You've Got (a Reset) Mail: A Security Analysis of Email-Based Password Reset Procedures. - Tommaso Innocenti; Seyed Ali Mirheidari; Amin Kharraz; Bruno Crispo; Engin Kirda (DIMVA, 2021)

FRAMESHIFTER: Security Implications of HTTP/2-to-HTTP/1 Conversion Anomalies. - Bahruz Jabiyev; Steven Sprecher; Anthony Gavazzi; Tommaso Innocenti; Kaan Onarlioglu; Engin Kirda (USENIX Security Symposium, 2022)

OAuth 2.0 Redirect URI Validation Falls Short, Literally. - Tommaso Innocenti; Matteo Golinelli; Kaan Onarlioglu; Seyed Ali Mirheidari; Bruno Crispo; Engin Kirda (ACSAC, 2023)

"Only as Strong as the Weakest Link": On the Security of Brokered Single Sign-On on the Web. - Tommaso Innocenti; Louis Jannett; Christian Mainka; Vladislav Mladenov; Engin Kirda (SP, 2025)