article{trevisan2019_cookielaw,
author = {Trevisan, Martino and Traverso, Stefano and Bassi, Eleonora and Mellia, Marco},
title = {4 Years of EU Cookie Law: Results and Lessons Learned},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2019},
volume = {2019},
number = {2},
pages = {126--145},
doi = {10.2478/popets-2019-0023},
}
@article{kollnig2022_iphones,
author = {Kollnig, Konrad and Shuba, Anastasia and Binns, Reuben and Van Kleek, Max and Shadbolt, Nigel},
title = {Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
volume = {2022},
number = {2},
pages = {6--24},
doi = {10.2478/popets-2022-0033},
}
@article{siby2023_quic,
author = {Siby, Sandra and Barman, Ludovic and Wood, Christopher and Fayed, Marwan and Sullivan, Nick and Troncoso, Carmela},
title = {Evaluating Practical QUIC Website Fingerprinting Defenses for the Masses},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {4},
pages = {79--95},
doi = {10.56553/popets-2023-0099},
}
@inproceedings{borgolte2020_performance,
author = {Borgolte, Kevin and Feamster, Nick},
title = {Understanding the Performance Costs and Benefits of Privacy-focused Browser Extensions},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380292},
}
@inproceedings{englehardt2015_cookies,
author = {Englehardt, Steven and Reisman, Dillon and Eubank, Christian and Zimmerman, Peter and Mayer, Jonathan R. and Narayanan, Arvind and Felten, Edward W.},
title = {Cookies That Give You Away: The Surveillance Implications of Web Tracking},
booktitle = {Proceedings of the ACM Web Conference},
year = {2015},
series = {TheWebConf 2015},
doi = {10.1145/2736277.2741679},
}
@article{englehardt2018_email,
author = {Englehardt, Steven and Han, Jeffrey and Narayanan, Arvind},
title = {I never signed up for this! Privacy implications of email tracking},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2018},
volume = {2018},
number = {1},
pages = {109--126},
doi = {10.1515/popets-2018-0006},
}
@inproceedings{das2018_sixth,
author = {Das, Anupam and Acar, Gunes and Borisov, Nikita and Pradeep, Amogh},
title = {The Web's Sixth Sense: A Study of Scripts Accessing Smartphone Sensors},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2018},
series = {CCS 2018},
doi = {10.1145/3243734.3243860},
}
@article{acar2020_noboundaries,
author = {Acar, Gunes and Englehardt, Steven and Narayanan, Arvind},
title = {No boundaries: data exfiltration by third parties embedded on web pages},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
volume = {2020},
number = {4},
pages = {220--238},
doi = {10.2478/popets-2020-0070},
}
@article{utz2023_rarely,
author = {Utz, Christine and Amft, Sabrina and Degeling, Martin and Holz, Thorsten and Fahl, Sascha and Schaub, Florian},
title = {Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {1},
pages = {5--28},
doi = {10.56553/popets-2023-0002},
}
@article{fouad2024_devil,
author = {Fouad, Imane and Santos, Cristiana and Laperdrix, Pierre},
title = {The Devil is in the Details: Detection, Measurement and Lawfulness of Server-Side Tracking on the Web},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
volume = {2024},
number = {4},
pages = {450--465},
doi = {10.56553/popets-2024-0125},
}
@inproceedings{agarwal2020_stop,
author = {Agarwal, Pushkal and Joglekar, Sagar and Papadopoulos, Panagiotis and Sastry, Nishanth and Kourtellis, Nicolas},
title = {Stop tracking me Bro! Differential Tracking of User Demographics on Hyper-Partisan Websites},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380221},
}
@inproceedings{senol2022_leaky,
author = {Senol, Asuman and Acar, Gunes and Humbert, Mathias and Zuiderveen Borgesius, Frederik},
title = {Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission},
booktitle = {31st USENIX Security Symposium (USENIX Security 22)},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/senol},
}
@inproceedings{torres2023_wallet,
author = {Ferreira Torres, Christof and Willi, Fiona and Shinde, Shweta},
title = {Is Your Wallet Snitching On You? An Analysis on the Privacy Implications of Web3},
booktitle = {32nd USENIX Security Symposium (USENIX Security 23)},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/torres},
}
@inproceedings{aziz2024_johnny,
author = {Aziz, Muhammad Abu Bakar and Wilson, Christo},
title = {Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
volume = {2024},
number = {3},
doi = {10.56553/popets-2024-0120},
}
@inproceedings{senol2024_double,
author = {Senol, Asuman and Ukani, Alisha and Cutler, Dylan and Bilogrevic, Igor},
title = {The Double Edged Sword: Identifying Authentication Pages and their Fingerprinting Behavior},
booktitle = {Proceedings of the ACM Web Conference 2024},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645493},
}
@inproceedings{moti2024_targeted,
author = {Moti, Zahra and Senol, Asuman and Bostani, Hamid and Zuiderveen Borgesius, Frederik J. and Moonsamy, Veelasha and Mathur, Arunesh and Acar, Gunes},
title = {Targeted and Troublesome: Tracking and Advertising on Children's Websites},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S\&P 2024},
doi = {10.1109/SP54263.2024.00118},
}
@inproceedings{zagi2025_referrer,
author = {Zagi, Luqman and Moti, Zahra and Acar, Gunes},
title = {Referrer Policy: Implementation and Circumvention},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {3},
doi = {10.56553/popets-2025-0092},
}
@inproceedings{roongta2025_sheep,
author = {Roongta, Ritik and Jose, Julia and Habib, Hussam and Greenstadt, Rachel},
title = {Sheep's Clothing, Wolfish Intent: Automated Detection and Evaluation of Problematic 'Allowed' Advertisements},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {3},
doi = {10.56553/popets-2025-0142},
}
@inproceedings{vlummens2026_bridges,
author = {Vlummens, Tim and Girish, Aniketh and Weerasekara, Nipuna and Zuiderveen Borgesius, Frederik and Acar, Gunes and Vallina-Rodriguez, Narseo},
title = {Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/vlummens},
}
@misc{duckduckgo_trc_2026,
author = {{DuckDuckGo}},
title = {Tracker Radar Collector},
year = {2026},
howpublished = {GitHub repository},
url = {https://github.com/duckduckgo/tracker-radar-collector},
note = {Source and README checked at main commit 8b64006691a1ce3929cfdfeeb425e7cc64be6543 on 2026-08-14},
}
@misc{duckduckgo_tracker_radar_2026,
author = {{DuckDuckGo}},
title = {DuckDuckGo Tracker Radar},
year = {2026},
howpublished = {GitHub repository and data model},
url = {https://github.com/duckduckgo/tracker-radar},
note = {README and docs/DATA_MODEL.md checked at main commit a1d894db2312f3fdeea06d6c784739b97eb727c8 on 2026-08-14},
}
@misc{duckduckgo_tracker_radar_detector_2026,
author = {{DuckDuckGo}},
title = {DuckDuckGo Tracker Radar Detector},
year = {2026},
howpublished = {GitHub repository},
url = {https://github.com/duckduckgo/tracker-radar-detector},
note = {README and build scripts checked at main commit 0f6eb7db39bbf7cf7357db7279535941e1c0eb4b on 2026-08-14},
}
@inproceedings{jueckstock2022_privacy,
author = {Jueckstock, Jordan and Snyder, Peter and Sarker, Shaown and Kapravelos, Alexandros and Livshits, Benjamin},
title = {Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking},
booktitle = {Proceedings of the ACM Web Conference},
year = {2022},
series = {TheWebConf 2022},
doi = {10.1145/3485447.3512231},
}
@inproceedings{libert2018_automated,
author = {Libert, Timothy},
title = {An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies},
booktitle = {Proceedings of the ACM Web Conference},
year = {2018},
series = {TheWebConf 2018},
doi = {10.1145/3178876.3186087},
}
@inproceedings{sanchezrola2021_journey,
author = {Sánchez-Rola, Iskander and Dell'Amico, Matteo and Balzarotti, Davide and Vervier, Pierre-Antoine and Bilge, Leyla},
title = {Journey to the Center of the Cookie Ecosystem: Unraveling Actors' Roles and Relationships},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2021},
series = {IEEE S&P 2021},
doi = {10.1109/sp40001.2021.9796062},
}
@inproceedings{dambra2022_sally,
author = {Dambra, Savino and Sanchez-Rola, Iskander and Bilge, Leyla and Balzarotti, Davide},
title = {When Sally Met Trackers: Web Tracking From the Users' Perspective},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/dambra},
}
@inproceedings{steffens2021_blockparty,
author = {Steffens, Marius and Musch, Marius and Johns, Martin and Stock, Ben},
title = {Who’s Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/whos-hosting-the-block-party-studying-third-party-blockage-of-csp-and-sri/},
}
@inproceedings{musa2022_atom,
author = {Musa, Maaz Bin and Nithyanand, Rishab},
title = {ATOM: Ad-network Tomography},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0110},
}
@inproceedings{yang2020_comparative,
author = {Yang, Zhiju and Yue, Chuan},
title = {A Comparative Measurement Study of Web Tracking on Mobile and Desktop Environments},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0016},
}
@inproceedings{mcquistin2023_psl,
author = {McQuistin, Stephen and Snyder, Peter and Perkins, Colin and Haddadi, Hamed and Tyson, Gareth},
title = {A First Look at the Privacy Harms of the Public Suffix List},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624836},
}
@inproceedings{kashaf2020_dependencies,
author = {Kashaf, Aqsa and Sekar, Vyas and Agarwal, Yuvraj},
title = {Analyzing Third Party Service Dependencies in Modern Web Services: Have We Learned from the Mirai-Dyn Incident?},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
doi = {10.1145/3419394.3423664},
}
@inproceedings{kats2022_search,
author = {Kats, Daniel and Silva, David Luz and Roturier, Johann},
title = {Who Knows I Like Jelly Beans? An Investigation Into Search Privacy},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.2478/popets-2022-0053},
}
@inproceedings{jakaria2024_dots,
author = {Jakaria, Md and Huang, Danny Yuxing and Das, Anupam},
title = {Connecting the Dots: Tracing Data Endpoints in IoT Devices},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0090},
}
@inproceedings{sorensen2019_beforeafter,
author = {Sørensen, Jannick Kirk and Kosta, Sokol},
title = {Before and After GDPR: The Changes in Third Party Presence at Public and Private European Websites},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313524},
}
@inproceedings{jannett2026_passkeys,
author = {Jannett, Louis and Mayer, Andreas and Westers, Maximilian and Mladenov, Vladislav and Mainka, Christian and Schwenk, Jörg},
title = {The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/jannett},
}
@inproceedings{cui2023_poligraph,
author = {Cui, Hao and Trimananda, Rahmadi and Markopoulou, Athina and Jordan, Scott},
title = {PoliGraph: Automated Privacy Policy Analysis using Knowledge Graphs},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/cui},
}
@inproceedings{wu2025_appprivacyreport,
author = {Wu, Xiaoyuan and Hu, Lydia and Zeng, Eric and Habib, Hana and Bauer, Lujo},
title = {Transparency or Information Overload? Evaluating Users’ Comprehension and Perceptions of the iOS App Privacy Report},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/transparency-or-information-overload-evaluating-users-comprehension-and-perceptions-of-the-ios-app-privacy-report/},
}
@inproceedings{gouda2025_prefix2org,
author = {Gouda, Deepak and Dainotti, Alberto and Testart, Cecilia},
title = {Prefix2Org: Mapping BGP Prefixes to Organizations},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764485},
}
@misc{karaj2018whotracksme,
author = {Karaj, Arjaldo and Macbeth, Sam and Berson, R{\'e}mi and Pujol, Josep M.},
title = {WhoTracks.Me: Shedding light on the opaque world of online tracking},
year = {2018},
eprint = {1804.08959},
archiveprefix = {arXiv},
primaryclass = {cs.CY},
note = {arXiv:1804.08959v2, revised 2019-04-25},
url = {https://arxiv.org/abs/1804.08959},
}
@inproceedings{lekies2013_million,
author = {Lekies, Sebastian and Stock, Ben and Johns, Martin},
title = {25 Million Flows Later: Large-scale Detection of DOM-based XSS},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2013},
series = {CCS 2013},
doi = {10.1145/2508859.2516703},
}
@inproceedings{stock2014_precise,
author = {Stock, Ben and Lekies, Sebastian and Mueller, Tobias and Spiegel, Patrick and Johns, Martin},
title = {Precise Client-side Protection against DOM-based Cross-Site Scripting},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2014},
series = {USENIX Security 2014},
url = {https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/stock},
}
@inproceedings{stock2015_facepalm,
author = {Stock, Ben and Pfistner, Stephan and Kaiser, Bernd and Lekies, Sebastian and Johns, Martin},
title = {From Facepalm to Brain Bender: Exploring Client-Side Cross-Site Scripting},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2015},
series = {CCS 2015},
doi = {10.1145/2810103.2813625},
}
@inproceedings{steffens2019_dont,
author = {Steffens, Marius and Rossow, Christian and Johns, Martin and Stock, Ben},
title = {Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
url = {https://www.ndss-symposium.org/ndss-paper/dont-trust-the-locals-investigating-the-prevalence-of-persistent-client-side-cross-site-scripting-in-the-wild/},
}
@inproceedings{kirchner2024_dancer,
author = {Kirchner, Robin and M\"oller, Jonas and Musch, Marius and Klein, David and Rieck, Konrad and Johns, Martin},
title = {Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/kirchner},
}
@inproceedings{khodayari2024_great,
author = {Khodayari, Soheil and Barber, Thomas and Pellegrino, Giancarlo},
title = {The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S\&P 2024},
doi = {10.1109/sp54263.2024.00098},
}
@inproceedings{rautenstrauch2024_auth,
author = {Rautenstrauch, Jannis and Mitkov, Metodi and Helbrecht, Thomas and Hetterich, Lorenz and Stock, Ben},
title = {To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S\&P 2024},
doi = {10.1109/sp54263.2024.00094},
}
@inproceedings{khodayari2025_follow,
author = {Khodayari, Soheil and Glauber, Kai and Pellegrino, Giancarlo},
title = {Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection/},
}
@inproceedings{calzavara2025_dynamic,
author = {Calzavara, Stefano and Casarin, Samuele and Focardi, Riccardo},
title = {Dynamic Security Analysis of JavaScript: Are We There Yet?},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714614},
}
@inproceedings{liu2025_domino,
author = {Liu, Zhengyu and Lee, Theo and Yu, Jianjia and Kang, Zifeng and Cao, Yinzhi},
title = {The DOMino Effect: Detecting and Exploiting DOM Clobbering Gadgets via Concolic Execution with Symbolic DOM},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/liu-zhengyu},
}
@inproceedings{drescher2025_trust,
author = {Drescher, Jan and Mirzaei, Sepehr and Khodayari, Soheil and Klein, David and Barber, Thomas and Johns, Martin and Pellegrino, Giancarlo},
title = {In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765117},
}
@inproceedings{sabino2026_detection,
author = {Sabino, Nuno and Cassel, Darion and Abreu, Rui and Ad\~ao, Pedro and Bauer, Lujo and Jia, Limin},
title = {DOM-XSS Detection via Webpage Interaction Fuzzing and URL Component Synthesis},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/dom-xss-detection-via-webpage-interaction-fuzzing-and-url-component-synthesis/},
}
@article{zimmeck2019_maps,
author = {Zimmeck, Sebastian and Story, Peter and Smullen, Daniel and Ravichander, Abhilasha and Wang, Ziqi and Reidenberg, Joel and Russell, N. Cameron and Sadeh, Norman},
title = {{MAPS}: Scaling Privacy Compliance Analysis to a Million Apps},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2019},
volume = {2019},
number = {3},
series = {PoPETs 2019},
doi = {10.2478/popets-2019-0037},
}
@article{feal2020_angel,
author = {Feal, Álvaro and Calciati, Paolo and Vallina-Rodriguez, Narseo and Troncoso, Carmela and Gorla, Alessandra},
title = {Angel or Devil? A Privacy Study of Mobile Parental Control Apps},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
volume = {2020},
number = {2},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0029},
}
@article{zimmeck2023_gpc,
author = {Zimmeck, Sebastian and Wang, Oliver and Alicki, Kuba and Wang, Jocelyn and Eng, Sophie},
title = {Usability and Enforceability of Global Privacy Control},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {2},
series = {PoPETs 2023},
doi = {10.56553/popets-2023-0052},
}
@article{girish2025_signal,
author = {Girish, Aniketh and Reardon, Joel and Tapiador, Juan and Matic, Srdjan and Vallina-Rodriguez, Narseo},
title = {Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-scanning {SDKs} in Android},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
volume = {2025},
number = {3},
series = {PoPETs 2025},
doi = {10.56553/popets-2025-0103},
}
@article{weerasekara2025_webviews,
author = {Weerasekara, Nipuna and Moreno, José Miguel and Matic, Srdjan and Reardon, Joel and Tapiador, Juan and Vallina-Rodríguez, Narseo},
title = {Tracking Without Borders: Studying the Role of {WebViews} in Bridging Mobile and Web Tracking},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
volume = {2025},
number = {4},
series = {PoPETs 2025},
doi = {10.56553/popets-2025-0155},
}
@article{morel2026_tcf,
author = {Morel, Victor and Santos, Cristiana and Carlsson, Pontus and Ahlinder, Joel and Duvignau, Romaric},
title = {The {TCF} doesn't really {A(A)ID} -- Automatic Privacy Analysis and Legal Compliance of {TCF}-based Android Applications},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {3},
series = {PoPETs 2026},
doi = {10.56553/popets-2026-0068},
}
@article{bogdanov2016_students,
author = {Bogdanov, Dan and Kamm, Liina and Kubo, Baldur and Rebane, Reimo and Sokk, Ville and Talviste, Riivo},
title = {Students and Taxes: a Privacy-Preserving Study Using Secure Computation},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2016},
volume = {2016},
number = {3},
series = {PoPETs 2016},
doi = {10.1515/popets-2016-0019},
}
@article{saemann2022_fines,
author = {Saemann, Marlene and Theis, Daniel and Urban, Tobias and Degeling, Martin},
