Unfortunately, exclusively focusing on research by Googlers introduces a huge selection bias into this list, making it completely useless as a research overview. A lot of really good research in this area happens at CMU, for example.
We should all remember that at the same meeting, two Googlers explicitly stated based on no evidence at all that they were confident that there was a difference between 90 day certificates and two year certificates for phishing sites, despite the fact that the typical lifetime of a phishing certificate is best measured in hours. Starting with the conclusion you want, and then working backwards to find the arguments and data that matches them is the wrong way to think about hard problems. An excellent paper that I happened to read on the plane to London is “Instrumenting Simple Risk Communication for Safer Browsing”, by Camp et al from the recent security & human behavior workshop at CMU: https://www.heinz.cmu.edu/~acquisti/SHB2018/participants.htm http://ljean.com/files/Toolbar_Extension.pdf I highly recommend the paper, it’s very relevant and up to date. I wish I had time to do a proper survey of all the existing research; I’m sure there’s lots of other good stuff out there. -Tim From: Public [mailto:[email protected]] On Behalf Of Ryan Sleevi via Public Sent: Monday, June 18, 2018 10:16 AM To: CABFPub <[email protected]> Subject: [cabfpub] Research references for CAs During our recent F2F, there were some questions from CAs and other browsers about research that has informed some of the decisions on how the Chrome UI, particularly the security UI, has evolved. Google has participated in, as well as authored, several research studies that pertain to these topics. In order to ensure the quality of methodology, scale, and analysis, each of these papers underwent review by Conference committee or a group of peers as defined by the publication venue. A list of some of the peer-reviewed research published by Googlers in widely well-respected journals and conferences: * <https://ai.google/research/pubs/pub41323> Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness * <https://ai.google/research/pubs/pub42546> Your Reputation Precedes You: History, Reputation, and the Chrome Malware Warning * <https://ai.google/research/pubs/pub41927> Experimenting At Scale With Google Chrome's SSL Warning * <https://ai.google/research/pubs/pub43265> Improving SSL Warnings: Comprehension and Adherence * <https://ai.google/research/pubs/pub45366> Rethinking Connection Security Indicators * <https://ai.google/research/pubs/pub45374> A Week to Remember: The Impact of Browser Warning Storage Policies * <https://ai.google/research/pubs/pub46359> Where the Wild Warnings Are: Root Causes of Chrome Certificate Errors * <https://ai.google/research/pubs/pub46197> Measuring HTTPS adoption on the web * <https://blues.cs.berkeley.edu/wp-content/uploads/2018/01/chi18-warnings.pdf> An Experience Sampling Study of User Reactions to Browser Warnings in the Field * <https://ai.google/research/pubs/pub46306> 152 Simple Steps to Stay Safe Online: Security Advice for Non-Tech-Savvy Users Additionally, in hallway conversations, there were discussions about other research into the PKI ecosystem. A few resources that CAs may not have been aware of, also appearing in top-tier conferences and publications: * <https://zakird.com/papers/https_interception.pdf> The Security Impact of HTTPS Interception * <https://censys.io/static/censys.pdf> A Search Engine Backed by Internet-Wide Scanning * <https://zakird.com/papers/zlint.pdf> Tracking Certificate Misissuance in the Wild * <https://jhalderm.com/pub/papers/https-perspectives-imc16.pdf> Towards a Complete View of the Certificate Ecosystem
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
