TrustBox: A Security Architecture for Preventing Data Breaches. - Matthias Schmidt 001; Sascha Fahl; Roland Schwarzkopf; Bernd Freisleben (PDP, 2011)

Why eve and mallory love android: an analysis of android SSL (in)security. - Sascha Fahl; Marian Harbach; Thomas Muders; Matthew Smith 001; Lars Baumgärtner; Bernd Freisleben (CCS, 2012)

Towards measuring warning readability. - Marian Harbach; Sascha Fahl; Thomas Muders; Matthew Smith 001 (CCS, 2012)

Human-centric visual access control for clinical data management. - Sascha Fahl; Marian Harbach; Matthew Smith 001 (DEST, 2012)

TrustSplit: usable confidentiality for social network messaging. - Sascha Fahl; Marian Harbach; Thomas Muders; Matthew Smith 001 (HT, 2012)

Towards privacy-preserving access control with hidden policies, hidden credentials and hidden decisions. - Marian Harbach; Sascha Fahl; Michael Brenner 003; Thomas Muders; Matthew Smith 001 (PST, 2012)

Helping Johnny 2.0 to encrypt his Facebook conversations. - Sascha Fahl; Marian Harbach; Thomas Muders; Matthew Smith 001; Uwe Sander (SOUPS, 2012)

Confidentiality as a Service - Usable Security for the Cloud. - Sascha Fahl; Marian Harbach; Thomas Muders; Matthew Smith 001 (TrustCom, 2012)

All our messages are belong to us: usable confidentiality in social networks. - Marian Harbach; Sascha Fahl; Thomas Muders; Matthew Smith 001 (WWW (Companion Volume), 2012)

Rethinking SSL development in an appified world. - Sascha Fahl; Marian Harbach; Henning Perl; Markus Koetter; Matthew Smith 001 (CCS, 2013)

Hey, You, Get Off of My Clipboard - On How Usability Trumps Security in Android Password Managers. - Sascha Fahl; Marian Harbach; Marten Oltrogge; Thomas Muders; Matthew Smith 001 (Financial Cryptography, 2013)

Sorry, I Don't Get It: An Analysis of Warning Message Texts. - Marian Harbach; Sascha Fahl; Polina Yakovleva; Matthew Smith 001 (Financial Cryptography Workshops, 2013)

On the Acceptance of Privacy-Preserving Authentication Technology: The Curious Case of National Identity Cards. - Marian Harbach; Sascha Fahl; Matthias Rieger; Matthew Smith 001 (Privacy Enhancing Technologies, 2013)

On the ecological validity of a password study. - Sascha Fahl; Marian Harbach; Yasemin Acar; Matthew Smith 001 (SOUPS, 2013)

Why eve and mallory (also) love webmasters: a study on the root causes of SSL misconfigurations. - Sascha Fahl; Yasemin Acar; Henning Perl; Matthew Smith 001 (AsiaCCS, 2014)

Hey, NSA: Stay Away from my Market! Future Proofing App Markets against Powerful Attackers. - Sascha Fahl; Sergej Dechand; Henning Perl; Felix Fischer 001; Jaromir Smrcek; Matthew Smith 001 (CCS, 2014)

Who's Afraid of Which Bad Wolf? A Survey of IT Security Risk Awareness. - Marian Harbach; Sascha Fahl; Matthew Smith 001 (CSF, 2014)

You Won't Be Needing These Any More: On Removing Unused Certificates from Trust Stores. - Henning Perl; Sascha Fahl; Matthew Smith 001 (Financial Cryptography, 2014)

VCCFinder: Finding Potential Vulnerabilities in Open-Source Projects to Assist Code Audits. - Henning Perl; Sergej Dechand; Matthew Smith 001; Daniel Arp; Fabian Yamaguchi; Konrad Rieck; Sascha Fahl; Yasemin Acar (CCS, 2015)