title = {Investigating {GDPR} Fines in the Light of Data Flows},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
volume = {2022},
number = {4},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0111},
}
@article{sun2023_gdprxiv,
author = {Sun, Chen and Jacobs, Evan and Lehmann, Daniel and Crouse, Andrew and Shastri, Supreeth},
title = {{GDPRxiv}: Establishing the State of the Art in {GDPR} Enforcement},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {4},
series = {PoPETs 2023},
doi = {10.56553/popets-2023-0121},
}
@article{brookman2017_crossdevice,
author = {Brookman, Justin and Rouge, Phoebe and Alva, Aaron and Yeung, Christina},
title = {Cross-Device Tracking: Measurement and Disclosures},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2017},
volume = {2017},
number = {2},
series = {PoPETs 2017},
doi = {10.1515/popets-2017-0020},
}
@article{toth2022_darkpatterns,
author = {Toth, Michael and Bielova, Nataliia and Roca, Vincent},
title = {On dark patterns and manipulation of website publishers by {CMPs}},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
volume = {2022},
number = {3},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0082},
}
@inproceedings{reardon2019_50ways,
author = {Reardon, Joel and Feal, Álvaro and Wijesekera, Primal and Elazari Bar On, Amit and Vallina-Rodriguez, Narseo and Egelman, Serge},
title = {50 Ways to Leak Your Data: An Exploration of Apps' Circumvention of the Android Permissions System},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2019},
series = {USENIX Security 2019},
url = {https://www.usenix.org/conference/usenixsecurity19/presentation/reardon},
}
@inproceedings{zhang2025_qrcode,
author = {Zhang, Xin and Zhang, Xiaohan and Zhao, Bo and Nan, Yuhong and Liu, Zhichen and Chen, Jianzhou and Zhou, Huijun and Yang, Min},
title = {Demystifying the (In)Security of {QR} Code-based Login in Real-world Deployments},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-xin},
}
@inproceedings{jing2025_enforcement,
author = {Jing, Tao and Li, Yao and Ye, Jingzhou and Wang, Jie and Wang, Xueqiang},
title = {Privacy Law Enforcement Under Centralized Governance: A Qualitative Analysis of Four Years' Special Privacy Rectification Campaigns},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/jing},
}
@inproceedings{bielova2024_designpatterns,
author = {Bielova, Nataliia and Litvine, Laura and Nguyen, Anysia and Chammat, Mariam and Toubiana, Vincent and Hary, Estelle},
title = {The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/bielova},
}
@inproceedings{cheng2020_dangerous,
author = {Cheng, Long and Wilson, Christin and Liao, Song and Young, Jeffrey and Dong, Daniel and Hu, Hongxin},
title = {Dangerous Skills Got Certified: Measuring the Trustworthiness of Skill Certification in Voice Personal Assistant Platforms},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2020},
series = {CCS 2020},
doi = {10.1145/3372297.3423339},
}
@inproceedings{gamba2020_installed,
author = {Gamba, Julien and Rashed, Mohammed and Razaghpanah, Abbas and Tapiador, Juan and Vallina-Rodriguez, Narseo},
title = {An Analysis of Pre-installed Android Software},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2020},
series = {IEEE S\&P 2020},
doi = {10.1109/sp40000.2020.00013},
}
@inproceedings{iqbal2023_tracking,
author = {Iqbal, Umar and Bahrami, Pouneh Nikkhah and Trimananda, Rahmadi and Cui, Hao and Gamero-Garrido, Alexander and Dubois, Daniel J. and Choffnes, David R. and Markopoulou, Athina and Roesner, Franziska and Shafiq, Zubair},
title = {Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624803},
}
@inproceedings{yeung2023_online,
author = {Yeung, Christina and Iqbal, Umar and O'Neil, Yekaterina Tsipenyuk and Kohno, Tadayoshi and Roesner, Franziska},
title = {Online Advertising in Ukraine and Russia During the 2022 Russian Invasion},
booktitle = {Proceedings of the ACM Web Conference},
year = {2023},
series = {TheWebConf 2023},
doi = {10.1145/3543507.3583484},
}
@inproceedings{arunasalam2024_dark,
author = {Arunasalam, Arjun and Chu, Andrew and Ozmen, Muslum Ozgur and Farrukh, Habiba and Celik, Z. Berkay},
title = {The Dark Side of E-Commerce: Dropshipping Abuse as a Business Model},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2024},
series = {NDSS 2024},
url = {https://www.ndss-symposium.org/ndss-paper/the-dark-side-of-e-commerce-dropshipping-abuse-as-a-business-model/},
}
@inproceedings{murdoch2010_chip,
author = {Murdoch, Steven J. and Drimer, Saar and Anderson, Ross and Bond, Mike},
title = {Chip and {PIN} is Broken},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2010},
series = {IEEE S\&P 2010},
doi = {10.1109/sp.2010.33},
}
@inproceedings{girish2023_room,
author = {Girish, Aniketh and Hu, Tianrui and Prakash, Vijay and Dubois, Daniel J. and Matic, Srdjan and Huang, Danny Yuxing and Egelman, Serge and Reardon, Joel and Tapiador, Juan and Choffnes, David R. and Vallina-Rodriguez, Narseo},
title = {In the Room Where It Happens: Characterizing Local Communication and Threats in Smart Homes},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624830},
}
@inproceedings{singh2019_urban,
author = {Singh, Rajkarn and Fiore, Marco and Marina, Mahesh K. and Tarable, Alberto and Nordio, Alessandro},
title = {Urban Vibes and Rural Charms: Analysis of Geographic Diversity in Mobile Service Usage at National Scale},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313628},
}
@inproceedings{zanella2023_characterizing,
author = {Zanella, André Felipe and Bazco-Nogueras, Antonio and Ziemlicki, Cezary and Fiore, Marco},
title = {Characterizing and Modeling Session-Level Mobile Traffic Demands from Large-Scale Measurements},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624825},
}
@inproceedings{li2024_bounce,
author = {Li, Ruixuan and Xiao, Shaodong and Liu, Baojun and Lin, Yanzhong and Duan, Haixin and Pan, Qingfeng and Chen, Jianjun and Zhang, Jia and Liu, Ximeng and Lu, Xiuqi and Shao, Jun},
title = {Bounce in the Wild: A Deep Dive into Email Delivery Failures from a Large Email Service Provider},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3688425},
}
@inproceedings{bellini2024_safer,
author = {Bellini, Rosanna and Tseng, Emily and Warford, Noel and Daffalla, Alaa and Matthews, Tara and Consolvo, Sunny and Woelfer, Jill Palzkill and Kelley, Patrick Gage and Mazurek, Michelle L. and Cuomo, Dana and Dell, Nicola and Ristenpart, Thomas},
title = {SoK: Safer Digital-Safety Research Involving At-Risk Users},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00071},
}
@inproceedings{perez2021_smart,
author = {Perez, Daniel and Livshits, Benjamin},
title = {Smart Contract Vulnerabilities: Vulnerable Does Not Imply Exploited},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/perez},
}
@inproceedings{cui2013_when,
author = {Cui, Ang and Costello, Michael and Stolfo, Salvatore J.},
title = {When Firmware Modifications Attack: A Case Study of Embedded Exploitation},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2013},
series = {NDSS 2013},
url = {https://www.ndss-symposium.org/ndss2013/ndss-2013-programme/when-firmware-modifications-attack-case-study-embedded-exploitation/},
}
@inproceedings{kotzias2018_coming,
author = {Kotzias, Platon and Razaghpanah, Abbas and Amann, Johanna and Paterson, Kenneth G. and Vallina-Rodriguez, Narseo and Caballero, Juan},
title = {Coming of Age: A Longitudinal Study of TLS Deployment},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278568},
}
@inproceedings{deuber2023_assessing,
author = {Deuber, Dominic and Keuchen, Michael and Christin, Nicolas},
title = {Assessing Anonymity Techniques Employed in German Court Decisions: A De-Anonymization Experiment},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/deuber},
}
@article{dubois2020_speakers,
author = {Dubois, Daniel J. and Kolcun, Roman and Mandalari, Anna Maria and Paracha, Muhammad Talha and Choffnes, David and Haddadi, Hamed},
title = {When Speakers Are All Ears: Characterizing Misactivations of IoT Smart Speakers},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
volume = {2020},
number = {4},
pages = {255--276},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0072},
}
@article{pan2018_panoptispy,
author = {Pan, Elleen and Ren, Jingjing and Lindorfer, Martina and Wilson, Christo and Choffnes, David},
title = {Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2018},
volume = {2018},
number = {4},
pages = {33--50},
series = {PoPETs 2018},
doi = {10.1515/popets-2018-0030},
}
@inproceedings{smith2020_disseminating,
author = {Smith, C. Estelle and Nevarez, Eduardo and Zhu, Haiyi},
title = {Disseminating Research News in HCI: Perceived Hazards, How-To's, and Opportunities for Innovation},
booktitle = {Proceedings of the CHI Conference on Human Factors in Computing Systems},
year = {2020},
series = {CHI 2020},
doi = {10.1145/3313831.3376744},
}
@article{sumner2014_exaggeration,
author = {Sumner, Petroc and Vivian-Griffiths, Solveiga and Boivin, Jacky and Williams, Andy and Venetis, Christos A. and Davies, Aim{\'e}e and Ogden, Jack and Whelan, Leanne and Hughes, Bethan and Dalton, Bethan and Boy, Fred and Chambers, Christopher D.},
title = {The Association Between Exaggeration in Health Related Science News and Academic Press Releases: Retrospective Observational Study},
journal = {BMJ},
year = {2014},
volume = {349},
pages = {g7015},
doi = {10.1136/bmj.g7015},
}
@article{bratton2019_replication,
author = {Bratton, Luke and Adams, Rachel C. and Challenger, Aimée and Boivin, Jacky and Bott, Lewis and Chambers, Christopher D. and Sumner, Petroc},
title = {The Association Between Exaggeration in Health-Related Science News and Academic Press Releases: A Replication Study},
journal = {Wellcome Open Research},
year = {2019},
volume = {4},
pages = {148},
doi = {10.12688/wellcomeopenres.15486.2},
}
@article{adams2019_causality,
author = {Adams, Rachel C. and Challenger, Aimée and Bratton, Luke and Boivin, Jacky and Bott, Lewis and Powell, Georgina and Williams, Andy and Chambers, Christopher D. and Sumner, Petroc},
title = {Claims of Causality in Health News: A Randomised Trial},
journal = {BMC Medicine},
year = {2019},
volume = {17},
pages = {91},
doi = {10.1186/s12916-019-1324-7},
}
@inproceedings{ramulu2025_ethics,
author = {Ramulu, Harshini Sri and Schmitt, Helen and Rerich, Bogdan and Rodriguez, Rachel Gonzalez and Kohno, Tadayoshi and Acar, Yasemin},
title = {Ethics in Computer Security Research: A Data-Driven Assessment of the Past, the Present, and the Possible Future},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765071},
}
@inproceedings{chehade2025_forbidden,
author = {Chehade, Saiid El Hajj and Hantke, Florian and Stock, Ben},
title = {403 Forbidden? Ethically Evaluating Broken Access Control in the Wild},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00252},
}
@inproceedings{thomas2017_ethical,
author = {Thomas, Daniel R. and Pastrana, Sergio and Hutchings, Alice and Clayton, Richard and Beresford, Alastair R.},
title = {Ethical issues in research using datasets of illicit origin},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2017},
series = {IMC 2017},
doi = {10.1145/3131365.3131389},
}
@inproceedings{bowser2015_supporting,
author = {Bowser, Anne and Tsai, Janice Y.},
title = {Supporting Ethical Web Research: A New Research Ethics Review},
booktitle = {Proceedings of the ACM Web Conference},
year = {2015},
series = {TheWebConf 2015},
doi = {10.1145/2736277.2741654},
}
@inproceedings{singh2025_where,
author = {Singh, Sachin Kumar and Ricci, Robert and Gamero-Garrido, Alexander},
title = {Where in the World Are My Trackers? Mapping Web Tracking Flow Across Diverse Geographic Regions},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764427},
}
@inproceedings{snyder2017_fifteen,
author = {Snyder, Peter and Doerfler, Periwinkle and Kanich, Chris and McCoy, Damon},
title = {Fifteen minutes of unwanted fame: detecting and characterizing doxing},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2017},
series = {IMC 2017},
doi = {10.1145/3131365.3131385},
}
@inproceedings{raman2020_censored,
author = {Raman, Ram Sundara and Shenoy, Prerana and Kohls, Katharina and Ensafi, Roya},
title = {Censored Planet: An Internet-wide, Longitudinal Censorship Observatory},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2020},
series = {CCS 2020},
doi = {10.1145/3372297.3417883},
}
@inproceedings{wu2025_revealing,
author = {Wu, Mengying and Hong, Geng and Chen, Jinsong and Liu, Qi and Tang, Shujun and Li, Youhao and Liu, Baojun and Duan, Haixin and Yang, Min},
title = {Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/revealing-the-black-box-of-device-search-engine-scanning-assets-strategies-and-ethical-consideration/},
}
@inproceedings{niaki2020_iclab,
author = {Niaki, Arian Akhavan and Cho, Shinyoung and Weinberg, Zachary and Hoang, Nguyen Phong and Razaghpanah, Abbas and Christin, Nicolas and Gill, Phillipa},
title = {ICLab: A Global, Longitudinal Internet Censorship Measurement Platform},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2020},
series = {IEEE S&P 2020},
doi = {10.1109/sp40000.2020.00014},
}
@inproceedings{krombholz2017_noidea,
author = {Krombholz, Katharina and Mayer, Wilfried and Schmiedecker, Martin and Weippl, Edgar},
title = {"I Have No Idea What I'm Doing" -- On the Usability of Deploying HTTPS},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2017},
series = {USENIX Security 2017},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/krombholz},
}
@inproceedings{zhang2014_dspin,
author = {Zhang, Qing and Wang, David Y. and Voelker, Geoffrey M.},
title = {DSpin: Detecting Automatically Spun Content on the Web},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2014},
series = {NDSS 2014},
url = {https://www.ndss-symposium.org/ndss2014/ndss-2014-programme/dspin-detecting-automatically-spun-content-web/},
}
@inproceedings{almansoori2022_dualuse,
author = {Almansoori, Majed and Gallardo, Andrea and Poveda, Julio and Ahmed, Adil and Chatterjee, Rahul},
title = {A Global Survey of Android Dual-Use Applications Used in Intimate Partner Surveillance},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0102},
}
@inproceedings{zeng2021_polls,
author = {Zeng, Eric and Wei, Miranda and Gregersen, Theo and Kohno, Tadayoshi and Roesner, Franziska},
title = {Polls, Clickbait, and Commemorative \$2 Bills: Problematic Political Advertising on News and Media Websites Around the 2020 U.S. Elections},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487850},
}
@inproceedings{subramani2020_push,
author = {Subramani, Karthika and Yuan, Xingzi and Setayeshfar, Omid and Vadrevu, Phani and Lee, Kyu Hyung and Perdisci, Roberto},
title = {When Push Comes to Ads: Measuring the Rise of (Malicious) Push Advertising},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
doi = {10.1145/3419394.3423631},
}
@inproceedings{kohno2023_trolley,
author = {Kohno, Tadayoshi and Acar, Yasemin and Loh, Wulf},
title = {Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/kohno},
}
@inproceedings{utz2019_informed,
author = {Utz, Christine and Degeling, Martin and Fahl, Sascha and Schaub, Florian and Holz, Thorsten},
title = {(Un)informed Consent: Studying GDPR Consent Notices in the Field},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2019},
series = {CCS 2019},
doi = {10.1145/3319535.3354212},
}
@inproceedings{degeling2019_value,
author = {Degeling, Martin and Utz, Christine and Lentzsch, Christopher and Hosseini, Henry and Schaub, Florian and Holz, Thorsten},
title = {We Value Your Privacy ... Now Take Some Cookies: Measuring the {GDPR}'s Impact on Web Privacy},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
url = {https://www.ndss-symposium.org/ndss-paper/we-value-your-privacy-now-take-some-cookies-measuring-the-gdprs-impact-on-web-privacy/},
}
@inproceedings{hils2021_privacy,
author = {Hils, Maximilian and Woods, Daniel W. and B{\"o}hme, Rainer},
title = {Privacy Preference Signals: Past, Present and Future},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2021},
series = {PoPETs 2021},
doi = {10.2478/popets-2021-0069},
}
@inproceedings{charatan2024_steps,
author = {Charatan, Jan and Birrell, Eleanor},
title = {Two Steps Forward and One Step Back: The Right to Opt-out of Sale under {CPRA}},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0042},
}
@inproceedings{kancherla2025_johnny,
author = {Kancherla, Gayatri Priyadarsini and Bielova, Nataliia and Santos, Cristiana and Bichhawat, Abhishek},
title = {Johnny Can't Revoke Consent Either: Measuring Compliance of Consent Revocation on the Web},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
doi = {10.56553/popets-2025-0133},
}
@inproceedings{hausladen2025_websites,
author = {Hausladen, Katherine and Wang, Oliver and Eng, Sophie and Wang, Jocelyn and Wijaya, Francisca and May, Matthew and Zimmeck, Sebastian},
title = {Websites' Global Privacy Control Compliance at Scale and over Time},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/hausladen},
}
@inproceedings{smith2024_gdpr,
author = {Smith, Michael and Torres-Ag{\"u}ero, Antonio and Grossman, Riley and Sen, Pritam and Chen, Yi and Borcea, Cristian},
title = {A Study of {GDPR} Compliance under the Transparency and Consent Framework},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645618},
}
@inproceedings{nguyen2022_freely,
author = {Nguyen, Trung Tin and Backes, Michael and Stock, Ben},
title = {Freely Given Consent?: Studying Consent Notice of Third-Party Tracking and Its Violations of {GDPR} in Android Apps},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2022},
series = {CCS 2022},
doi = {10.1145/3548606.3560564},
}
@inproceedings{koch2023_enough,
author = {Koch, Simon and Altpeter, Benjamin and Johns, Martin},
title = {The {OK} Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/koch},
}
@inproceedings{kumar2020_finding,
