Click This, Not That: Extending Web Authentication with Deception. - Timothy Barron; Johnny So; Nick Nikiforakis (AsiaCCS, 2021)

Domains Do Change Their Spots: Quantifying Potential Abuse of Residual Trust. - Johnny So; Najmeh Miramirkhani; Michael Ferdman; Nick Nikiforakis (SP, 2022)

Uninvited Guests: Analyzing the Identity and Behavior of Certificate Transparency Bots. - Brian Kondracki; Johnny So; Nick Nikiforakis (USENIX Security Symposium, 2022)

The More Things Change, the More They Stay the Same: Integrity of Modern JavaScript. - Johnny So; Michael Ferdman; Nick Nikiforakis (WWW, 2023)