Class Schedule

Note: Plans more than one week in the future subject to change.

Date	Topic	Readings / Materials	Assignments
Week 1
01/03/2024	Introduction [slides]	None
01/05/2024	Measurement and Attack	Required reading (due 9am today): Heninger, et al.: Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices, USENIX Security 2012 Koscher, et al.: Experimental Security Analysis of a Modern Automobile , IEEE Symposium on Security and Privacy 2010
Week 2
01/10/2024	Design/Build and People	Required reading (due 9am today): Geambasu, et al.: Vanish: Increasing Data Privacy with Self-Destructing Data, USENIX Security 2009 Tseng, et al.: The Tools and Tactics Used in Intimate Partner Surveillance: An Analysis of Online Infidelity Forums, USENIX Security 2020
01/12/2024	Authentication and Usability	Required reading (due 9am today): Chiasson, et al.: A Usability Study and Critique of Two Password Managers, USENIX Security 2006 Bonneau, et al.: The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes, IEEE Symposium on Security and Privacy (Oakland) 2012 Optional reading (no writeup required): Mickens: This World Of Ours (funny column on security), 2014	Project groups due (11:30pm)
Week 3
01/17/2024	System Design and Implementation	Required reading (due 9am today): Intro + Section 1 (skip/skim Sections 2+3) of Saltzer and Schroeder: The Protection of Information in Computer Systems, Proceedings of IEEE 1975 (HTML/Screen Reader accessible version is available at http://web.mit.edu/Saltzer/www/publications/protection/) Chen, et al.: Experimental Security Analysis of the App Model in Business Collaboration Platforms, USENIX Security 2022
01/19/2024	Developers	Required reading (due 9am today): Wermke, et al.: Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects, IEEE Symposium on Security and Privacy 2022 Votipka, et al.: Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It, USENIX Security 2020	Project proposals due (11:30pm)
Week 4
01/24/2024	Mobile Security	Required reading (due 9am today): Felt et al., Android Permissions Demystified, CCS 2011 Liu et al., No Privacy Among Spies: Assessing the Functionality and Insecurity of Consumer Android Spyware Apps, PETS 2023
01/26/2024	Ecosystem Studies [slides]	Required reading (due 9am today): Motoyama et al.: Re: CAPTCHAs – Understanding CAPTCHA-Solving Services in an Economic Context, USENIX Security 2010 Prasad, et al.: Who’s Calling? Characterizing Robocalls through Audio and Metadata Analysis, USENIX Security 2020
Week 5
01/31/2024	Web Security	Required reading (due 9am today): Felt et al.: Improving SSL Warnings: Comprehension and Adherence, CHI 2015 Reis et al.: Site Isolation: Process Separation for Web Sites within the Browser, USENIX Security 2019 -- you may watch the video and skim the paper!	Two security reviews due (11:30pm)
02/02/2024	Deception and Misinformation	Required reading (due 9am today): Mink et al.: DeepPhish: Understanding User Trust Towards Artificially Generated Profiles in Online Social Networks, USENIX Security 2022 Bak-Coleman et al.: Combining interventions to reduce the spread of viral misinformation, Nature Human Behavior 2022
Week 6
02/07/2024	System Security	Required reading (due 9am today) - pick one of these: Parno, et al.: Bootstrapping Trust in Commodity Computers, Oakland 2010 Kocher, et al.: Spectre Attacks: Exploiting Speculative Execution, IEEE Symposium on Security & Privacy (Oakland) 2019
02/09/2024	Project Checkpoint Presentations	None	Project checkpoint writeup due (11:30pm)
Week 7
02/14/2024	Peer Project Workshopping	None	Project workshopping materials due (10am -- BEFORE CLASS)
02/16/2024	Privacy and Anonymity	Required reading (due 9am today): Dingledine, et al.: Tor: The Second-Generation Onion Router, USENIX Security 2004 Englehardt and Narayanan, Online Tracking: A 1-million-site Measurement and Analysis, CCS 2016
Week 8
02/21/2024	Ethics (with Yoshi Kohno)	Optional reading (due 9am today, can replace one of your other reading writeups): Kohno, et al.: Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations, USENIX Security 2023 Optional but highly encouraged: Review Scenarios A-F on this page and use the linked Google Forms to compare your responses to others
02/23/2024	No class meeting today! I encourage you to use this time to work on your projects.	None
Week 9
02/28/2024	Adversarial ML and LLMs [slides]	Required reading (due 9am today): Sharif et al., Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition, CCS 2016 Abdelnabi et al., Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, AISec 2023
03/01/2024	Emerging Technologies	Required reading (due 9am today): Lebeck et al.: Securing Augmented Reality Output, Oakland 2017 Ney et al.: Computer Security, Privacy, and DNA Sequencing: Compromising Computers with Synthesized DNA, Privacy Leaks, and More, USENIX Security 2017	Project report draft due (11:30pm)
Week 10
03/06/2024	Online Abuse (with Miranda Wei)	Optional reading (due 9am today, can replace one of your other reading writeups): Thomas et al.: SoK: Hate, Harassment, and the Changing Landscape of Online Abuse, IEEE S&P (Oakland) 2021
03/08/2024	Security and Policy	Required reading (due 9am today): Savage: Lawful Device Access without Mass Surveillance Risk: A Technical Design Discussion, CCS 2018 Diffie and Landau: The Export of Cryptography in the 20th Century and the 21st, The Handbook of the History of Information Security, 2005
Finals Week
03/11/2024 (Monday!) 10am-3pm	Final Project Presentations Location: CSE2 387	(You will be asked to attend 3 presentations in addition to your own.)
03/14/2024	(No meeting)		Final project report due (11:30pm)