author = {Kumar, Vinayshekhar Bannihatti and Iyengar, Roger and Nisal, Namita and Feng, Yuanyuan and Habib, Hana and Story, Peter and Cherivirala, Sushain and Hagan, Margaret and Cranor, Lorrie Faith and Wilson, Shomir and Schaub, Florian and Sadeh, Norman M.},
title = {Finding a Choice in a Haystack: Automatic Extraction of Opt-Out Statements from Privacy Policy Text},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380262},
}
@inproceedings{bui2022_outs,
author = {Bui, Duc and Tang, Brian and Shin, Kang G.},
title = {Do Opt-Outs Really Opt Me Out?},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2022},
series = {CCS 2022},
doi = {10.1145/3548606.3560574},
}
@inproceedings{zimmeck2026_exercising,
author = {Zimmeck, Sebastian and Aggarwal, Nishant and Liu, Zachary and Altman, Sage and Kollnig, Konrad},
title = {Exercising the {CCPA} Opt-out Right on Android: Legally Mandated but Practically Challenging},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PoPETs 2026},
doi = {10.56553/popets-2026-0065},
}
@inproceedings{nouwens2020_dark,
author = {Nouwens, Midas and Liccardi, Ilaria and Veale, Michael and Karger, David and Kagal, Lalana},
title = {Dark Patterns after the {GDPR}: Scraping Consent Pop-ups and Demonstrating their Influence},
booktitle = {Proceedings of the CHI Conference on Human Factors in Computing Systems},
year = {2020},
series = {CHI 2020},
doi = {10.1145/3313831.3376321},
}
@inproceedings{solomos2021_tales,
author = {Solomos, Konstantinos and Kristoff, John and Kanich, Chris and Polakis, Jason},
title = {Tales of Favicons and Caches: Persistent Tracking in Modern Browsers},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/tales-of-favicons-and-caches-persistent-tracking-in-modern-browsers/},
}
@inproceedings{chen2021_cookieswap,
author = {Chen, Quan and Ilia, Panagiotis and Polychronakis, Michalis and Kapravelos, Alexandros},
title = {Cookie Swap Party: Abusing First-Party Cookies for Web Tracking},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3449837},
}
@inproceedings{mirheidari2022_cache,
author = {Mirheidari, Seyed Ali and Golinelli, Matteo and Onarlioglu, Kaan and Kirda, Engin and Crispo, Bruno},
title = {Web Cache Deception Escalates!},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/mirheidari},
}
@inproceedings{rautenstrauch2023_leaky,
author = {Rautenstrauch, Jannis and Pellegrino, Giancarlo and Stock, Ben},
title = {The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S&P 2023},
doi = {10.1109/sp46215.2023.10179311},
}
@inproceedings{kaizer2016_characterizing,
author = {Kaizer, Andrew J. and Gupta, Minaxi},
title = {Characterizing Website Behaviors Across Logged-in and Not-logged-in Users},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2016},
series = {IMC 2016},
doi = {10.1145/2987443.2987450},
}
@inproceedings{pan2015_summer,
author = {Pan, Xiang and Cao, Yinzhi and Chen, Yan},
title = {I Do Not Know What You Visited Last Summer: Protecting Users from Third-party Web Tracking with TrackingFree Browser},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2015},
series = {NDSS 2015},
url = {https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/i-do-not-know-what-you-visited-last-summer-protecting-users-third-party-web-tracking/},
}
@inproceedings{matthews2018_addons,
author = {Matthews, Zachary and Vlajic, Natalija},
title = {Can Browser Add-Ons Protect Your Children from Online Tracking?},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2018},
series = {CCS 2018},
doi = {10.1145/3243734.3278498},
}
@inproceedings{song2026_wfpllm,
author = {Song, Chuxu and Mekala, Dheekshith Dev Manohar and Wang, Hao and Martin, Richard},
title = {Redefining Website Fingerprinting Attacks with Multi-Agent LLMs},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PoPETs 2026},
volume = {2026},
number = {3},
pages = {688--702},
doi = {10.56553/popets-2026-0101},
}
@inproceedings{meng2014_pollution,
author = {Meng, Wei and Xing, Xinyu and Sheth, Anmol and Weinsberg, Udi and Lee, Wenke},
title = {Your Online Interests: Pwned! A Pollution Attack Against Targeted Advertising},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2014},
series = {CCS 2014},
doi = {10.1145/2660267.2687258},
}
@inproceedings{robertson2018_auditing,
author = {Robertson, Ronald E. and Lazer, David and Wilson, Christo},
title = {Auditing the Personalization and Composition of Politically-Related Search Engine Results Pages},
booktitle = {Proceedings of the ACM Web Conference},
year = {2018},
series = {TheWebConf 2018},
doi = {10.1145/3178876.3186143},
}
@inproceedings{ablove2026_censorship,
author = {Ablove, Anna and Chandrashekaran, Shreyas and Qiang, Xiao and Ensafi, Roya},
title = {Characterizing the Implementation of Censorship Policies in Chinese LLM Services},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/characterizing-the-implementation-of-censorship-policies-in-chinese-llm-services/},
}
@inproceedings{mehrnezhad2022_protect,
author = {Mehrnezhad, Maryam and Coopamootoo, Kovila and Toreini, Ehsan},
title = {How Can and Would People Protect From Online Tracking?},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
volume = {2022},
number = {1},
doi = {10.2478/popets-2022-0006},
}
@inproceedings{collier2019_booting,
author = {Collier, Ben and Thomas, Daniel R. and Clayton, Richard and Hutchings, Alice},
title = {Booting the Booters: Evaluating the Effects of Police Interventions in the Market for Denial-of-Service Attacks},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
pages = {50--64},
doi = {10.1145/3355369.3355592},
}
@inproceedings{votipka2020_security,
author = {Votipka, Daniel and Fulton, Kelsey R. and Parker, James and Hou, Matthew and Mazurek, Michelle L. and Hicks, Michael},
title = {Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/votipka-understanding},
}
@inproceedings{vu2025_assessing,
author = {Vu, Anh V. and Collier, Ben and Thomas, Daniel R. and Kristoff, John and Clayton, Richard and Hutchings, Alice},
title = {Assessing the Aftermath: the Effects of a Global Takedown against DDoS-for-hire Services},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/vu},
}
@inproceedings{nguyen2019_short,
author = {Nguyen, Duc Cuong and Derr, Erik and Backes, Michael and Bugiel, Sven},
title = {Short Text, Large Effect: Measuring the Impact of User Reviews on Android App Security & Privacy},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2019},
series = {IEEE S&P 2019},
pages = {555--569},
doi = {10.1109/sp.2019.00012},
}
@inproceedings{vetrivel2024_market,
author = {Vetrivel, Swaathi and Bouwmeester, Brennen and Eeten, Michel van and Gañán, Carlos H.},
title = {IoT Market Dynamics: An Analysis of Device Sales, Security and Privacy Signals, and their Interactions},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/vetrivel},
}
@inproceedings{yuan2024_adversarial,
author = {Yuan, Ying and Hao, Qingying and Apruzzese, Giovanni and Conti, Mauro and Wang, Gang},
title = {"Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
pages = {1712--1723},
doi = {10.1145/3589334.3645502},
}
@inproceedings{kieserman2025_tracker,
author = {Kieserman, Julia B. and Andreou, Athanasios and Geeng, Chris and Lauinger, Tobias and McCoy, Damon},
title = {Tracker Installations Are Not Created Equal: Understanding Tracker Configuration of Form Data Collection},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {4},
pages = {679--695},
doi = {10.56553/popets-2025-0151},
}
@inproceedings{chuai2026_consensus,
author = {Chuai, Yuwei and Lenzini, Gabriele and Pröllochs, Nicolas},
title = {Consensus Stability of Community Notes on X},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
pages = {8885--8896},
doi = {10.1145/3774904.3792987},
}
@inproceedings{bashir2019_quantity,
author = {Bashir, Muhammad Ahmad and Farooq, Umar and Shahid, Maryam and Zaffar, Muhammad Fareed and Wilson, Christo},
title = {Quantity vs. Quality: Evaluating User Interest Profiles Using Ad Preference Managers},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
url = {https://www.ndss-symposium.org/ndss-paper/quantity-vs-quality-evaluating-user-interest-profiles-using-ad-preference-managers/},
}
@inproceedings{campobasso2023_know,
author = {Campobasso, Michele and Allodi, Luca},
title = {Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/campobasso},
}
@inproceedings{kumarswamy2025_causal,
author = {Kumarswamy, Nihal and Singhal, Mohit and Nilizadeh, Shirin},
title = {Causal Insights into Parler's Content Moderation Shift: Effects on Toxicity and Factuality},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
pages = {3762--3771},
doi = {10.1145/3696410.3714865},
}
@inproceedings{abdullah2022_causal,
author = {Abdullah, Muhammad and Qazi, Zafar Ayyub and Qazi, Ihsan Ayyub},
title = {Causal impact of Android go on mobile web performance},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
pages = {113--129},
doi = {10.1145/3517745.3561456},
}
@book{gelman2007_regression,
author = {Gelman, Andrew and Hill, Jennifer},
title = {Data Analysis Using Regression and Multilevel/Hierarchical Models},
publisher = {Cambridge University Press},
year = {2007},
doi = {10.1017/CBO9780511790942},
}
@article{bates2015_lme4,
author = {Bates, Douglas and M{\"a}chler, Martin and Bolker, Ben and Walker, Steve},
title = {Fitting Linear Mixed-Effects Models Using lme4},
journal = {Journal of Statistical Software},
year = {2015},
volume = {67},
number = {1},
pages = {1--48},
doi = {10.18637/jss.v067.i01},
}
@article{barr2013_maximal,
author = {Barr, Dale J. and Levy, Roger and Scheepers, Christoph and Tily, Harry J.},
title = {Random Effects Structure for Confirmatory Hypothesis Testing: Keep It Maximal},
journal = {Journal of Memory and Language},
year = {2013},
volume = {68},
number = {3},
pages = {255--278},
doi = {10.1016/j.jml.2012.11.001},
}
@article{mood2010_logistic,
author = {Mood, Carina},
title = {Logistic Regression: Why We Cannot Do What We Think We Can Do, and What We Can Do About It},
journal = {European Sociological Review},
year = {2010},
volume = {26},
number = {1},
pages = {67--82},
doi = {10.1093/esr/jcp006},
}
@article{verhoef2007_quasipoisson,
author = {Ver Hoef, Jay M. and Boveng, Peter L.},
title = {Quasi-{P}oisson vs. Negative Binomial Regression: How Should We Model Overdispersed Count Data?},
journal = {Ecology},
year = {2007},
volume = {88},
number = {11},
pages = {2766--2772},
doi = {10.1890/07-0043.1},
}
@article{ferrari2004_beta,
author = {Ferrari, Silvia and Cribari-Neto, Francisco},
title = {Beta Regression for Modelling Rates and Proportions},
journal = {Journal of Applied Statistics},
year = {2004},
volume = {31},
number = {7},
pages = {799--815},
doi = {10.1080/0266476042000214501},
}
@article{callaway2021_did,
author = {Callaway, Brantly and Sant'Anna, Pedro H. C.},
title = {Difference-in-Differences with Multiple Time Periods},
journal = {Journal of Econometrics},
year = {2021},
volume = {225},
number = {2},
pages = {200--230},
doi = {10.1016/j.jeconom.2020.12.001},
}
@article{moineddin2007_simulation,
author = {Moineddin, Rahim and Matheson, Flora I. and Glazier, Richard H.},
title = {A Simulation Study of Sample Size for Multilevel Logistic Regression Models},
journal = {BMC Medical Research Methodology},
year = {2007},
volume = {7},
pages = {34},
doi = {10.1186/1471-2288-7-34},
}
@article{shmueli2010_explain,
author = {Shmueli, Galit},
title = {To Explain or to Predict?},
journal = {Statistical Science},
year = {2010},
volume = {25},
number = {3},
pages = {289--310},
doi = {10.1214/10-STS330},
}
@article{vittinghoff2007_relaxing,
author = {Vittinghoff, Eric and McCulloch, Charles E.},
title = {Relaxing the Rule of Ten Events per Variable in Logistic and {C}ox Regression},
journal = {American Journal of Epidemiology},
year = {2007},
volume = {165},
number = {6},
pages = {710--718},
doi = {10.1093/aje/kwk052},
}
@book{angrist2009_mostly,
author = {Angrist, Joshua D. and Pischke, J{\"o}rn-Steffen},
title = {Mostly Harmless Econometrics: An Empiricist's Companion},
publisher = {Princeton University Press},
year = {2009},
doi = {10.1515/9781400829828},
}
@book{gelman2020_stories,
author = {Gelman, Andrew and Hill, Jennifer and Vehtari, Aki},
title = {Regression and Other Stories},
publisher = {Cambridge University Press},
year = {2020},
doi = {10.1017/9781139161879},
}
@article{matuschek2017_balancing,
author = {Matuschek, Hannes and Kliegl, Reinhold and Vasishth, Shravan and Baayen, Harald and Bates, Douglas},
title = {Balancing Type {I} Error and Power in Linear Mixed Models},
journal = {Journal of Memory and Language},
year = {2017},
volume = {94},
pages = {305--315},
doi = {10.1016/j.jml.2017.01.001},
}
@article{mackinnon2023_clusterrobust,
author = {MacKinnon, James G. and Nielsen, Morten {\O}rregaard and Webb, Matthew D.},
title = {Cluster-Robust Inference: A Guide to Empirical Practice},
journal = {Journal of Econometrics},
year = {2023},
volume = {232},
number = {2},
pages = {272--299},
doi = {10.1016/j.jeconom.2022.04.001},
}
@article{huang2026_clusterfail,
author = {Huang, Francis L.},
title = {When Cluster-Robust Inferences Fail},
journal = {Educational and Psychological Measurement},
year = {2026},
volume = {86},
number = {3},
pages = {579--601},
doi = {10.1177/00131644251393203},
note = {Published online 2025-12-19; issue dated 2026-06},
}
@inproceedings{zeng2022_factors,
author = {Zeng, Eric and McAmis, Rachel and Kohno, Tadayoshi and Roesner, Franziska},
title = {What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
pages = {210--229},
doi = {10.1145/3517745.3561460},
}
@inproceedings{efstratiou2025_youtube,
author = {Efstratiou, Alexandros},
title = {On YouTube Search API Use in Research},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764492},
}
@inproceedings{singh2017_torexit,
author = {Singh, Rachee and Nithyanand, Rishab and Afroz, Sadia and Pearce, Paul and Tschantz, Michael Carl and Gill, Phillipa and Paxson, Vern},
title = {Characterizing the Nature and Dynamics of Tor Exit Blocking},
booktitle = {26th USENIX Security Symposium (USENIX Security 17)},
year = {2017},
pages = {325--341},
publisher = {USENIX Association},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/singh},
}
@inproceedings{chen2025_semantics,
author = {Chen, Baiqi and Lyu, Jiawei and Wu, Tingmin and Chhetri, Mohan Baruwal and Bai, Guangdong},
title = {Semantics-Aware Cookie Purpose Compliance},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714746},
}
@inproceedings{swart2025_detecting,
author = {Swart, Milena de and Hengst, Floris den and Chen, Jieying},
title = {Detecting Linguistic Bias in Government Documents Using Large Language Models},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714526},
}
@inproceedings{zhou2025_secrets,
author = {Zhou, Jiawei and Zhang, Zidong and Ying, Lingyun and Chai, Huajun and Cao, Jiuxin and Duan, Haixin},
title = {Hey, Your Secrets Leaked! Detecting and Characterizing Secret Leakage in the Wild},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S\&P 2025},
doi = {10.1109/sp61157.2025.00122},
}
@inproceedings{xian2025_layered,
author = {Xian, Lu and Tran, Van Hong and Lee, Lauren and Kumar, Meera and Zhang, Yichen and Schaub, Florian},
title = {Layered, Overlapping, and Inconsistent: A Large-Scale Analysis of the Multiple Privacy Policies and Controls of U.S. Banks},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765072},
}
@article{cory2026_wordlevel,
author = {Cory, Thomas and Rieder, Wolf and Kr\"{a}mer, Julia and Raschke, Philip and Herbke, Patrick and K\"{u}pper, Axel},
title = {Word-level Annotation of GDPR Transparency Compliance in Privacy Policies using Large Language Models},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {1},
pages = {509--528},
doi = {10.56553/popets-2026-0026},
}
@article{sun2026_suitability,
author = {Sun, Chen and Vekaria, Yash and Nithyanand, Rishab},
title = {On the Suitability of LLM-Driven Agents for Dark Pattern Audits},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {4},
pages = {927--946},
doi = {10.56553/popets-2026-0152},
}
@article{khatun2026_disclosure,
author = {Khatun, Mst Eshita and Noureddine, Lamine and Bello, Sideeq and Ali-Gombe, Aisha},
title = {Disclosure Divergence: Measuring Privacy Policy and Data Safety Misalignment at Scale},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {4},
pages = {213--231},
doi = {10.56553/popets-2026-0117},
}
@article{coopamootoo2017_forgotten,
author = {Coopamootoo, Kovila P. L. and Gro\ss{}, Thomas},
title = {Why Privacy Is All But Forgotten: An Empirical Study of Privacy and Sharing Attitude},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2017},
volume = {2017},
number = {4},
pages = {97--118},
doi = {10.1515/popets-2017-0040},
}
@inproceedings{alam2026_philter,
author = {Alam, Mahbub and Rahman, Muhammad Lutfor and Paul, Sonjoy Kumar and Hays, Amy W. and Hussain, Aftab and Huq, Md Imanul and Saxena, Nitesh},
title = {SoK: PHILTER: Uncovering Security and Functional Gaps in AI-based Phishing Website Detection Literature via an LLM-based Reasoning Framework},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/alam},
}
@article{cohen1960_coefficient,
author = {Cohen, Jacob},
title = {A Coefficient of Agreement for Nominal Scales},
journal = {Educational and Psychological Measurement},
year = {1960},
volume = {20},
number = {1},
pages = {37--46},
doi = {10.1177/001316446002000104},
}
@article{fleiss1971_measuring,
author = {Fleiss, Joseph L.},
title = {Measuring Nominal Scale Agreement Among Many Raters},
journal = {Psychological Bulletin},
year = {1971},
volume = {76},
number = {5},
pages = {378--382},
doi = {10.1037/h0031619},
}
@article{landis1977_measurement,
author = {Landis, J. Richard and Koch, Gary G.},
title = {The Measurement of Observer Agreement for Categorical Data},
journal = {Biometrics},
year = {1977},
volume = {33},
number = {1},
pages = {159--174},
doi = {10.2307/2529310},
}
@article{feinstein1990_paradoxes,
author = {Feinstein, Alvan R. and Cicchetti, Domenic V.},
title = {High Agreement but Low Kappa: I. The Problems of Two Paradoxes},