SoK: Secure Messaging. - Nik Unger; Sergej Dechand; Joseph Bonneau; Sascha Fahl; Henning Perl; Ian Goldberg; Matthew Smith 001 (IEEE Symposium on Security and Privacy, 2015)

To Pin or Not to Pin-Helping App Developers Bullet Proof Their TLS Connections. - Marten Oltrogge; Yasemin Acar; Sergej Dechand; Matthew Smith 001; Sascha Fahl (USENIX Security Symposium, 2015)

You are Not Your Developer, Either: A Research Agenda for Usable Security and Privacy Research Beyond End Users. - Yasemin Acar; Sascha Fahl; Michelle L. Mazurek (SecDev, 2016)

SoK: Lessons Learned from Android Security Research for Appified Software Platforms. - Yasemin Acar; Michael Backes 001; Sven Bugiel; Sascha Fahl; Patrick D. McDaniel; Matthew Smith 001 (IEEE Symposium on Security and Privacy, 2016)

You Get Where You're Looking for: The Impact of Information Sources on Code Security. - Yasemin Acar; Michael Backes 001; Sascha Fahl; Doowon Kim; Michelle L. Mazurek; Christian Stransky (IEEE Symposium on Security and Privacy, 2016)

An Empirical Study of Textual Key-Fingerprint Representations. - Sergej Dechand; Dominik Schürmann; Karoline Busse; Yasemin Acar; Sascha Fahl; Matthew Smith 001 (USENIX Security Symposium, 2016)

On the importance of ecologically valid usable security research for end users and IT workers. - Sascha Fahl (2016)

Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors. - Mustafa Emre Acer; Emily Stark 001; Adrienne Porter Felt; Sascha Fahl; Radhika Bhargava; Bhanu Dev; Matt Braithwaite; Ryan Sleevi; Parisa Tabriz (CCS, 2017)

Keep me Updated: An Empirical Study of Third-Party Library Updatability on Android. - Erik Derr; Sven Bugiel; Sascha Fahl; Yasemin Acar; Michael Backes 001 (CCS, 2017)

A Stitch in Time: Supporting Android Developers in WritingSecure Code. - Duc Cuong Nguyen 001; Dominik Wermke; Yasemin Acar; Michael Backes 001; Charles Weir; Sascha Fahl (CCS, 2017)

Developers Need Support, Too: A Survey of Security Advice for Software Developers. - Yasemin Acar; Christian Stransky; Dominik Wermke; Charles Weir; Michelle L. Mazurek; Sascha Fahl (SecDev, 2017)

Security Developer Studies with GitHub Users: Exploring a Convenience Sample. - Yasemin Acar; Christian Stransky; Dominik Wermke; Michelle L. Mazurek; Sascha Fahl (SOUPS, 2017)

Comparing the Usability of Cryptographic APIs. - Yasemin Acar; Michael Backes 001; Sascha Fahl; Simson L. Garfinkel; Doowon Kim; Michelle L. Mazurek; Christian Stransky (IEEE Symposium on Security and Privacy, 2017)

Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security. - Felix Fischer 001; Konstantin Böttinger; Huang Xiao; Christian Stransky; Yasemin Acar; Michael Backes 001; Sascha Fahl (IEEE Symposium on Security and Privacy, 2017)

Lessons Learned from Using an Online Platform to Conduct Large-Scale, Online Controlled Security Experiments with Software Developers. - Christian Stransky; Yasemin Acar; Duc Cuong Nguyen 001; Dominik Wermke; Doowon Kim; Elissa M. Redmiles; Michael Backes 001; Simson L. Garfinkel; Michelle L. Mazurek; Sascha Fahl (CSET @ USENIX Security Symposium, 2017)

Studying the Impact of Managers on Password Strength and Reuse. - Sanam Ghorbani Lyastani; Michael Schilling 001; Sascha Fahl; Sven Bugiel; Michael Backes 001 (CoRR, 2017)