journal = {Journal of Clinical Epidemiology},
year = {1990},
volume = {43},
number = {6},
pages = {543--549},
doi = {10.1016/0895-4356(90)90158-L},
}
@article{cicchetti1990_resolving,
author = {Cicchetti, Domenic V. and Feinstein, Alvan R.},
title = {High Agreement but Low Kappa: II. Resolving the Paradoxes},
journal = {Journal of Clinical Epidemiology},
year = {1990},
volume = {43},
number = {6},
pages = {551--558},
doi = {10.1016/0895-4356(90)90159-M},
}
@article{gwet2008_computing,
author = {Gwet, Kilem Li},
title = {Computing Inter-Rater Reliability and Its Variance in the Presence of High Agreement},
journal = {British Journal of Mathematical and Statistical Psychology},
year = {2008},
volume = {61},
number = {1},
pages = {29--48},
doi = {10.1348/000711006X126600},
}
@article{krippendorff2004_reliability,
author = {Krippendorff, Klaus},
title = {Reliability in Content Analysis: Some Common Misconceptions and Recommendations},
journal = {Human Communication Research},
year = {2004},
volume = {30},
number = {3},
pages = {411--433},
doi = {10.1111/j.1468-2958.2004.tb00738.x},
}
@book{krippendorff2018_content,
author = {Krippendorff, Klaus},
title = {Content Analysis: An Introduction to Its Methodology},
publisher = {SAGE Publications},
year = {2018},
edition = {4},
isbn = {9781506395661},
}
@article{mchugh2012_interrater,
author = {McHugh, Mary L.},
title = {Interrater Reliability: The Kappa Statistic},
journal = {Biochemia Medica},
year = {2012},
volume = {22},
number = {3},
pages = {276--282},
doi = {10.11613/BM.2012.031},
}
@article{hallgren2012_computing,
author = {Hallgren, Kevin A.},
title = {Computing Inter-Rater Reliability for Observational Data: An Overview and Tutorial},
journal = {Tutorials in Quantitative Methods for Psychology},
year = {2012},
volume = {8},
number = {1},
pages = {23--34},
doi = {10.20982/tqmp.08.1.p023},
}
@article{gilardi2023_chatgpt,
author = {Gilardi, Fabrizio and Alizadeh, Meysam and Kubli, Ma\"{e}l},
title = {ChatGPT Outperforms Crowd Workers for Text-Annotation Tasks},
journal = {Proceedings of the National Academy of Sciences},
year = {2023},
volume = {120},
number = {30},
pages = {e2305016120},
doi = {10.1073/pnas.2305016120},
}
@article{ziems2024_transform,
author = {Ziems, Caleb and Held, William and Shaikh, Omar and Chen, Jiaao and Zhang, Zhehao and Yang, Diyi},
title = {Can Large Language Models Transform Computational Social Science?},
journal = {Computational Linguistics},
year = {2024},
volume = {50},
number = {1},
pages = {237--291},
doi = {10.1162/coli_a_00502},
}
@misc{pangakis2023_validation,
author = {Pangakis, Nicholas and Wolken, Samuel and Fasching, Neil},
title = {Automated Annotation with Generative AI Requires Validation},
year = {2023},
howpublished = {arXiv:2306.00176},
url = {https://arxiv.org/abs/2306.00176},
}
@article{tornberg2024_bestpractices,
author = {T\"{o}rnberg, Petter},
title = {Best Practices for Text Annotation with Large Language Models},
journal = {Sociologica},
year = {2024},
volume = {18},
number = {2},
pages = {67--85},
doi = {10.6092/issn.1971-8853/19461},
}
@inproceedings{zhang2025_abusability,
author = {Zhang, Shirley and Chung, Paul and Vervelde, Jacob and Korapati, Nishant and Chatterjee, Rahul and Fawaz, Kassem},
title = {Abusability of Automation Apps in Intimate Partner Violence},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-shirley},
}
@misc{baumann2025_llmhacking,
author = {Baumann, Joachim and R\"{o}ttger, Paul and Urman, Aleksandra and Wendsj\"{o}, Albert and Plaza-del-Arco, Flor Miriam and Gruber, Johannes B. and Hovy, Dirk},
title = {Large Language Model Hacking: Quantifying the Hidden Risks of Using LLMs for Text Annotation},
year = {2025},
howpublished = {arXiv:2509.08825},
url = {https://arxiv.org/abs/2509.08825},
}
@inproceedings{gray2024_ontology,
author = {Gray, Colin M. and Santos, Cristiana Teixeira and Bielova, Nataliia and Mildner, Thomas},
title = {An Ontology of Dark Patterns Knowledge: Foundations, Definitions, and a Pathway for Shared Knowledge-Building},
booktitle = {Proceedings of the CHI Conference on Human Factors in Computing Systems},
year = {2024},
series = {CHI 2024},
doi = {10.1145/3613904.3642436},
}
@article{mathur2019_scale,
author = {Mathur, Arunesh and Acar, Gunes and Friedman, Michael J. and Lucherini, Elena and Mayer, Jonathan and Chetty, Marshini and Narayanan, Arvind},
title = {Dark Patterns at Scale: Findings from a Crawl of 11K Shopping Websites},
journal = {Proceedings of the ACM on Human-Computer Interaction},
volume = {3},
number = {CSCW},
year = {2019},
doi = {10.1145/3359183},
}
@article{bosch2016_tales,
author = {B\"osch, Christoph and Erb, Benjamin and Kargl, Frank and Kopp, Henning and Pfattheicher, Stefan},
title = {Tales from the Dark Side: Privacy Dark Strategies and Privacy Dark Patterns},
journal = {Proceedings on Privacy Enhancing Technologies},
volume = {2016},
number = {4},
pages = {237--254},
year = {2016},
doi = {10.1515/popets-2016-0038},
}
@inproceedings{shi2025_shades,
author = {Shi, Zewei and Sun, Ruoxi and Chen, Jieshan and Sun, Jiamou and Xue, Minhui and Gao, Yansong and Liu, Feng and Yuan, Xingliang},
title = {50 Shades of Deceptive Patterns: A Unified Taxonomy, Multimodal Detection, and Security Implications},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714593},
}
@inproceedings{nayak2025_automatically,
author = {Nayak, Asmit and Wani, Yash and Zhang, Shirley and Khandelwal, Rishabh and Fawaz, Kassem},
title = {Automatically Detecting Online Deceptive Patterns},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765191},
}
@inproceedings{ersoy2026_investigating,
author = {Ersoy, Devin and Lee, Brandon and Shreekumar, Ananth and Arunasalam, Arjun and Ibrahim, Muhammad and Bianchi, Antonio and Celik, Z. Berkay},
title = {Investigating the Impact of Dark Patterns on {LLM}-Based Web Agents},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2026},
series = {IEEE S\&P 2026},
doi = {10.1109/sp63933.2026.00042},
}
@article{elfraihi2024_meta,
author = {El fraihi, Asmaa and Amieur, Nardjes and Rudametkin, Walter and Goga, Oana},
title = {Client-side and Server-side Tracking on Meta: Effectiveness and Accuracy},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
volume = {2024},
number = {3},
pages = {431--445},
doi = {10.56553/popets-2024-0086},
}
@misc{jazlan2026_sstguard,
author = {Jazlan, Muhammad and Gamero-Garrido, Alexander and Shafiq, Zubair and Vekaria, Yash},
title = {{SST-Guard}: Detecting and Characterizing Server-Side Google Analytics in the Wild},
year = {2026},
month = apr,
eprint = {2604.27497},
archiveprefix = {arXiv},
primaryclass = {cs.CR},
note = {Preprint, arXiv v1 of 30 April 2026; also presented as a poster at PETS 2026, which states that posters "will not be peer-reviewed". Not peer-reviewed as of 21 August 2026},
doi = {10.48550/arXiv.2604.27497},
}
@inproceedings{mertens2026_gtm,
author = {Mertens, Gilles and Bielova, Nataliia and Roca, Vincent and Bouhoula, Ahmed and Akassab, Marouane},
title = {Detecting and Measuring Client- and Server-Side Google Tag Manager and its Tags in 80K Websites},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2026},
series = {CCS 2026},
note = {Accepted at CCS 2026 (verified on the SIGSAC accepted-papers list, 21 August 2026); to appear. Preprint at {HAL} hal-05466083v2, submitted 6 February 2026, under the title "An Analysis of Client- and Server-Side Google Tag Manager and its Tags on the Web". Full text read from https://hal.science/hal-05466083v2/document},
url = {https://hal.science/hal-05466083},
}
@inproceedings{mertens2025_tag,
author = {Mertens, Gilles and Bielova, Nataliia and Roca, Vincent and Santos, Cristiana},
title = {You Can't Trust Your Tag Neither: Privacy Leaks and Potential Legal Violations within the Google Tag Manager},
booktitle = {Proceedings of the IEEE European Symposium on Security and Privacy},
year = {2025},
series = {EuroS\&P 2025},
pages = {93--112},
doi = {10.1109/EuroSP63326.2025.00015},
}
@article{dao2021_cname,
author = {Dao, Ha and Mazel, Johan and Fukuda, Kensuke},
title = {{CNAME} Cloaking-Based Tracking on the Web: Characterization, Detection, and Protection},
journal = {IEEE Transactions on Network and Service Management},
year = {2021},
volume = {18},
number = {3},
pages = {3873--3888},
doi = {10.1109/TNSM.2021.3072874},
}
@inproceedings{aliyeva2021_oversharing,
author = {Aliyeva, Assel and Egele, Manuel},
title = {Oversharing Is Not Caring: How {CNAME} Cloaking Can Expose Your Session Cookies},
booktitle = {Proceedings of the ACM Asia Conference on Computer and Communications Security},
year = {2021},
series = {ASIA CCS '21},
pages = {123--134},
doi = {10.1145/3433210.3437524},
}
@inproceedings{bahrami2025_cookieguard,
author = {Nikkhah Bahrami, Pouneh and Fass, Aurore and Shafiq, Zubair},
title = {{CookieGuard}: Characterizing and Isolating the First-Party Cookie Jar},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764490},
}
@inproceedings{moti2025_bitterpill,
author = {Moti, Zahra and Frings, Kimberley and Utz, Christine and Zuiderveen Borgesius, Frederik and Acar, Gunes},
title = {The Bitter Pill: Tracking and Remarketing on {EU} Pharmacy Websites},
booktitle = {Data Privacy Management, Cryptology and Information Security},
year = {2025},
series = {DPM 2025},
url = {https://gunesacar.net/assets/bitter-pill-pharmacy-privacy-dpm-25.pdf},
}
@inproceedings{bekos2025_piixel,
author = {Bekos, Paschalis and Papadopoulos, Panagiotis and Kourtellis, Nicolas and Polychronakis, Michalis},
title = {{PIIxel} Leaks: Passive Identification of Personally Identifiable Information Leakage through Meta Pixel},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765113},
}
@article{dao2026_gclid,
author = {Dao, Ha and Shinde, Abhishek and Athar, Sana and Gosain, Devashish},
title = {Clicking into Exposure: Uncovering Privacy Risks of Google Click Identifier in {YouTube} Ads},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {2},
pages = {92--107},
doi = {10.56553/popets-2026-0038},
}
@inproceedings{papadopoulos2019_csync,
author = {Papadopoulos, Panagiotis and Kourtellis, Nicolas and Markatos, Evangelos P.},
title = {Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313542},
}
@inproceedings{randall2022_uidsmuggling,
author = {Randall, Audrey and Snyder, Peter and Ukani, Alisha and Snoeren, Alex C. and Voelker, Geoffrey M. and Savage, Stefan and Schulman, Aaron},
title = {Measuring UID smuggling in the wild},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561415},
}
@inproceedings{papadopoulos2018_cost,
author = {Papadopoulos, Panagiotis and Kourtellis, Nicolas and Markatos, Evangelos P.},
title = {The Cost of Digital Advertisement: Comparing User and Advertiser Views},
booktitle = {Proceedings of the ACM Web Conference},
year = {2018},
series = {TheWebConf 2018},
doi = {10.1145/3178876.3186060},
}
@inproceedings{vallina2019_porn,
author = {Vallina, Pelayo and Feal, Álvaro and Gamba, Julien and Vallina-Rodriguez, Narseo and Anta, Antonio Fernández},
title = {Tales from the Porn: A Comprehensive Privacy Analysis of the Web Porn Ecosystem},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355583},
}
@inproceedings{ditizio2021_calculus,
author = {Di Tizio, Giorgio and Massacci, Fabio},
title = {A Calculus of Tracking: Theory and Practice},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2021},
series = {PoPETs 2021},
doi = {10.2478/popets-2021-0027},
}
@inproceedings{cook2020_headerbidding,
author = {Cook, John and Nithyanand, Rishab and Shafiq, Zubair},
title = {Inferring Tracker-Advertiser Relationships in the Online Advertising Ecosystem using Header Bidding},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0005},
}
@inproceedings{oh2022_cartology,
author = {Oh, ChangSeok and Kanich, Chris and McCoy, Damon and Pearce, Paul},
title = {Cart-ology: Intercepting Targeted Advertising via Ad Network Identity Entanglement},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2022},
series = {CCS 2022},
doi = {10.1145/3548606.3560641},
}
@inproceedings{bekos2023_hitchhiker,
author = {Bekos, Paschalis and Papadopoulos, Panagiotis and Markatos, Evangelos P. and Kourtellis, Nicolas},
title = {The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs},
booktitle = {Proceedings of the ACM Web Conference},
year = {2023},
series = {TheWebConf 2023},
doi = {10.1145/3543507.3583311},
}
@inproceedings{tahaei2022_charting,
author = {Tahaei, Mohammad and Ramokapane, Kopo M. and Li, Tianshi and Hong, Jason I. and Rashid, Awais},
title = {Charting App Developers' Journey Through Privacy Regulation Features in Ad Networks},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
series = {PoPETs 2022},
doi = {10.56553/popets-2022-0061},
}
@inproceedings{ahmad2026_ipfp,
author = {Ahmad, Sumeer and Polychronakis, Michalis and Benson, Theophilus A. and Hoang, Nguyen Phong},
title = {More Space, Less Privacy? Measuring the Effectiveness of IP-based Website Fingerprinting in IPv6},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PoPETs 2026},
doi = {10.56553/popets-2026-0109},
}
@inproceedings{papadogiannakis2025_before,
author = {Papadogiannakis, Emmanouil and Papadopoulos, Panagiotis and Kourtellis, Nicolas and Markatos, Evangelos P.},
title = {Before \& After: The Effect of EU's 2022 Code of Practice on Disinformation},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714898},
}
@inproceedings{gavazzi2023_multi,
author = {Gavazzi, Anthony and Williams, Ryan and Kirda, Engin and Lu, Long and King, Andre and Davis, Andy and Leek, Tim},
title = {A Study of Multi-Factor and Risk-Based Authentication Availability},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/gavazzi},
}
@inproceedings{siby2020_encrypted,
author = {Siby, Sandra and Juarez, Marc and Diaz, Claudia and Vallina-Rodriguez, Narseo and Troncoso, Carmela},
title = {Encrypted {DNS} -> Privacy? A Traffic Analysis Perspective},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2020},
series = {NDSS 2020},
url = {https://www.ndss-symposium.org/ndss-paper/encrypted-dns-privacy-a-traffic-analysis-perspective/},
}
@inproceedings{le2019_political,
author = {Le, Huyen T. and Maragh, Raven and Ekdale, Brian and High, Andrew and Havens, Timothy and Shafiq, Zubair},
title = {Measuring Political Personalization of Google News Search},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313682},
}
@inproceedings{invernizzi2016_cloak,
author = {Invernizzi, Luca and Thomas, Kurt and Kapravelos, Alexandros and Comanescu, Oxana and Picod, Jean-Michel and Bursztein, Elie},
title = {Cloak of Visibility: Detecting When Machines Browse a Different Web},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2016},
series = {IEEE S\&P 2016},
doi = {10.1109/sp.2016.50},
}
@inproceedings{pradeep2022_comparative,
author = {Pradeep, Amogh and Paracha, Muhammad Talha and Bhowmick, Protick and Davanian, Ali and Razaghpanah, Abbas and Chung, Taejoong and Lindorfer, Martina and Vallina-Rodriguez, Narseo and Levin, Dave and Choffnes, David},
title = {A Comparative Analysis of Certificate Pinning in Android \& {iOS}},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561439},
}
@inproceedings{oltrogge2021_mallory,
author = {Oltrogge, Marten and Huaman, Nicolas and Klivan, Sabrina and Acar, Yasemin and Backes, Michael and Fahl, Sascha},
title = {Why Eve and Mallory Still Love Android: Revisiting {TLS} {(In)Security} in Android Applications},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/oltrogge},
}
@inproceedings{pourali2024_racing,
author = {Pourali, Sajjad and Yu, Xiufen and Zhao, Lianying and Mannan, Mohammad and Youssef, Amr},
title = {Racing for {TLS} Certificate Validation: A Hijacker's Guide to the Android {TLS} Galaxy},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/pourali},
}
@inproceedings{schmidt2023_iotflow,
author = {Schmidt, David and Tagliaro, Carlotta and Borgolte, Kevin and Lindorfer, Martina},
title = {{IoTFlow}: Inferring {IoT} Device Behavior at Scale through Static Mobile Companion App Analysis},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2023},
series = {CCS 2023},
doi = {10.1145/3576915.3623211},
}
@inproceedings{bonett2018_discovering,
author = {Bonett, Richard and Kafle, Kaushal and Moran, Kevin and Nadkarni, Adwait and Poshyvanyk, Denys},
title = {Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2018},
series = {USENIX Security 2018},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/bonett},
}
@inproceedings{khandelwal2024_unpacking,
author = {Khandelwal, Rishabh and Nayak, Asmit and Chung, Paul and Fawaz, Kassem},
title = {Unpacking Privacy Labels: A Measurement and Developer Perspective on Google's Data Safety Section},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/khandelwal},
}
@inproceedings{lin2021_longitudinal,
author = {Lin, Fuqi and Wang, Haoyu and Wang, Liu and Liu, Xuanzhe},
title = {A Longitudinal Study of Removed Apps in {iOS} App Store},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3449990},
}
@inproceedings{wang2019_evolution,
author = {Wang, Haoyu and Li, Hao and Guo, Yao},
title = {Understanding the Evolution of Mobile App Ecosystems: A Longitudinal Measurement Study of Google Play},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313611},
}
@inproceedings{lin2026_chameleoscan,
author = {Lin, Hongyu and Hu, Yicheng and Xu, Haitao and Lu, Yanchen and Ren, Mengxia and Hao, Shuai and Yue, Chuan and Li, Zhao and Zhang, Fan and Jiang, Yixin},
title = {{ChameleoScan}: Demystifying and Detecting {iOS} Chameleon Apps via {LLM}-Powered {UI} Exploration},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/chameleoscan-demystifying-and-detecting-ios-chameleon-apps-via-llm-powered-ui-exploration/},
}
@inproceedings{specter2025_fingerprinting,
author = {Specter, Michael A. and Christodorescu, Mihai and Farr, Abbie and Ma, Bo and Lassonde, Robin},
title = {Fingerprinting {SDKs} for Mobile Apps and Where to Find Them: Understanding the Market for Device Fingerprinting},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3744877},
}
@article{rodriguez2025_settings,
author = {Rodriguez, David and Calandrino, Joseph A. and Del Alamo, Jose M. and Sadeh, Norman},
title = {Privacy Settings of Third-Party Libraries in Android Apps: A Study of Facebook {SDKs}},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
volume = {2025},
number = {2},
pages = {173--187},
doi = {10.56553/popets-2025-0056},
}
@inproceedings{liu2026_cracks,
author = {Liu, Yijing and Zhang, Yiming and Liu, Baojun and Duan, Haixin},
title = {Cracks in the Walled Garden: Dissecting the Gray-Market of Unauthorized {iOS} App Distribution via Ad Hoc Sideloading},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/liu-yijing},
}
@inproceedings{allix2016_androzoo,
author = {Allix, Kevin and Bissyand{\'e}, Tegawend{\'e} F. and Klein, Jacques and Le Traon, Yves},
title = {{AndroZoo}: Collecting Millions of Android Apps for the Research Community},
booktitle = {Proceedings of the 13th International Conference on Mining Software Repositories},
year = {2016},
series = {MSR 2016},
pages = {468--471},
doi = {10.1145/2901739.2903508},
}
@inproceedings{alecci2024_retrospective,
author = {Alecci, Marco and Ruiz Jim{\'e}nez, Pedro Jes{\'u}s and Allix, Kevin and Bissyand{\'e}, Tegawend{\'e} F. and Klein, Jacques},
title = {{AndroZoo}: A Retrospective with a Glimpse into the Future},
booktitle = {Proceedings of the 21st International Conference on Mining Software Repositories},
year = {2024},
series = {MSR 2024},
pages = {389--393},
doi = {10.1145/3643991.3644863},
}
@article{li2017_static,
author = {Li, Li and Bissyand{\'e}, Tegawend{\'e} F. and Papadakis, Mike and Rasthofer, Siegfried and Bartel, Alexandre and Octeau, Damien and Klein, Jacques and Traon, Le},
title = {Static analysis of Android apps: A systematic literature review},
journal = {Information and Software Technology},
year = {2017},
volume = {88},
pages = {67--95},
doi = {10.1016/j.infsof.2017.04.001},
}
@article{kong2019_testing,
author = {Kong, Pingfan and Li, Li and Gao, Jun and Liu, Kui and Bissyand{\'e}, Tegawend{\'e} F. and Klein, Jacques},
title = {Automated Testing of Android Apps: A Systematic Literature Review},
journal = {IEEE Transactions on Reliability},
year = {2019},
volume = {68},
number = {1},
pages = {45--66},
doi = {10.1109/TR.2018.2865733},
}
@inproceedings{pauck2018_promises,
author = {Pauck, Felix and Bodden, Eric and Wehrheim, Heike},
title = {Do Android taint analysis tools keep their promises?},
booktitle = {Proceedings of the 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
year = {2018},
series = {ESEC/FSE 2018},
doi = {10.1145/3236024.3236029},
}
@inproceedings{LePochat2019_tranco_eval,
author = {{Le Pochat}, Victor and {Van Goethem}, Tom and Joosen, Wouter},
title = {Evaluating the Long-term Effects of Parameters on the Characteristics of the {Tranco} Top Sites Ranking},
booktitle = {12th {USENIX} Workshop on Cyber Security Experimentation and Test ({CSET} 19)},
year = {2019},
url = {https://www.usenix.org/conference/cset19/presentation/lepochat},
}
@inproceedings{galloway2024_practical,
author = {Galloway, Tillson and Karakolios, Kleanthis and Ma, Zane and Perdisci, Roberto and Keromytis, Angelos D. and Antonakakis, Manos},
title = {Practical Attacks Against DNS Reputation Systems},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S\&P 2024},
doi = {10.1109/sp54263.2024.00266},
}
@inproceedings{wickramasinghe2025_decoding,
author = {Wickramasinghe, Nimesha and Shaghaghi, Arash and Tsudik, Gene and Jha, Sanjay K.},
title = {SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S\&P 2025},
doi = {10.1109/sp61157.2025.00165},
}
@inproceedings{misell2025_deployment,
author = {Misell, Q. and Steurer, Florian and Zirngibl, Johannes and Feldmann, Anja and Fiebig, Tobias},
title = {Measuring the deployment of DNSSEC Bootstrapping Using Authenticated Signals},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764501},
}
@inproceedings{wu2026_tracking,
author = {Wu, Wenhao and Wang, Zhaohua and Li, Zihan and Li, Qinxin and Xia, Yiming and Gao, Chuan and Zhang, Guangxing and Li, Zhenyu},
title = {Tracking the Stray Sheep: Understanding DNS Response Manipulation in the Wild},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792405},
}
@inproceedings{beugin2024_interest,
author = {Beugin, Yohan and McDaniel, Patrick},
title = {Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
series = {PoPETs 2024},
doi = {10.56553/popets-2024-0004},
}
@inproceedings{ahmad2026_more,
author = {Ahmad, Sumeer and Polychronakis, Michalis and Benson, Theophilus A. and Hoang, Nguyen Phong},
title = {More Space, Less Privacy? Measuring the Effectiveness of IP-based Website Fingerprinting in {IPv6}},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PoPETs 2026},
doi = {10.56553/popets-2026-0109},
}
@misc{cloudflare2022_radar_rankings,
author = {Martinho, Celso and Zejnilovic, Sabina},
title = {Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings},
year = {2022},
howpublished = {Cloudflare Blog},
url = {https://blog.cloudflare.com/radar-domain-rankings/},
note = {Published 2022-09-30},
}
@inproceedings{guo2025_evocrawl,
author = {Guo, Xiangyu and Kawlay, Akshay and Liu, Eric and Lie, David},
title = {EvoCrawl: Exploring Web Application Code and State using Evolutionary Search},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/evocrawl-exploring-web-application-code-and-state-using-evolutionary-search/},
}
@inproceedings{stafeev2025_yurascanner,
author = {Stafeev, Aleksei and Recktenwald, Tim and De Stefano, Gianluca and Khodayari, Soheil and Pellegrino, Giancarlo},
title = {YuraScanner: Leveraging LLMs for Task-driven Web App Scanning},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2025},
series = {NDSS 2025},
url = {https://www.ndss-symposium.org/ndss-paper/yurascanner-leveraging-llms-for-task-driven-web-app-scanning/},
}
@inproceedings{musch2021_debug,
author = {Musch, Marius and Johns, Martin},
title = {U Can't Debug This: Detecting JavaScript Anti-Debugging Techniques in the Wild},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/musch},
}
@inproceedings{drakonakis2020_cookie,
author = {Drakonakis, Kostas and Ioannidis, Sotiris and Polakis, Jason},
title = {The Cookie Hunter: Automated Black-box Auditing for Web Authentication and Authorization Flaws},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2020},
series = {CCS 2020},
doi = {10.1145/3372297.3417869},
}
@inproceedings{lin2024_browsing,
author = {Lin, Maxwell and Lin, Shihan and Wu, Helen and Wang, Karen and Yang, Xiaowei},
title = {Browsing without Third-Party Cookies: What Do You See?},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3689014},
}
@inproceedings{roth2024_trust,
author = {Roth, Sebastian and Gr{\"o}ber, Lea and Baus, Philipp and Krombholz, Katharina and Stock, Ben},
title = {Trust Me If You Can -- How Usable Is Trusted Types In Practice?},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/roth},
}
@article{reitinger2024_creepy,
author = {Reitinger, Nathan and Wen, Bruce and Mazurek, Michelle L. and Ur, Blase},
title = {What Does It Mean to Be Creepy? Responses to Visualizations of Personal Browsing Activity, Online Tracking, and Targeted Ads},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
volume = {2024},
issue = {3},
pages = {715--743},
doi = {10.56553/popets-2024-0101},
url = {https://petsymposium.org/popets/2024/popets-2024-0101.php},
}
@inproceedings{retana2025_permissions,
author = {Retana, Alberto Fernández de and Rautenstrauch, Jannis and Santos-Grueiro, Igor and Stock, Ben},
title = {A Permissions Odyssey: A Systematic Study of Browser Permissions on Modern Websites},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764489},
}
@inproceedings{bui2023_detection,
author = {Bui, Duc and Tang, Brian and Shin, Kang G.},
title = {Detection of Inconsistencies in Privacy Practices of Browser Extensions},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S&P 2023},
doi = {10.1109/sp46215.2023.10179338},
}
@inproceedings{jonker2020_shepherd,
author = {Jonker, Hugo and Karsch, Stefan and Krumnow, Benjamin and Sleegers, Marc},
title = {Shepherd: a Generic Approach to Automating Website Login},
booktitle = {Proceedings of the Workshop on Measurements, Attacks, and Defenses for the Web},
year = {2020},
doi = {10.14722/madweb.2020.23008},
}
@inproceedings{kubicek2024_register,
author = {Kubicek, Karel and Merane, Jakob and Bouhoula, Ahmed and Basin, David A.},
title = {Automating Website Registration for Studying GDPR Compliance},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645709},
}
@inproceedings{calzavara2014_cookiejar,
author = {Calzavara, Stefano and Tolomei, Gabriele and Bugliesi, Michele and Orlando, Salvatore},
title = {Quite a mess in my cookie jar!: leveraging machine learning to protect web authentication},
booktitle = {Proceedings of the ACM Web Conference},
year = {2014},
series = {TheWebConf 2014},
doi = {10.1145/2566486.2568047},
}
@inproceedings{deblasio2017_tripwire,
author = {DeBlasio, Joe and Savage, Stefan and Voelker, Geoffrey M. and Snoeren, Alex C.},
title = {Tripwire: inferring internet site compromise},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2017},
series = {IMC 2017},
doi = {10.1145/3131365.3131391},
}
@inproceedings{alroomi2023_password,
author = {Alroomi, Suood and Li, Frank},
title = {Measuring Website Password Creation Policies At Scale},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2023},
series = {CCS 2023},
doi = {10.1145/3576915.3623156},
}
@inproceedings{ghasemisharif2022_saat,
author = {Ghasemisharif, Mohammad and Kanich, Chris and Polakis, Jason},
title = {Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2022},
series = {IEEE S\&P 2022},
doi = {10.1109/sp46214.2022.9833753},
}
@inproceedings{zhou2014_ssoscan,
author = {Zhou, Yuchen and Evans, David},
title = {SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2014},
series = {USENIX Security 2014},
url = {https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/zhou},
}
@inproceedings{ghasemisharif2018_sso,
author = {Ghasemisharif, Mohammad and Ramesh, Amrutha and Checkoway, Stephen and Kanich, Chris and Polakis, Jason},
title = {O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On Account Hijacking and Session Management on the Web},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2018},
series = {USENIX Security 2018},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/ghasemisharif},
}
@inproceedings{alroomi2023_login,
author = {Al Roomi, Suood and Li, Frank},
title = {A Large-Scale Measurement of Website Login Policies},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/al-roomi},
}
@inproceedings{teoh2025_captcha,
author = {Teoh, Xiwen and Lin, Yun and Li, Siqi and Liu, Ruofan and Sollomoni, Avi and Harel, Yaniv and Dong, Jin Song},
title = {Are CAPTCHAs Still Bot-hard? Generalized Visual CAPTCHA Solving with Agentic Vision Language Model},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/teoh},
}
@inproceedings{searles2023_captcha,
author = {Searles, Andrew and Nakatsuka, Yoshimichi and Ozturk, Ercan and Paverd, Andrew and Tsudik, Gene and Enkoji, Ai},
title = {An Empirical Study \& Evaluation of Modern CAPTCHAs},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/searles},
}
@article{dimova2023_ssomething,
author = {Dimova, Yana and Van Goethem, Tom and Joosen, Wouter},
title = {Everybody's Looking for SSOmething: A large-scale evaluation on the privacy of OAuth authentication on the web},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {4},
doi = {10.56553/popets-2023-0119},
}
@article{kubicek2022_emails,
author = {Kub{\'i}{\v{c}}ek, Karel and Merane, Jakob and Cotrini, Carlos and Stremitzer, Alexander and Bechtold, Stefan and Basin, David},
title = {Checking Websites' GDPR Consent Compliance for Marketing Emails},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2022},
volume = {2022},
number = {2},
doi = {10.2478/popets-2022-0046},
}
@inproceedings{chatzimpyrros2020_register,
author = {Chatzimpyrros, Manolis and Solomos, Konstantinos and Ioannidis, Sotiris},
title = {You Shall Not Register! Detecting Privacy Leaks Across Registration Forms},
booktitle = {Computer Security},
year = {2020},
pages = {91--104},
doi = {10.1007/978-3-030-42051-2_7},
}
@article{mathur2023_political,
author = {Mathur, Arunesh and Wang, Angelina and Schwemmer, Carsten and Hamin, Maia and Stewart, Brandon M. and Narayanan, Arvind},
title = {Manipulative tactics are the norm in political emails: Evidence from 300K emails from the 2020 US election cycle},
journal = {Big Data \& Society},
year = {2023},
doi = {10.1177/20539517221145371},
}
@inproceedings{stafeev2024_state,
author = {Stafeev, Aleksei and Pellegrino, Giancarlo},
title = {SoK: State of the Krawlers – Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/stafeev},
}
@inproceedings{blessing2025_authentication,
author = {Blessing, Jenny and Hugenroth, Daniel and Anderson, Ross and Beresford, Alastair},
title = {SoK: Web Authentication and Recovery in the Age of End-to-End Encryption},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
series = {PoPETs 2025},
doi = {10.56553/popets-2025-0113},
}
@inproceedings{birrell2024_technical,
author = {Birrell, Eleanor and Rodolitz, Jay and Ding, Angel and Lee, Jenna and McReynolds, Emily and Hutson, Jevan A. and Lerner, Ada},
title = {SoK: Technical Implementation and Human Impact of Internet Privacy Regulations},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00206},
}
@inproceedings{warford2022_framework,
author = {Warford, Noel and Matthews, Tara and Yang, Kaitlyn and Akgul, Omer and Consolvo, Sunny and Kelley, Patrick Gage and Malkin, Nathan and Mazurek, Michelle L. and Sleeper, Manya and Thomas, Kurt},
title = {SoK: A Framework for Unifying At-Risk User Research},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2022},
series = {IEEE S&P 2022},
doi = {10.1109/sp46214.2022.9833643},
}
@inproceedings{usman2025_framework,
author = {Usman, Warda and Zappala, Daniel},
title = {SoK: A Framework and Guide for Human-Centered Threat Modeling in Security and Privacy Research},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2025},
series = {IEEE S&P 2025},
doi = {10.1109/sp61157.2025.00033},
}
@inproceedings{mathews2023_critical,
author = {Mathews, Nate and Holland, James K. and Oh, Se Eun and Rahman, Mohammad Saidur and Hopper, Nicholas and Wright, Matthew},
title = {SoK: A Critical Evaluation of Efficient Website Fingerprinting Defenses},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S&P 2023},
doi = {10.1109/sp46215.2023.10179289},
}
@inproceedings{holz2011_landscape,
author = {Holz, Ralph and Braun, Lothar and Kammenhuber, Nils and Carle, Georg},
title = {The SSL landscape: a thorough analysis of the {X.509} PKI using active and passive measurements},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2011},
series = {IMC 2011},
doi = {10.1145/2068816.2068856},
}
@inproceedings{durumeric2013_https,
author = {Durumeric, Zakir and Kasten, James and Bailey, Michael D. and Halderman, J. Alex},
title = {Analysis of the HTTPS certificate ecosystem},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2013},
series = {IMC 2013},
doi = {10.1145/2504730.2504755},
}
@inproceedings{durumeric2015_search,
author = {Durumeric, Zakir and Adrian, David and Mirian, Ariana and Bailey, Michael D. and Halderman, J. Alex},
title = {A Search Engine Backed by Internet-Wide Scanning},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2015},
series = {CCS 2015},
doi = {10.1145/2810103.2813703},
}
@inproceedings{weichselbaum2016_dead,
author = {Weichselbaum, Lukas and Spagnuolo, Michele and Lekies, Sebastian and Janc, Artur},
title = {CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2016},
series = {CCS 2016},
doi = {10.1145/2976749.2978363},
}
@inproceedings{peng2019_opening,
author = {Peng, Peng and Yang, Limin and Song, Linhai and Wang, Gang},
title = {Opening the Blackbox of VirusTotal: Analyzing Online Phishing Scan Engines},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355585},
}
@inproceedings{zhang2021_crawlphish,
author = {Zhang, Penghui and Oest, Adam and Cho, Haehyun and Sun, Zhibo and Johnson, RC and Wardman, Brad and Sarker, Shaown and Kapravelos, Alexandros and Bao, Tiffany and Wang, Ruoyu and Shoshitaishvili, Yan and Doupé, Adam and Ahn, Gail-Joon},
title = {CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2021},
series = {IEEE S&P 2021},
doi = {10.1109/sp40001.2021.00021},
}
@inproceedings{aas2019_encrypt,
author = {Aas, Josh and Barnes, Richard and Case, Benton and Durumeric, Zakir and Eckersley, Peter and Flores-López, Alan and Halderman, J. Alex and Hoffman-Andrews, Jacob and Kasten, James and Rescorla, Eric and Schoen, Seth D. and Warren, Brad},
title = {{Let's Encrypt}: An Automated Certificate Authority to Encrypt the Entire Web},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2019},
series = {CCS 2019},
doi = {10.1145/3319535.3363192},
}
@inproceedings{durumeric2024_years,
author = {Durumeric, Zakir and Adrian, David and Stephens, Phillip and Wustrow, Eric and Halderman, J. Alex},
title = {Ten Years of ZMap},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3689012},
}
@inproceedings{dey2013_profiling,
author = {Dey, Ratan and Ding, Yuan and Ross, Keith W.},
title = {Profiling high-school students with facebook: how online privacy laws can actually increase minors' risk},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2013},
series = {IMC 2013},
doi = {10.1145/2504730.2504733},
}
@inproceedings{bertram2019_five,
author = {Bertram, Theo and Bursztein, Elie and Caro, Stephanie and Chao, Hubert and Feman, Rutledge Chin and Fleischer, Peter and Gustafsson, Albin and Hemerly, Jess and Hibbert, Chris and Invernizzi, Luca and Donnelly, Lanah Kammourieh and Ketover, Jason and Laefer, Jay and Nicholas, Paul and Niu, Yuan and Obhi, Harjinder and Price, David and Strait, Andrew and Thomas, Kurt and Verney, Al},