How Internet Resources Might Be Helping You Develop Faster but Less Securely. - Yasemin Acar; Michael Backes 001; Sascha Fahl; Doowon Kim; Michelle L. Mazurek; Christian Stransky (IEEE Secur. Priv., 2017)

A Large Scale Investigation of Obfuscation Use in Google Play. - Dominik Wermke; Nicolas Huaman; Yasemin Acar; Bradley Reaves; Patrick Traynor; Sascha Fahl (ACSAC, 2018)

Developers Deserve Security Warnings, Too: On the Effect of Integrated Security Advice on Cryptographic API Misuse. - Peter Leo Gorski; Luigi Lo Iacono; Dominik Wermke; Christian Stransky; Sebastian Möller 001; Yasemin Acar; Sascha Fahl (SOUPS @ USENIX Security Symposium, 2018)

The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators. - Marten Oltrogge; Erik Derr; Christian Stransky; Yasemin Acar; Sascha Fahl; Christian Rossow; Giancarlo Pellegrino; Sven Bugiel; Michael Backes 001 (IEEE Symposium on Security and Privacy, 2018)

Better managed than memorized? Studying the Impact of Managers on Password Strength and Reuse. - Sanam Ghorbani Lyastani; Michael Schilling 001; Sascha Fahl; Michael Backes 001; Sven Bugiel (USENIX Security Symposium, 2018)

Your Secrets Are Safe: How Browsers' Explanations Impact Misconceptions About Private Browsing Mode. - Yuxi Wu; Panya Gupta; Miranda Wei; Yasemin Acar; Sascha Fahl; Blase Ur (WWW, 2018)

(Un)informed Consent: Studying GDPR Consent Notices in the Field. - Christine Utz; Martin Degeling; Sascha Fahl; Florian Schaub; Thorsten Holz (CCS, 2019)

Listen to Developers! A Participatory Design Study on Security Warnings for Cryptographic APIs. - Peter Leo Gorski; Yasemin Acar; Luigi Lo Iacono; Sascha Fahl (CHI, 2020)

Cloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations of Security and Privacy in Cloud Office Suites. - Dominik Wermke; Nicolas Huaman; Christian Stransky; Niklas Busch; Yasemin Acar; Sascha Fahl (SOUPS @ USENIX Security Symposium, 2020)

From Needs to Actions to Secure Apps? The Effect of Requirements and Developer Practices on App Security. - Charles Weir; Ben Hermann; Sascha Fahl (USENIX Security Symposium, 2020)

Never ever or no matter what: Investigating Adoption Intentions and Misconceptions about the Corona-Warn-App in Germany. - Maximilian Häring; Eva Gerlitz; Christian Tiefenau; Matthew Smith 001; Dominik Wermke; Sascha Fahl; Yasemin Acar (SOUPS @ USENIX Security Symposium, 2021)

On the Limited Impact of Visualizing Encryption: Perceptions of E2E Messaging Security. - Christian Stransky; Dominik Wermke; Johanna Schrader; Nicolas Huaman; Yasemin Acar; Anna Lena Fehlhaber; Miranda Wei; Blase Ur; Sascha Fahl (SOUPS @ USENIX Security Symposium, 2021)

They Would do Better if They Worked Together: The Case of Interaction Problems Between Password Managers and Websites. - Nicolas Huaman; Sabrina Amft; Marten Oltrogge; Yasemin Acar; Sascha Fahl (SP, 2021)

A Large-Scale Interview Study on Information Security in and Attacks against Small and Medium-sized Enterprises. - Nicolas Huaman; Bennet von Skarczinski; Christian Stransky; Dominik Wermke; Yasemin Acar; Arne Dreißigacker; Sascha Fahl (USENIX Security Symposium, 2021)

Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications. - Marten Oltrogge; Nicolas Huaman; Sabrina Amft; Yasemin Acar; Michael Backes 001; Sascha Fahl (USENIX Security Symposium, 2021)