title = {Five Years of the Right to be Forgotten},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2019},
series = {CCS 2019},
doi = {10.1145/3319535.3354208},
}
@inproceedings{kim2019_touching,
author = {Kim, Hongil and Lee, Jiho and Lee, Eunkyu and Kim, Yongdae},
title = {Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2019},
series = {IEEE S\&P 2019},
doi = {10.1109/sp.2019.00038},
}
@inproceedings{pastrana2018_crimebb,
author = {Pastrana, Sergio and Thomas, Daniel R. and Hutchings, Alice and Clayton, Richard},
title = {CrimeBB: Enabling Cybercrime Research on Underground Forums at Scale},
booktitle = {Proceedings of the ACM Web Conference},
year = {2018},
series = {TheWebConf 2018},
doi = {10.1145/3178876.3186178},
}
@inproceedings{thomas2015_injection,
author = {Thomas, Kurt and Bursztein, Elie and Grier, Chris and Ho, Grant and Jagpal, Nav and Kapravelos, Alexandros and McCoy, Damon and Nappa, Antonio and Paxson, Vern and Pearce, Paul and Provos, Niels and Rajab, Moheeb Abu},
title = {Ad Injection at Scale: Assessing Deceptive Advertisement Modifications},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2015},
series = {IEEE S\&P 2015},
doi = {10.1109/sp.2015.17},
}
@inproceedings{beverly2018_beholder,
author = {Beverly, Robert and Durairajan, Ramakrishnan and Plonka, David and Rohrer, Justin P.},
title = {In the IP of the Beholder: Strategies for Active IPv6 Topology Discovery},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278559},
}
@inproceedings{lyons2023_heavy,
author = {Lyons, Allan and Gamba, Julien and Shawaga, Austin and Reardon, Joel and Tapiador, Juan and Egelman, Serge and Vallina-Rodriguez, Narseo},
title = {Log: It's Big, It's Heavy, It's Filled with Personal Data! Measuring the Logging of Sensitive Information in the Android Ecosystem},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/lyons},
}
@inproceedings{bau2010_state,
author = {Bau, Jason and Bursztein, Elie and Gupta, Divij and Mitchell, John C.},
title = {State of the Art: Automated Black-Box Web Application Vulnerability Testing},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2010},
series = {IEEE S\&P 2010},
doi = {10.1109/sp.2010.27},
}
@inproceedings{son2013_postman,
author = {Son, Sooel and Shmatikov, Vitaly},
title = {The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2013},
series = {NDSS 2013},
url = {https://www.ndss-symposium.org/ndss2013/ndss-2013-programme/postman-always-rings-twice-attacking-and-defending-postmessage-html5-websites/},
}
@inproceedings{eriksson2021_black,
author = {Eriksson, Benjamin and Pellegrino, Giancarlo and Sabelfeld, Andrei},
title = {Black Widow: Blackbox Data-driven Web Scanning},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2021},
series = {IEEE S\&P 2021},
doi = {10.1109/sp40001.2021.00022},
}
@inproceedings{khodayari2022_state,
author = {Khodayari, Soheil and Pellegrino, Giancarlo},
title = {The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2022},
series = {IEEE S\&P 2022},
doi = {10.1109/sp46214.2022.9833637},
}
@inproceedings{kang2022_probe,
author = {Kang, Zifeng and Li, Song and Cao, Yinzhi},
title = {Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2022},
series = {NDSS 2022},
doi = {10.14722/ndss.2022.24308},
}
@inproceedings{khodayari2023_clobbering,
author = {Khodayari, Soheil and Pellegrino, Giancarlo},
title = {It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S\&P 2023},
doi = {10.1109/sp46215.2023.10179403},
}
@inproceedings{mirheidari2020_cached,
author = {Mirheidari, Seyed Ali and Arshad, Sajjad and Onarlioglu, Kaan and Crispo, Bruno and Kirda, Engin and Robertson, William},
title = {Cached and Confused: Web Cache Deception in the Wild},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/mirheidari},
}
@inproceedings{olsson2024_spider,
author = {Olsson, Eric and Eriksson, Benjamin and Doupé, Adam and Sabelfeld, Andrei},
title = {Spider-Scents: Grey-box Database-aware Web Scanning for Stored XSS},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/olsson},
}
@inproceedings{zhu2020_vtset,
author = {Zhu, Shuofei and Zhang, Ziyi and Yang, Limin and Song, Linhai and Wang, Gang},
title = {Demo: Benchmarking Label Dynamics of VirusTotal Engines},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2020},
series = {CCS 2020},
doi = {10.1145/3372297.3420013},
}
@inproceedings{wang2023_remeasuring,
author = {Wang, Jingjing and Wang, Liu and Dong, Feng and Wang, Haoyu},
title = {Re-measuring the Label Dynamics of Online Anti-Malware Engines from Millions of Samples},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624800},
}
@inproceedings{zhu2020_label,
author = {Zhu, Shuofei and Shi, Jianjun and Yang, Limin and Qin, Boqin and Zhang, Ziyi and Song, Linhai and Wang, Gang},
title = {Measuring and Modeling the Label Dynamics of Online Anti-Malware Engines},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/zhu},
}
@inproceedings{felt2017_https,
author = {Felt, Adrienne Porter and Barnes, Richard and King, April and Palmer, Chris and Bentzel, Chris and Tabriz, Parisa},
title = {Measuring HTTPS Adoption on the Web},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2017},
series = {USENIX Security 2017},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/felt},
}
@inproceedings{vandersloot2016_complete,
author = {VanderSloot, Benjamin and Amann, Johanna and Bernhard, Matthew and Durumeric, Zakir and Bailey, Michael D. and Halderman, J. Alex},
title = {Towards a Complete View of the Certificate Ecosystem},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2016},
series = {IMC 2016},
doi = {10.1145/2987443.2987462},
}
@inproceedings{scheitle2018_rise,
author = {Scheitle, Quirin and Gasser, Oliver and Nolte, Theodor and Amann, Johanna and Brent, Lexi and Carle, Georg and Holz, Ralph and Schmidt, Thomas C. and Wählisch, Matthias},
title = {The Rise of Certificate Transparency and Its Implications on the Internet Ecosystem},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278562},
}
@inproceedings{huang2014_forged,
author = {Huang, Lin-Shung and Rice, Alex and Ellingsen, Erling and Jackson, Collin},
title = {Analyzing Forged SSL Certificates in the Wild},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2014},
series = {IEEE S&P 2014},
doi = {10.1109/sp.2014.13},
}
@inproceedings{lee2025_7days,
author = {Lee, Kiho and Lim, Kyungchan and Kim, Hyoungshick and Kwon, Yonghwi and Kim, Doowon},
title = {7 Days Later: Analyzing Phishing-Site Lifespan After Detected},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714678},
}
@inproceedings{moura2024_cctld,
author = {Moura, Giovane C. M. and Daniels, Thomas and Bosteels, Maarten and Castro, Sebastian and Müller, Moritz and Wabeke, Thymen and Hout, Thijs van Den and Korczynski, Maciej and Smaragdakis, Georgios},
title = {Characterizing and Mitigating Phishing Attacks at ccTLD Scale},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2024},
series = {CCS 2024},
doi = {10.1145/3658644.3690192},
}
@inproceedings{lin2022_sheep,
author = {Lin, Xu and Ilia, Panagiotis and Solanki, Saumya and Polakis, Jason},
title = {Phish in Sheep's Clothing: Exploring the Authentication Pitfalls of Browser Fingerprinting},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/lin-xu},
}
@inproceedings{oest2019_phishfarm,
author = {Oest, Adam and Safaei, Yeganeh and Doupé, Adam and Ahn, Gail-Joon and Wardman, Brad and Tyers, Kevin},
title = {PhishFarm: A Scalable Framework for Measuring the Effectiveness of Evasion Techniques against Browser Phishing Blacklists},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2019},
series = {IEEE S&P 2019},
doi = {10.1109/sp.2019.00049},
}
@inproceedings{oest2020_phishtime,
author = {Oest, Adam and Safaei, Yeganeh and Zhang, Penghui and Wardman, Brad and Tyers, Kevin and Shoshitaishvili, Yan and Doup{\'e}, Adam and Ahn, Gail-Joon},
title = {PhishTime: Continuous Longitudinal Measurement of the Effectiveness of Anti-phishing Blacklists},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/oest-phishtime},
}
@inproceedings{oest2020_sunrise,
author = {Oest, Adam and Zhang, Penghui and Wardman, Brad and Nunes, Eric and Burgis, Jakub and Zand, Ali and Thomas, Kurt and Doup{\'e}, Adam and Ahn, Gail-Joon},
title = {Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/oest-sunrise},
}
@inproceedings{han2016_phisheye,
author = {Han, Xiao and Kheir, Nizar and Balzarotti, Davide},
title = {PhishEye: Live Monitoring of Sandboxed Phishing Kits},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2016},
series = {CCS 2016},
doi = {10.1145/2976749.2978330},
}
@inproceedings{teoh2024_phishdecloaker,
author = {Teoh, Xiwen and Lin, Yun and Liu, Ruofan and Huang, Zhiyong and Dong, Jin Song},
title = {PhishDecloaker: Detecting CAPTCHA-cloaked Phishing Websites via Hybrid Vision-based Interactive Models},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/teoh},
}
@inproceedings{subramani2022_phishinpatterns,
author = {Subramani, Karthika and Melicher, William and Starov, Oleksii and Vadrevu, Phani and Perdisci, Roberto},
title = {PhishInPatterns: measuring elicited user interactions at scale on phishing websites},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561467},
}
@inproceedings{bijmans2021_catching,
author = {Bijmans, Hugo and Booij, Tim and Schwedersky, Anneke and Nedgabat, Aria and Wegberg, Rolf van},
title = {Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/bijmans},
}
@inproceedings{tian2018_needle,
author = {Tian, Ke and Jan, Steve T. K. and Hu, Hang and Yao, Danfeng and Wang, Gang},
title = {Needle in a Haystack: Tracking Down Elite Phishing Domains in the Wild},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278569},
}
@inproceedings{lin2021_phishpedia,
author = {Lin, Yun and Liu, Ruofan and Divakaran, Dinil Mon and Ng, Jun Yang and Chan, Qing Zhou and Lu, Yiwen and Si, Yuxuan and Zhang, Fan and Dong, Jin Song},
title = {Phishpedia: A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/lin},
}
@inproceedings{acharya2021_phishprint,
author = {Acharya, Bhupendra and Vadrevu, Phani},
title = {PhishPrint: Evading Phishing Detection Crawlers by Prior Profiling},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/acharya},
}
@inproceedings{kranch2015_upgrading,
author = {Kranch, Michael and Bonneau, Joseph},
title = {Upgrading HTTPS in Mid-Air: An Empirical Study of Strict Transport Security and Key Pinning},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2015},
series = {NDSS 2015},
url = {https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/upgrading-https-mid-air-empirical-study-strict-transport-security-and-key-pinning/},
}
@inproceedings{som2017_content,
author = {Somé, Dolière Francis and Bielova, Nataliia and Rezk, Tamara},
title = {On the Content Security Policy Violations due to the Same-Origin Policy},
booktitle = {Proceedings of the ACM Web Conference},
year = {2017},
series = {TheWebConf 2017},
doi = {10.1145/3038912.3052634},
}
@inproceedings{kumar2017_security,
author = {Kumar, Deepak and Ma, Zane and Durumeric, Zakir and Mirian, Ariana and Mason, Joshua and Halderman, J. Alex and Bailey, Michael D.},
title = {Security Challenges in an Increasingly Tangled Web},
booktitle = {Proceedings of the ACM Web Conference},
year = {2017},
series = {TheWebConf 2017},
doi = {10.1145/3038912.3052686},
}
@inproceedings{chang2017_security,
author = {Chang, Li and Hsiao, Hsu-Chun and Jeng, Wei and Kim, Tiffany Hyun-Jin and Lin, Wei-Hsi},
title = {Security Implications of Redirection Trail in Popular Websites Worldwide},
booktitle = {Proceedings of the ACM Web Conference},
year = {2017},
series = {TheWebConf 2017},
doi = {10.1145/3038912.3052698},
}
@inproceedings{chapuis2020_integrity,
author = {Chapuis, Bertil and Omolola, Olamide and Cherubini, Mauro and Humbert, Mathias and Huguenin, Kévin},
title = {An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380092},
}
@inproceedings{calzavara2021_reining,
author = {Calzavara, Stefano and Urban, Tobias and Tatang, Dennis and Steffens, Marius and Stock, Ben},
title = {Reining in the Web’s Inconsistencies with Site Policy},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/reining-in-the-webs-inconsistencies-with-site-policy/},
}
@inproceedings{lim2025_phishers,
author = {Lim, Kyungchan and Lee, Kiho and Ji, Fujiao and Kwon, Yonghwi and Kim, Hyoungshick and Kim, Doowon},
title = {What's in Phishers: A Longitudinal Study of Security Configurations in Phishing Websites and Kits},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714710},
}
@inproceedings{agarwal2022_helping,
author = {Agarwal, Shubham},
title = {Helping or Hindering?: How Browser Extensions Undermine Security},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2022},
series = {CCS 2022},
doi = {10.1145/3548606.3560685},
}
@inproceedings{luo2019_time,
author = {Luo, Meng and Laperdrix, Pierre and Honarmand, Nima and Nikiforakis, Nick},
title = {Time Does Not Heal All Wounds: A Longitudinal Analysis of Security Mechanism Support in Mobile Browsers},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
url = {https://www.ndss-symposium.org/ndss-paper/time-does-not-heal-all-wounds-a-longitudinal-analysis-of-security-mechanism-support-in-mobile-browsers/},
}
@inproceedings{zheng2015_cookies,
author = {Zheng, Xiaofeng and Jiang, Jian and Liang, Jinjin and Duan, Haixin and Chen, Shuo and Wan, Tao and Weaver, Nicholas},
title = {Cookies Lack Integrity: Real-World Implications},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2015},
series = {USENIX Security 2015},
url = {https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/zheng},
}
@inproceedings{calzavara2020_tale,
author = {Calzavara, Stefano and Roth, Sebastian and Rabitti, Alvise and Backes, Michael and Stock, Ben},
title = {A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/calzavara},
}
@inproceedings{durumeric2013_zmap,
author = {Durumeric, Zakir and Wustrow, Eric and Halderman, J. Alex},
title = {{ZMap}: Fast Internet-wide Scanning and Its Security Applications},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2013},
series = {USENIX Security 2013},
url = {https://www.usenix.org/conference/usenixsecurity13/technical-sessions/paper/durumeric},
}
@inproceedings{durumeric2014_view,
author = {Durumeric, Zakir and Bailey, Michael and Halderman, J. Alex},
title = {An Internet-Wide View of Internet-Wide Scanning},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2014},
series = {USENIX Security 2014},
url = {https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/durumeric},
}
@inproceedings{kelley2012_guess,
author = {Kelley, Patrick Gage and Komanduri, Saranga and Mazurek, Michelle L. and Shay, Richard and Vidas, Timothy and Bauer, Lujo and Christin, Nicolas and Cranor, Lorrie Faith and L\'{o}pez, Julio C.},
title = {Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2012},
series = {IEEE S&P 2012},
doi = {10.1109/sp.2012.38},
}
@inproceedings{pei2020_attention,
author = {Pei, Weiping and Mayer, Arthur and Tu, Kaylynn and Yue, Chuan},
title = {Attention Please: Your Attention Check Questions in Survey Studies Can Be Automatically Answered},
booktitle = {Proceedings of the ACM Web Conference},
year = {2020},
series = {TheWebConf 2020},
doi = {10.1145/3366423.3380195},
}
@inproceedings{redmiles2020_comprehensive,
author = {Redmiles, Elissa M. and Warford, Noel and Jayanti, Amritha and Koneru, Aravind and Kross, Sean and Morales, Miraida and Stevens, Rock and Mazurek, Michelle L.},
title = {A Comprehensive Quality Evaluation of Security and Privacy Advice on the Web},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/redmiles},
}
@inproceedings{herbert2025_digital,
author = {Herbert, Franziska and Munyendo, Collins W. and Hielscher, Jonas and Becker, Steffen and Zou, Yixin},
title = {Digital Security Perceptions and Practices Around the World: A {WEIRD} versus Non-{WEIRD} Comparison},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/herbert},
}
@inproceedings{park2021_experimental,
author = {Park, Sungkyu and Park, Jamie Yejean and Chin, Hyojin and Kang, Jeong-han and Cha, Meeyoung},
title = {An Experimental Study to Understand User Experience and Perception Bias Occurred by Fact-checking Messages},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450121},
}
@inproceedings{bhuiyan2025_visitors,
author = {Bhuiyan, Masudul Hasan Masud and Varvello, Matteo and Zaki, Yasir and Staicu, Cristian-Alexandru},
title = {Not All Visitors are Bilingual: A Measurement Study of the Multilingual Web from an Accessibility Perspective},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764505},
}
@article{tang2024_automatic,
author = {Tang, Jenny and Alvarez, L{\'e}o and Brar, Arjun and Hoang, Nguyen Phong and Christin, Nicolas},
title = {Automatic Generation of Web Censorship Probe Lists},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2024},
volume = {2024},
number = {4},
pages = {44--60},
doi = {10.56553/popets-2024-0106},
}
@inproceedings{xie2025_evaluating,
author = {Xie, Qinge and Ramakrishnan, Karthik and Li, Frank},
title = {Evaluating Privacy Policies under Modern Privacy Laws At Scale: An {LLM}-Based Automated Approach},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
pages = {5797--5816},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/xie},
}
@inproceedings{nguyen2025_please,
author = {Nguyen, Hoang Dai and Dhungana, Sumit and Itha, Madhulika and Vadrevu, Phani},
title = {"Please don't send that bot anything": A Mixed-methods Study of Personal Impersonation Attacks Targeting Digital Payments on Social Media},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/nguyen},
}
@inproceedings{vombatkere2024_tiktok,
author = {Vombatkere, Karan and Mousavi, Sepehr and Zannettou, Savvas and Roesner, Franziska and Gummadi, Krishna P.},
title = {TikTok and the Art of Personalization: Investigating Exploration and Exploitation on Social Media Feeds},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645600},
}
@inproceedings{west2024_picture,
author = {West, Jack and Thiemt, Lea and Ahmed, Shimaa and Bartig, Maggie and Fawaz, Kassem and Banerjee, Suman},
title = {A Picture is Worth 500 Labels: A Case Study of Demographic Disparities in Local Machine Learning Models for Instagram and TikTok},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00203},
}
@inproceedings{capozzi2023_thin,
author = {Capozzi, Arthur and Morales, Gianmarco De Francisci and Mejova, Yelena and Monti, Corrado and Panisson, André},
title = {The Thin Ideology of Populist Advertising on Facebook during the 2019 EU Elections},
booktitle = {Proceedings of the ACM Web Conference},
year = {2023},
series = {TheWebConf 2023},
doi = {10.1145/3543507.3583267},
}
@inproceedings{bouchaud2024_beyond,
author = {Bouchaud, Paul and Liénard, Jean F.},
title = {Beyond the Guidelines: Assessing Meta's Political Ad Moderation in the EU},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3689020},
}
@inproceedings{venkatadri2019_auditing,
author = {Venkatadri, Giridhari and Sapiezynski, Piotr and Redmiles, Elissa M. and Mislove, Alan and Goga, Oana and Mazurek, Michelle L. and Gummadi, Krishna P.},
title = {Auditing Offline Data Brokers via Facebook's Advertising Platform},
booktitle = {Proceedings of the ACM Web Conference},
year = {2019},
series = {TheWebConf 2019},
doi = {10.1145/3308558.3313666},
}
@inproceedings{he2023_flocking,
author = {He, Jiahui and Zia, Haris Bin and Castro, Ignacio and Raman, Aravindh and Sastry, Nishanth and Tyson, Gareth},
title = {Flocking to Mastodon: Tracking the Great Twitter Migration},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624819},
}
@inproceedings{xue2021_throttling,
author = {Xue, Diwen and Ramesh, Reethika and S, Valdik S. and Evdokimov, Leonid and Viktorov, Andrey and Jain, Arham and Wustrow, Eric and Basso, Simone and Ensafi, Roya},
title = {Throttling Twitter: an emerging censorship technique in Russia},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487858},
}
@inproceedings{hagen2021_numbers,
author = {Hagen, Christoph and Weinert, Christian and Sendner, Christoph and Dmitrienko, Alexandra and Schneider, Thomas},
title = {All the Numbers are US: Large-scale Abuse of Contact Discovery in Mobile Messengers},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/all-the-numbers-are-us-large-scale-abuse-of-contact-discovery-in-mobile-messengers/},
}
@inproceedings{gegenhuber2026_there,
author = {Gegenhuber, Gabriel K. and Frenzel, Philipp E. and Günther, Maximilian and Ullrich, Johanna and Judmayer, Aljosha},
title = {Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/hey-there-you-are-using-whatsapp-enumerating-three-billion-accounts-for-security-and-privacy/},
}
@inproceedings{cohn2020_delf,
author = {Cohn-Gordon, Katriel and Damaskinos, Georgios and Neto, Divino and Cordova, Joshi and Reitz, Benoît and Strahs, Benjamin and Obenshain, Daniel and Pearce, Paul and Papagiannis, Ioannis},
title = {DELF: Safeguarding deletion correctness in Online Social Networks},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2020},
series = {USENIX Security 2020},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/cohn-gordon},
}
@inproceedings{schlinker2019_internet,
author = {Schlinker, Brandon and Cunha, Ítalo S. and Chiu, Yi-Ching and Sundaresan, Srikanth and Katz-Bassett, Ethan},
title = {Internet Performance from Facebook's Edge},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355567},
}
@inproceedings{zannettou2018_origins,
author = {Zannettou, Savvas and Caulfield, Tristan and Blackburn, Jeremy and Cristofaro, Emiliano De and Sirivianos, Michael and Stringhini, Gianluca and Suarez-Tangil, Guillermo},
title = {On the Origins of Memes by Means of Fringe Web Communities},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278550},
}
@inproceedings{acharya2024_imitation,
author = {Acharya, Bhupendra and Lazzaro, Dario and López-Morales, Efrén and Oest, Adam and Saad, Muhammad and Cinà, Antonio Emanuele and Schönherr, Lea and Holz, Thorsten},
title = {The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2024},
series = {USENIX Security 2024},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/acharya},
}
@inproceedings{beluri2025_exploration,
author = {Beluri, Mario and Acharya, Bhupendra and Khodayari, Soheil and Stivala, Giada and Pellegrino, Giancarlo and Holz, Thorsten},
title = {Exploration of the Dynamics of Buy and Sale of Social Media Accounts},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3732927},
}
@inproceedings{galeazzi2026_revealing,
author = {Galeazzi, Alessandro and Paudel, Pujan and Conti, Mauro and Cristofaro, Emiliano De and Stringhini, Gianluca},
title = {Revealing The Secret Power: How Algorithms Can Influence Content Visibility on Twitter/X},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/revealing-the-secret-power-how-algorithms-can-influence-content-visibility-on-twitter-x/},
}
@inproceedings{simko2024_modern,
author = {Simko, Lucy and Hutchinson, Adryana and Isaac, Alvin and Fries, Evan and Sherr, Micah and Aviv, Adam J.},
title = {"Modern problems require modern solutions": Community-Developed Techniques for Online Exam Proctoring Evasion},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2024},
series = {CCS 2024},
doi = {10.1145/3658644.3691638},
}
@inproceedings{liao2024_gdpr,
author = {Liao, Song and Aldeen, Mohammed and Yan, Jingwen and Cheng, Long and Luo, Xiapu and Cai, Haipeng and Hu, Hongxin},
title = {Understanding GDPR Non-Compliance in Privacy Policies of Alexa Skills in European Marketplaces},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645409},
}
@inproceedings{cinus2025_exposing,
author = {Cinus, Federico and Minici, Marco and Luceri, Luca and Ferrara, Emilio},
title = {Exposing Cross-Platform Coordinated Inauthentic Activity in the Run-Up to the 2024 U.S. Election},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714698},
}
@inproceedings{biswas2026_longitudinal,
author = {Biswas, Md. Rafiul and Bessghaier, Mabrouka and Ibrahim, Shimaa and Mikros, George K. and Zaghouani, Wajdi},
title = {Longitudinal Trends in Global Climate Change Discourse on Facebook},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3793026},
}
@inproceedings{mccrosky2026_does,
author = {McCrosky, Jesse and Malla, Ranadheer and Tanskanen, Aapo and Camargo, Chico Q.},
title = {Does This Button Work? Investigating YouTube's Ineffective User Controls},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792183},
}
@article{benzaamia2026_year,
author = {Benzaamia, Abir and {El Fraihi}, Asmaa and Abdelaziz, Ines and Goga, Oana},
title = {A Year Under the DSA: Ad Transparency's Uneven Landscape},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {2},
pages = {517--532},
doi = {10.56553/popets-2026-0059},
}
@article{knockel2026_banned,
author = {Knockel, Jeffrey and Dałek, Jakub and Aljizawi, Noura and Ahmed, Mohamed and Meletti, Levi and Lau, Justin},
title = {Banned Books: Analysis of Censorship on Amazon.com},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {3},
pages = {200--214},
doi = {10.56553/popets-2026-0078},
}
@inproceedings{roy2025_darkgram,
author = {{Saha Roy}, Sayak and {Pourabbas Vafa}, Elham and Khanmohamaddi, Kobra and Nilizadeh, Shirin},
title = {DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/roy},
}
@inproceedings{kaleli2021_human,
author = {Kaleli, Beliz and Kondracki, Brian and Egele, Manuel and Nikiforakis, Nick and Stringhini, Gianluca},
title = {To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media/},
}
@inproceedings{khrer2015_going,
author = {Kührer, Marc and Hupperich, Thomas and Bushart, Jonas and Rossow, Christian and Holz, Thorsten},
title = {Going Wild: Large-Scale Classification of Open DNS Resolvers},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2015},
series = {IMC 2015},
doi = {10.1145/2815675.2815683},
}
@inproceedings{ager2010_comparing,
author = {Ager, Bernhard and Mühlbauer, Wolfgang and Smaragdakis, Georgios and Uhlig, Steve},
title = {Comparing DNS resolvers in the wild},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2010},
series = {IMC 2010},
doi = {10.1145/1879141.1879144},
}
@inproceedings{lu2019_over,
author = {Lu, Chaoyi and Liu, Baojun and Li, Zhou and Hao, Shuang and Duan, Hai-Xin and Zhang, Mingming and Leng, Chunying and Liu, Ying and Zhang, Zaifeng and Wu, Jianping},
title = {An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come?},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355580},
}
@inproceedings{chhabra2021_over,
author = {Chhabra, Rishabh and Murley, Paul and Kumar, Deepak and Bailey, Michael D. and Wang, Gang},
title = {Measuring DNS-over-HTTPS performance around the world},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487849},
}
@inproceedings{randall2021_home,
author = {Randall, Audrey and Liu, Enze and Padmanabhan, Ramakrishna and Akiwate, Gautam and Voelker, Geoffrey M. and Savage, Stefan and Schulman, Aaron},
title = {Home is where the hijacking is: understanding DNS interception by residential routers},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487817},
}
@inproceedings{izhikevich2022_zdns,
author = {Izhikevich, Liz and Akiwate, Gautam and Berger, Briana and Drakontaidis, Spencer and Ascheman, Anna and Pearce, Paul and Adrian, David and Durumeric, Zakir},
title = {ZDNS: a fast DNS toolkit for internet measurement},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3561434},
}
@inproceedings{liu2023_dial,
author = {Liu, Guannan and Jin, Lin and Hao, Shuai and Zhang, Yubao and Liu, Daiping and Stavrou, Angelos and Wang, Haining},
title = {Dial "N" for NXDomain: The Scale, Origin, and Security Implications of DNS Queries to Non-Existent Domains},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624805},
}
@inproceedings{aldalky2019_look,
author = {Al-Dalky, Rami and Rabinovich, Michael and Schomp, Kyle},
title = {A Look at the ECS Behavior of DNS Resolvers},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355586},
}
@inproceedings{ashiq2025_decoding,
author = {Ashiq, Md. Ishtiaq and Hureau, Olivier and Deccio, Casey T. and Chung, Tijay},
title = {Decoding DNSSEC Errors at Scale: An Automated DNSSEC Error Resolution Framework using Insights from DNSViz Logs},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764428},
}
@inproceedings{li2024_worldwide,
author = {Li, Ruixuan and Liu, Baojun and Lu, Chaoyi and Duan, Haixin and Shao, Jun},
title = {A Worldwide View on the Reachability of Encrypted DNS Services},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645539},
}
@inproceedings{xia2026_starlink,
author = {Xia, Ruoxuan and Li, Bingyu and Chen, Zhenyu and Yuan, Pengyu and Wang, Yunjia and Zheng, Xiaofeng and Lin, Jingqiang},
title = {Starlink in the Wild: Multi-Perspective Measurements via DNS},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792366},
}
@inproceedings{klein2019_cache,
author = {Klein, Amit and Pinkas, Benny},
title = {dns-cache-based-user-tracking},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2019},
series = {NDSS 2019},
url = {https://www.ndss-symposium.org/ndss-paper/dns-cache-based-user-tracking/},
}
@inproceedings{randall2020_trufflehunter,
author = {Randall, Audrey and Liu, Enze and Akiwate, Gautam and Padmanabhan, Ramakrishna and Voelker, Geoffrey M. and Savage, Stefan and Schulman, Aaron},
title = {Trufflehunter: Cache Snooping Rare Domains at Large Public DNS Resolvers},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
doi = {10.1145/3419394.3423640},
}
@inproceedings{moura2019_cache,
author = {Moura, Giovane C. M. and Heidemann, John S. and Schmidt, Ricardo de Oliveira and Hardaker, Wes},
title = {Cache Me If You Can: Effects of DNS Time-to-Live},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2019},
series = {IMC 2019},
doi = {10.1145/3355369.3355568},
}
@inproceedings{nosyk2023_extended,
author = {Nosyk, Yevheniya and Korczynski, Maciej and Duda, Andrzej},
title = {Extended DNS Errors: Unlocking the Full Potential of DNS Troubleshooting},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624835},
}
@inproceedings{pearce2017_global,
author = {Pearce, Paul and Jones, Ben and Li, Frank and Ensafi, Roya and Feamster, Nick and Weaver, Nick and Paxson, Vern},
title = {Global Measurement of {DNS} Manipulation},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2017},
series = {USENIX Security 2017},
url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/pearce},
}
@inproceedings{liu2018_answering,
author = {Liu, Baojun and Lu, Chaoyi and Duan, Haixin and Liu, Ying and Li, Zhou and Hao, Shuang and Yang, Min},
title = {Who Is Answering My Queries: Understanding and Characterizing Interception of the {DNS} Resolution Path},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2018},
series = {USENIX Security 2018},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/liu-baojun},
}
@inproceedings{bhaskar2022_many,
author = {Bhaskar, Abhishek and Pearce, Paul},
title = {Many Roads Lead To Rome: How Packet Headers Influence {DNS} Censorship Measurement},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/bhaskar},
}
@inproceedings{nisenoff2023_awareness,
author = {Nisenoff, Alexandra and Sharma, Ranya and Feamster, Nick},
title = {User Awareness and Behaviors Concerning Encrypted {DNS} Settings in Web Browsers},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/nisenoff-awareness},
}
@article{tsai2023_certainty,
author = {Tsai, Elisa and Kumar, Deepak and Sundara Raman, Ram and Li, Gavin and Eiger, Yael and Ensafi, Roya},
title = {{CERTainty}: Detecting {DNS} Manipulation at Scale using {TLS} Certificates},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
volume = {2023},
number = {3},
pages = {122--137},
doi = {10.56553/popets-2023-0073},
}
@article{ververis2025_path,
author = {Ververis, Vasilis and Sassala, Steffen and Roth, Felix and Bajpai, Vaibhav},
title = {Path to Encrypted {DNS} with {DDR}: Adoption, Configuration Patterns, and Privacy Implications},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2025},
volume = {2025},
number = {4},
pages = {465--484},
doi = {10.56553/popets-2025-0140},
}
@inproceedings{dong2024_exploring,
author = {Dong, Hongying and Zhang, Yizhe and Lee, Hyeonmin and Huque, Shumon and Sun, Yixin},
title = {Exploring the Ecosystem of DNS HTTPS Resource Records: An End-to-End Perspective},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2024},
series = {IMC 2024},
doi = {10.1145/3646547.3688410},
}
@inproceedings{weissteiner2026_continuous,
author = {Weissteiner, Hannes and Czerny, Roland and Franza, Simone and Gast, Stefan and Ullrich, Johanna and Gruss, Daniel},
title = {Continuous User Behavior Monitoring using DNS Cache Timing Attacks},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2026},
series = {NDSS 2026},
url = {https://www.ndss-symposium.org/ndss-paper/continuous-user-behavior-monitoring-using-dns-cache-timing-attacks/},
}
@inproceedings{izhikevich2021_identifying,
author = {Izhikevich, Liz and Teixeira, Renata and Durumeric, Zakir},
title = {LZR: Identifying Unexpected Internet Services},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2021},
series = {USENIX Security 2021},
url = {https://www.usenix.org/conference/usenixsecurity21/presentation/izhikevich},
}
@inproceedings{huang2025_trust,
author = {Huang, Szu-Chun and Griffioen, Harm and van der Horst, Max and Smaragdakis, Georgios and van Eeten, Michel and Zhauniarovich, Yury},
title = {Trust but Verify: An Assessment of Vulnerability Tagging Services},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/huang-szu-chun},
}
@inproceedings{sethuraman2022_ipv4,
author = {Sethuraman, Manasvini and Bischof, Zachary S. and Dainotti, Alberto},
title = {Analysis of IPv4 Address Space Utilization with ANT ISI Dataset and Censys},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2022},
series = {IMC 2022},
doi = {10.1145/3517745.3563018},
}
@inproceedings{leontiadis2014_nearly,
author = {Leontiadis, Nektarios and Moore, Tyler and Christin, Nicolas},
title = {A Nearly Four-Year Longitudinal Study of Search-Engine Poisoning},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2014},
series = {CCS 2014},
doi = {10.1145/2660267.2660332},
}
@inproceedings{wang2016_anatomy,
author = {Wang, Bolun and Zhang, Xinyi and Wang, Gang and Zheng, Haitao and Zhao, Ben Y.},
title = {Anatomy of a Personalized Livestreaming System},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2016},
series = {IMC 2016},
doi = {10.1145/2987443.2987453},
}
@inproceedings{chatterjee2018_spyware,
author = {Chatterjee, Rahul and Doerfler, Periwinkle and Orgad, Hadas and Havron, Sam and Palmer, Jackeline and Freed, Diana and Levy, Karen and Dell, Nicola and McCoy, Damon and Ristenpart, Thomas},
title = {The Spyware Used in Intimate Partner Violence},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2018},
series = {IEEE S&P 2018},
doi = {10.1109/sp.2018.00061},
}
@inproceedings{lee2021_practice,
author = {Lee, Hyunwoo and Kim, Doowon and Kwon, Yonghwi},
title = {TLS 1.3 in Practice: How TLS 1.3 Contributes to the Internet},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450057},
}
@inproceedings{maggi2013_years,
author = {Maggi, Federico and Frossi, Alessandro and Zanero, Stefano and Stringhini, Gianluca and Stone-Gross, Brett and Kruegel, Christopher and Vigna, Giovanni},
title = {Two years of short URLs internet measurement: security threats and countermeasures},
booktitle = {Proceedings of the ACM Web Conference},
year = {2013},
series = {TheWebConf 2013},
doi = {10.1145/2488388.2488463},
}
@inproceedings{rueth2018_digging,
author = {R{\"u}th, Jan and Zimmermann, Torsten and Wolsing, Konrad and Hohlfeld, Oliver},
title = {Digging into Browser-based Crypto Mining},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2018},
series = {IMC 2018},
doi = {10.1145/3278532.3278539},
}
@inproceedings{sabottke2015_vulnerability,
author = {Sabottke, Carl and Suciu, Octavian and Dumitra\c{s}, Tudor},
title = {Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2015},
series = {USENIX Security 2015},
url = {https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/sabottke},