If You Can't Get Them to the Lab: Evaluating a Virtual Study Environment with Security Information Workers. - Nicolas Huaman; Alexander Krause; Dominik Wermke; Jan H. Klemmer; Christian Stransky; Yasemin Acar; Sascha Fahl (SOUPS @ USENIX Security Symposium, 2022)

How Does Usable Security (Not) End Up in Software Products? Results From a Qualitative Interview Study. - Marco Gutfleisch; Jan H. Klemmer; Niklas Busch; Yasemin Acar; M. Angela Sasse; Sascha Fahl (SP, 2022)

27 Years and 81 Million Opportunities Later: Investigating the Use of Email Encryption for an Entire University. - Christian Stransky; Oliver Wiese; Volker Roth 002; Yasemin Acar; Sascha Fahl (SP, 2022)

Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects. - Dominik Wermke; Noah Wöhler; Jan H. Klemmer; Marcel Fourné; Yasemin Acar; Sascha Fahl (SP, 2022)

Where to Recruit for Security Development Studies: Comparing Six Software Developer Samples. - Harjot Kaur; Sabrina Amft; Daniel Votipka; Yasemin Acar; Sascha Fahl (USENIX Security Symposium, 2022)

"Please help share!": Security and Privacy Advice on Twitter during the 2022 Russian Invasion of Ukraine. - Juliane Schmüser; Noah Wöhler; Harshini Sri Ramulu; Christian Stransky; Dominik Wermke; Sascha Fahl; Yasemin Acar (CoRR, 2022)

Committed by Accident: Studying Prevention and Remediation Strategies Against Secret Leakage in Source Code Repositories. - Alexander Krause; Jan H. Klemmer; Nicolas Huaman; Dominik Wermke; Yasemin Acar; Sascha Fahl (CoRR, 2022)

They Would Do Better If They Worked Together: Interaction Problems Between Password Managers and the Web. - Nicolas Huaman; Sabrina Amft; Marten Oltrogge; Yasemin Acar; Sascha Fahl (IEEE Secur. Priv., 2022)

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments. - Sabrina Amft; Sandra Höltervennhoff; Nicolas Huaman; Alexander Krause; Lucy Simko; Yasemin Acar; Sascha Fahl (CCS, 2023)

"Make Them Change it Every Week!": A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication. - Jan H. Klemmer; Marco Gutfleisch; Christian Stransky; Yasemin Acar; M. Angela Sasse; Sascha Fahl (CCS, 2023)

Securing Your Crypto-API Usage Through Tool Support - A Usability Study. - Stefan Krüger; Michael Reif; Anna-Katharina Wickert; Sarah Nadi; Karim Ali 001; Eric Bodden; Yasemin Acar; Mira Mezini; Sascha Fahl (SecDev, 2023)

"Would You Give the Same Priority to the Bank and a Game? I Do Not!" Exploring Credential Management Strategies and Obstacles during Password Manager Setup. - Sabrina Amft; Sandra Höltervennhoff; Nicolas Huaman; Yasemin Acar; Sascha Fahl (SOUPS, 2023)

Privacy Mental Models of Electronic Health Records: A German Case Study. - Rebecca Panskus; Max Ninow; Sascha Fahl; Karola Marky (SOUPS, 2023)

It's like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain Security. - Marcel Fourné; Dominik Wermke; William Enck; Sascha Fahl; Yasemin Acar (SP, 2023)

"I wouldn't want my unsafe code to run my pacemaker": An Interview Study on the Use, Comprehension, and Perceived Risks of Unsafe Rust. - Sandra Höltervennhoff; Philip Klostermeyer; Noah Wöhler; Yasemin Acar; Sascha Fahl (USENIX Security Symposium, 2023)

Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories. - Alexander Krause; Jan H. Klemmer; Nicolas Huaman; Dominik Wermke; Yasemin Acar; Sascha Fahl (USENIX Security Symposium, 2023)