}
@inproceedings{agten2015_seven,
author = {Agten, Pieter and Joosen, Wouter and Piessens, Frank and Nikiforakis, Nick},
title = {Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2015},
series = {NDSS 2015},
url = {https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/seven-months-worth-mistakes-longitudinal-study-typosquatting-abuse/},
}
@inproceedings{murley2021_websocket,
author = {Murley, Paul and Ma, Zane and Mason, Joshua and Bailey, Michael D. and Kharraz, Amin},
title = {WebSocket Adoption and the Landscape of the Real-Time Web},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450063},
}
@inproceedings{kuchhal2021_knock,
author = {Kuchhal, Dhruv and Li, Frank},
title = {Knock and talk: investigating local network communications on websites},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2021},
series = {IMC 2021},
doi = {10.1145/3487552.3487857},
}
@inproceedings{bijmans2019_inadvertently,
author = {Bijmans, Hugo L.J. and Booij, Tim M. and Doerr, Christian},
title = {Inadvertently Making Cyber Criminals Rich: A Comprehensive Study of Cryptojacking Campaigns at Internet Scale},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2019},
series = {USENIX Security 2019},
url = {https://www.usenix.org/conference/usenixsecurity19/presentation/bijmans},
}
@inproceedings{thomas2011_design,
author = {Thomas, Kurt and Grier, Chris and Ma, Justin and Paxson, Vern and Song, Dawn},
title = {Design and Evaluation of a Real-Time URL Spam Filtering Service},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2011},
series = {IEEE S&P 2011},
doi = {10.1109/sp.2011.25},
}
@inproceedings{wondracek2010_practical,
author = {Wondracek, Gilbert and Holz, Thorsten and Kirda, Engin and Kruegel, Christopher},
title = {A Practical Attack to De-anonymize Social Network Users},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2010},
series = {IEEE S&P 2010},
doi = {10.1109/sp.2010.21},
}
@inproceedings{koop2020_redirect,
author = {Koop, Martin and Tews, Erik and Katzenbeisser, Stefan},
title = {In-Depth Evaluation of Redirect Tracking and Link Usage},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0079},
}
@inproceedings{konoth2018_minesweeper,
author = {Konoth, Radhesh Krishnan and Vineti, Emanuele and Moonsamy, Veelasha and Lindorfer, Martina and Kruegel, Christopher and Bos, Herbert and Vigna, Giovanni},
title = {MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2018},
series = {CCS 2018},
doi = {10.1145/3243734.3243858},
}
@inproceedings{miramirkhani2017_dial,
author = {Miramirkhani, Najmeh and Starov, Oleksii and Nikiforakis, Nick},
title = {Dial One for Scam: A Large-Scale Analysis of Technical Support Scams},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2017},
series = {NDSS 2017},
url = {https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/dial-one-scam-large-scale-analysis-technical-support-scams/},
}
@inproceedings{zhang2023_under,
author = {Zhang, Zhenrui and Hong, Geng and Li, Xiang and Fu, Zhuoqun and Zhang, Jia and Liu, Mingxuan and Wang, Chuhan and Chen, Jianjun and Liu, Baojun and Duan, Haixin and Zhang, Chao and Yang, Min},
title = {Under the Dark: A Systematical Study of Stealthy Mining Pools (Ab)use in the Wild},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2023},
series = {CCS 2023},
doi = {10.1145/3576915.3616677},
}
@inproceedings{dahlberg2023_timeless,
author = {Dahlberg, Rasmus and Pulls, Tobias},
title = {Timeless Timing Attacks and Preload Defenses in Tor's DNS Cache},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/dahlberg},
}
@inproceedings{genkin2022_lend,
author = {Genkin, Daniel and Nissan, Noam and Schuster, Roei and Tromer, Eran},
title = {Lend Me Your Ear: Passive Remote Physical Side Channels on PCs},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/genkin},
}
@inproceedings{qiu2023_calpric,
author = {Qiu, Wenjun and Lie, David and Austin, Lisa},
title = {Calpric: Inclusive and Fine-grain Labeling of Privacy Policies with Crowdsourcing and Active Learning},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/qiu},
}
@inproceedings{pu2023_deepfake,
author = {Pu, Jiameng and Sarwar, Zain and Abdullah, Sifat Muhammad and Rehman, Abdullah and Kim, Yoonjin and Bhattacharya, Parantapa and Javed, Mobin and Viswanath, Bimal},
title = {Deepfake Text Detection: Limitations and Opportunities},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2023},
series = {IEEE S&P 2023},
doi = {10.1109/sp46215.2023.10179387},
}
@inproceedings{li2021_good,
author = {Li, Xigao and Azad, Babak Amin and Rahmati, Amir and Nikiforakis, Nick},
title = {Good Bot, Bad Bot: Characterizing Automated Browsing Activity},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2021},
series = {IEEE S&P 2021},
doi = {10.1109/sp40001.2021.00079},
}
@inproceedings{herley2022_automated,
author = {Herley, Cormac},
title = {Automated Detection of Automated Traffic},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2022},
series = {USENIX Security 2022},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/herley},
}
@inproceedings{venugopalan2025_inconsistent,
author = {Venugopalan, Hari and Munir, Shaoor and Ahmed, Shuaib and Wang, Tangbaihe and King, Samuel T. and Shafiq, Zubair},
title = {FP-Inconsistent: Measurement and Analysis of Fingerprint Inconsistencies in Evasive Bot Traffic},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3732919},
}
@inproceedings{jan2020_throwing,
author = {Jan, Steve T. K. and Hao, Qingying and Hu, Tianrui and Pu, Jiameng and Oswal, Sonal and Wang, Gang and Viswanath, Bimal},
title = {Throwing Darts in the Dark? Detecting Bots with Limited Data using Neural Data Augmentation},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2020},
series = {IEEE S&P 2020},
doi = {10.1109/sp40000.2020.00079},
}
@inproceedings{liu2025_somesite,
author = {Liu, Enze and Luo, Elisa and Shan, Shawn and Voelker, Geoffrey M. and Zhao, Ben Y. and Savage, Stefan},
title = {Somesite I Used To Crawl: Awareness, Agency and Efficacy in Protecting Content Creators From AI Crawlers},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3732913},
}
@inproceedings{cui2025_odyssey,
author = {Cui, Jian and Zha, Mingming and Wang, XiaoFeng and Liao, Xiaojing},
title = {The Odyssey of robots.txt Governance: Measuring Convention Implications of Web Bots in Large Language Model Services},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2025},
series = {CCS 2025},
doi = {10.1145/3719027.3765063},
}
@inproceedings{kim2025_scrapers,
author = {Kim, Taein and Bock, Karstan and Luo, Claire and Liswood, Amanda and Poroslay, Chloe and Wenger, Emily},
title = {Scrapers Selectively Respect robots.txt Directives: Evidence From a Large-Scale Empirical Study},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2025},
series = {IMC 2025},
doi = {10.1145/3730567.3764471},
}
@inproceedings{qi2026_viper,
author = {Qi, Minfeng and He, Dongyang and Wang, Qin and Zhang, Lefeng},
title = {VIPER Strike: Defeating Visual Reasoning CAPTCHAs via Structured Vision–Language Inference},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/qi-minfeng},
}
@inproceedings{nguyen2024_frame,
author = {Nguyen, Hoang Dai and Subramani, Karthika and Acharya, Bhupendra and Perdisci, Roberto and Vadrevu, Phani},
title = {C-Frame: Characterizing and measuring in-the-wild CAPTCHA attacks},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2024},
series = {IEEE S&P 2024},
doi = {10.1109/sp54263.2024.00200},
}
@inproceedings{ardi2023_prevalence,
author = {Ardi, Calvin and Calder, Matt},
title = {The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2023},
series = {IMC 2023},
doi = {10.1145/3618257.3624841},
}
@inproceedings{wang2011_cloak,
author = {Wang, David Y. and Savage, Stefan and Voelker, Geoffrey M.},
title = {Cloak and dagger: dynamics of web search cloaking},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2011},
series = {CCS 2011},
doi = {10.1145/2046707.2046763},
}
@inproceedings{maroofi2020_human,
author = {Maroofi, Sourena and Korczynski, Maciej and Duda, Andrzej},
title = {Are You Human?: Resilience of Phishing Detection to Evasion Techniques Based on Human Verification},
booktitle = {Proceedings of the ACM Internet Measurement Conference},
year = {2020},
series = {IMC 2020},
doi = {10.1145/3419394.3423632},
}
@inproceedings{szurdi2021_where,
author = {Szurdi, Janos and Luo, Meng and Kondracki, Brian and Nikiforakis, Nick and Christin, Nicolas},
title = {Where are you taking me?Understanding Abusive Traffic Distribution Systems},
booktitle = {Proceedings of the ACM Web Conference},
year = {2021},
series = {TheWebConf 2021},
doi = {10.1145/3442381.3450071},
}
@inproceedings{shi2020_text,
author = {Shi, Chenghui and Ji, Shouling and Liu, Qianjun and Liu, Changchang and Chen, Yuefeng and He, Yuan and Liu, Zhe and Beyah, Raheem and Wang, Ting},
title = {Text Captcha Is Dead? A Large Scale Deployment and Empirical Study},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2020},
series = {CCS 2020},
doi = {10.1145/3372297.3417258},
}
@inproceedings{oh2017_fingerprinting,
author = {Oh, Se Eun and Li, Shuai and Hopper, Nicholas},
title = {Fingerprinting Keywords in Search Queries over Tor},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2017},
series = {PETS 2017},
doi = {10.1515/popets-2017-0048},
}
@inproceedings{campobasso2020_impersonation,
author = {Campobasso, Michele and Allodi, Luca},
title = {Impersonation-as-a-Service: Characterizing the Emerging Criminal Infrastructure for User Impersonation at Scale},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2020},
series = {CCS 2020},
doi = {10.1145/3372297.3417892},
}
@inproceedings{steiner2026_nlweb,
author = {Steiner, Aaron and Peeters, Ralph and Bizer, Christian},
title = {MCP vs RAG vs NLWeb vs HTML: A Comparison of the Effectiveness and Efficiency of Different Agent Interfaces to the Web},
booktitle = {Proceedings of the ACM Web Conference},
year = {2026},
series = {TheWebConf 2026},
doi = {10.1145/3774904.3792893},
}
@inproceedings{jeong2026_network,
author = {Jeong, Hyejun and Teymoorianfard, Mohammadreza and Kumar, Abhinav and Houmansadr, Amir and Bagdasarian, Eugene},
title = {Network-Level Prompt and Trait Leakage in Local Research Agents},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/jeong},
}
@inproceedings{zhao2026_parasites,
author = {Zhao, Shuli and Hou, Qinsheng and Zhan, Zihan and Wang, Yanhao and Xie, Yuchong and Guo, Yu and Chen, Libo and Li, Shenghong and Xue, Zhi},
title = {Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the {MCP} Ecosystem},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2026},
series = {IEEE S&P 2026},
doi = {10.1109/sp63933.2026.00154},
}
@article{ramesh2026_webspeval,
author = {Ramesh, Guruprasad Viswanathan and Nayak, Asmit and Siddique, Basieem and Fawaz, Kassem},
title = {WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks},
journal = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
volume = {2026},
number = {4},
pages = {666--702},
doi = {10.56553/popets-2026-0140},
}
@inproceedings{chang2026_overcoming,
author = {Chang, Hongyan and Bao, Ergute and Luo, Xinjian and Yu, Ting},
title = {Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for {LLM} Systems},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2026},
series = {USENIX Security 2026},
url = {https://www.usenix.org/conference/usenixsecurity26/presentation/chang-hongyan},
}
@inproceedings{shuba2018_nomoads,
author = {Shuba, Anastasia and Markopoulou, Athina and Shafiq, Zubair},
title = {NoMoAds: Effective and Efficient Cross-App Mobile Ad-Blocking},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2018},
series = {PoPETs 2018},
doi = {10.1515/popets-2018-0035},
}
@inproceedings{shuba2020_nomoats,
author = {Shuba, Anastasia and Markopoulou, Athina},
title = {NoMoATS: Towards Automatic Detection of Mobile Tracking},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0017},
}
@inproceedings{varmarken2020_smart,
author = {Varmarken, Janus and Le, Hieu and Shuba, Anastasia and Markopoulou, Athina and Shafiq, Zubair},
title = {The TV is Smart and Full of Trackers: Measuring Smart TV Advertising and Tracking},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2020},
series = {PoPETs 2020},
doi = {10.2478/popets-2020-0021},
}
@inproceedings{watanabe2020_melting,
author = {Watanabe, Takuya and Shioji, Eitaro and Akiyama, Mitsuaki and Mori, Tatsuya},
title = {Melting Pot of Origins: Compromising the Intermediary Web Services that Rehost Websites},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2020},
series = {NDSS 2020},
url = {https://www.ndss-symposium.org/ndss-paper/melting-pot-of-origins-compromising-the-intermediary-web-services-that-rehost-websites/},
}
@inproceedings{ali2023_navigating,
author = {Ali, Mir Masood and Chitale, Binoy and Ghasemisharif, Mohammad and Kanich, Chris and Nikiforakis, Nick and Polakis, Jason},
title = {Navigating Murky Waters: Automated Browser Feature Testing for Uncovering Tracking Vectors},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2023},
series = {NDSS 2023},
url = {https://www.ndss-symposium.org/ndss-paper/navigating-murky-waters-automated-browser-feature-testing-for-uncovering-tracking-vectors/},
}
@inproceedings{singh2010_incoherencies,
author = {Singh, Kapil and Moshchuk, Alexander and Wang, Helen J. and Lee, Wenke},
title = {On the Incoherencies in Web Browser Access Control Policies},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2010},
series = {IEEE S&P 2010},
doi = {10.1109/sp.2010.35},
}
@inproceedings{liu2024_promises,
author = {Liu, Xiaoyin and Li, Wenzhi and Hou, Qinsheng and Yang, Shishuai and Ying, Lingyun and Diao, Wenrui and Li, Yanan and Guo, Shanqing and Duan, Haixin},
title = {From Promises to Practice: Evaluating the Private Browsing Modes of Android Browser Apps},
booktitle = {Proceedings of the ACM Web Conference},
year = {2024},
series = {TheWebConf 2024},
doi = {10.1145/3589334.3645320},
}
@inproceedings{zhou2015_monitoring,
author = {Zhou, Yuchen and Evans, David},
title = {Understanding and Monitoring Embedded Web Scripts},
booktitle = {Proceedings of the IEEE Symposium on Security and Privacy},
year = {2015},
series = {IEEE S&P 2015},
doi = {10.1109/sp.2015.57},
}
@inproceedings{kancherla2025_least,
author = {Kancherla, Gayatri Priyadarsini and Goel, Dishank and Bichhawat, Abhishek},
title = {Least Privilege Access for Persistent Storage Mechanisms in Web Browsers},
booktitle = {Proceedings of the ACM Web Conference},
year = {2025},
series = {TheWebConf 2025},
doi = {10.1145/3696410.3714887},
}
@inproceedings{karami2021_awakening,
author = {Karami, Soroush and Ilia, Panagiotis and Polakis, Jason},
title = {Awakening the Web's Sleeper Agents: Misusing Service Workers for Privacy Leakage},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
year = {2021},
series = {NDSS 2021},
url = {https://www.ndss-symposium.org/ndss-paper/awakening-the-webs-sleeper-agents-misusing-service-workers-for-privacy-leakage/},
}
@inproceedings{lee2018_pride,
author = {Lee, Jiyeon and Kim, Hayeon and Park, Junghwan and Shin, Insik and Son, Sooel},
title = {Pride and Prejudice in Progressive Web Apps: Abusing Native App-like Features in Web Applications},
booktitle = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
year = {2018},
series = {CCS 2018},
doi = {10.1145/3243734.3243867},
}
@inproceedings{mishra2021_dejavu,
author = {Mishra, Vikas and Laperdrix, Pierre and Rudametkin, Walter and Rouvoy, Romain},
title = {D\'ej\`a vu: Abusing Browser Cache Headers to Identify and Track Online Users},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2021},
series = {PETS 2021},
doi = {10.2478/popets-2021-0033},
}
@inproceedings{snyder2023_poolparty,
author = {Snyder, Peter and Karami, Soroush and Edelstein, Arthur and Livshits, Benjamin and Haddadi, Hamed},
title = {Pool-Party: Exploiting Browser Resource Pools for Web Tracking},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2023},
series = {USENIX Security 2023},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/snyder},
}
@inproceedings{aggarwal2010_analysis,
author = {Aggarwal, Gaurav and Bursztein, Elie and Jackson, Collin and Boneh, Dan},
title = {An Analysis of Private Browsing Modes in Modern Browsers},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2010},
series = {USENIX Security 2010},
url = {https://www.usenix.org/legacy/event/sec10/tech/full_papers/Aggarwal.pdf},
}
@inproceedings{franken2018_cookiejar,
author = {Franken, Gertjan and Van Goethem, Tom and Joosen, Wouter},
title = {Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2018},
series = {USENIX Security 2018},
url = {https://www.usenix.org/conference/usenixsecurity18/presentation/franken},
}
@inproceedings{patat2023_drm,
author = {Patat, Gwendal and Sabt, Mohamed and Fouque, Pierre-Alain},
title = {Your DRM Can Watch You Too: Exploring the Privacy Implications of Browsers (mis)Implementations of Widevine EME},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2023},
series = {PETS 2023},
doi = {10.56553/popets-2023-0112},
}
@inproceedings{vekaria2025_bighelp,
author = {Vekaria, Yash and Canino, Aurelio Loris and Levitsky, Jonathan and Ciechonski, Alex and Callejo, Patricia and Mandalari, Anna Maria and Shafiq, Zubair},
title = {Big Help or Big Brother? Auditing Tracking, Profiling, and Personalization in Generative AI Assistants},
booktitle = {Proceedings of the USENIX Security Symposium},
year = {2025},
series = {USENIX Security 2025},
url = {https://www.usenix.org/conference/usenixsecurity25/presentation/vekaria},
}
@inproceedings{wang2026_masks,
author = {Wang, Weihong and Dimova, Yana and Vansteenkiste, Victor and Van Goethem, Tom and Van Cutsem, Tom},
title = {The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem},
booktitle = {Proceedings on Privacy Enhancing Technologies},
year = {2026},
series = {PETS 2026},
doi = {10.56553/popets-2026-0094},
}
literature/bibliography.txt · Last modified: by karel.kubicek.claude