"Security is not my field, I'm a stats guy": A Qualitative Root Cause Analysis of Barriers to Adversarial Machine Learning Defenses in Industry. - Jaron Mink; Harjot Kaur; Juliane Schmüser; Sascha Fahl; Yasemin Acar (USENIX Security Symposium, 2023)

Lost and not Found: An Investigation of Recovery Methods for Multi-Factor Authentication. - Sabrina Amft; Sandra Höltervennhoff; Nicolas Huaman; Alexander Krause; Lucy Simko; Yasemin Acar; Sascha Fahl (CoRR, 2023)

A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda. - Marcel Fourné; Dominik Wermke; Sascha Fahl; Yasemin Acar (IEEE Secur. Priv., 2023)

Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites. - Christine Utz; Sabrina Amft; Martin Degeling; Thorsten Holz; Sascha Fahl; Florian Schaub (Proc. Priv. Enhancing Technol., 2023)

Securing Your Crypto-API Usage Through Tool Support - A Usability Study. - Stefan Krüger; Michael Reif; Anna-Katharina Wickert; Sarah Nadi; Karim Ali 001; Eric Bodden; Yasemin Acar; Sascha Fahl (Zenodo, 2023)

Passwords To-Go: Investigating Multifaceted Challenges for Password Managers in the Android Ecosystem. - Nicolas Huaman; Marten Oltrogge; Sabrina Klivan; Yannick Evers; Sascha Fahl (ACSAC, 2024)

Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns. - Jan H. Klemmer; Stefan Albert Horstmann; Nikhil Patnaik; Cordelia Ludden; Cordell Burton Jr.; Carson Powers; Fabio Massacci; Akond Rahman; Daniel Votipka; Heather Richter Lipford; Awais Rashid; Alena Naiakshina; et al. (CCS, 2024)

Skipping the Security Side Quests: A Qualitative Study on Security Practices and Challenges in Game Development. - Philip Klostermeyer; Sabrina Amft; Sandra Höltervennhoff; Alexander Krause; Niklas Busch; Sascha Fahl (CCS, 2024)

Mental Models, Expectations and Implications of Client-Side Scanning: An Interview Study with Experts. - Divyanshu Bhardwaj; Carolyn Guthoff; Adrian Dabrowski; Sascha Fahl; Katharina Krombholz (CHI, 2024)

Analyzing Security and Privacy Advice During the 2022 Russian Invasion of Ukraine on Twitter. - Juliane Schmüser; Harshini Sri Ramulu; Noah Wöhler; Christian Stransky; Felix Bensmann; Dimitar Dimitrov 002; Sebastian Schellhammer; Dominik Wermke; Stefan Dietze; Yasemin Acar; Sascha Fahl (CHI, 2024)

Always Contribute Back: A Qualitative Study on Security Challenges of the Open Source Supply Chain. - Dominik Wermke; Jan H. Klemmer; Noah Wöhler; Juliane Schmüser; Harshini Sri Ramulu; Yasemin Acar; Sascha Fahl (Software Engineering, 2024)

Committed to Trust: A Qualitative Study on Security and Trust in Open Source Software Projects. - Dominik Wermke; Noah Wöhler; Jan H. Klemmer; Marcel Fourné; Yasemin Acar; Sascha Fahl (Software Engineering, 2024)

Everyone for Themselves? A Qualitative Study about Individual Security Setups of Open Source Software Contributors. - Sabrina Amft; Sandra Höltervennhoff; Rebecca Panskus; Karola Marky; Sascha Fahl (SP, 2024)

The Challenges of Bringing Cryptography from Research Papers to Products: Results from an Interview Study with Experts. - Konstantin Fischer; Ivana Trummová; Phillip Gajland; Yasemin Acar; Sascha Fahl; M. Angela Sasse (USENIX Security Symposium, 2024)

A Mixed-Methods Study on User Experiences and Challenges of Recovery Codes for an End-to-End Encrypted Service. - Sandra Höltervennhoff; Noah Wöhler; Arne Möhle; Marten Oltrogge; Yasemin Acar; Oliver Wiese; Sascha Fahl (USENIX Security Symposium, 2024)

"You have to read 50 different RFCs that contradict each other": An Interview Study on the Experiences of Implementing Cryptographic Standards. - Nicolas Huaman; Jacques Suray; Jan H. Klemmer; Marcel Fourné; Sabrina Amft; Ivana Trummová; Yasemin Acar; Sascha Fahl (USENIX Security Symposium, 2024)

"You Received $100,000 From Johnny": A Mixed-Methods Study on Push Notification Security and Privacy in Android Apps. - Thomas Neteler; Sascha Fahl; Luigi Lo Iacono (IEEE Access, 2024)

How the Future Works at SOUPS: Analyzing Future Work Statements and Their Impact on Usable Security and Privacy Research. - Jacques Suray; Jan H. Klemmer; Juliane Schmüser; Sascha Fahl (CoRR, 2024)

Unraveling Challenges with Supply-Chain Levels for Software Artifacts (SLSA) for Securing the Software Supply Chain. - Mahzabin Tamanna; Sivana Hamer; Mindy Tran; Sascha Fahl; Yasemin Acar; Laurie A. Williams (CoRR, 2024)

Adoption Challenges for Cryptographic Protocols. - Konstantin Fischer; Ivana Trummová; Phillip Gajland; Yasemin Acar; Sascha Fahl; M. Angela Sasse (IEEE Secur. Priv., 2024)

A Qualitative Study of Adoption Barriers and Challenges for Passwordless Authentication in German Public Administrations. - Jan-Ulrich Holtgrave; Sabrina Klivan; Karola Marky; Sascha Fahl (CHI, 2025)

Attributing Open-Source Contributions is Critical but Difficult: A Systematic Analysis of GitHub Practices and Their Impact on Software Supply Chain Security. - Jan-Ulrich Holtgrave; Kay Friedrich; Fabian Fischer 009; Nicolas Huaman; Niklas Busch; Jan H. Klemmer; Marcel Fourné; Oliver Wiese; Dominik Wermke; Sascha Fahl (NDSS, 2025)

Transparency in Usable Privacy and Security Research: Scholars' Perspectives, Practices, and Recommendations. - Jan H. Klemmer; Juliane Schmüser; Byron M. Lowens; Fabian Fischer 009; Lea Schmüser; Florian Schaub; Sascha Fahl (SP, 2025)

"It's Time. Time for Digital Security.": An End User Study on Actionable Security and Privacy Advice. - Anna Lena Rotthaler; Harshini Sri Ramulu; Lucy Simko; Sascha Fahl; Yasemin Acar (SP, 2025)

"I'm Pretty Expert and I Still Screw It Up": Qualitative Insights into Experiences and Challenges of Designing and Implementing Cryptographic Library APIs. - Juliane Schmüser; Philip Klostermeyer; Kay Friedrich; Sascha Fahl (SP, 2025)

"It's Not My Data Anymore": Exploring Non-Users' Privacy Perceptions of Medical Data Donation Apps. - Sarah Abdelwahab Gaballah; Lamya Abdullah; Ephraim Zimmer; Sascha Fahl; Max Mühlhäuser; Karola Marky (Proc. Priv. Enhancing Technol., 2025)

Security Benefits and Side Effects of Labeling AI-Generated Images. - Sandra Höltervennhoff; Jonas Ricker; Maike M. Raphael; Charlotte Schwedes; Rebecca Weil; Asja Fischer; Thorsten Holz; Lea Schönherr; Sascha Fahl (CoRR, 2025)

From Paranoia to Compliance: The Bumpy Road of System Hardening Practices on Stack Exchange. - Niklas Busch; Philip Klostermeyer; Jan H. Klemmer; Yasemin Acar; Sascha Fahl (CoRR, 2025)