Andre Büttner

Doctoral Research Fellow - Digital infrastructure and security

Norwegian version of this page

Email andrbut@ifi.uio.no

Username

Visiting address Gaustadalléen 23B 0373 Oslo

Postal address Postboks 1080 0316 Oslo

Download business card

Tags: Web Application Security, Distributed Systems, Web Authentication, Health Information Systems

Publications

Büttner, Andre & Gruschka, Nils (2021). Enhancing FIDO Transaction Confirmation with Structured Data Formats. NIKT: Norsk IKT-konferanse for forskning og utdanning. ISSN 1892-0713. Show summary
FIDO Transaction Confirmation is an extension for the FIDO authentication protocols to enable the verification and signing of digital transactions, e.g., for online banking. The standard currently considers only to include a transaction message text in the assertion which is signed by the user’s authenticator. However, this is not useful for more complex transactions and leaves room for ambiguities that might lead to security vulnerabilities. Therefore, we propose to include the transaction information to the FIDO protocols in a structured data format with a strictly defined schema to validate and sign transactions more reliably and securely.
Büttner, Andre; Nguyen, Hoai Viet; Gruschka, Nils & Lo Iacono, Luigi (2021). Less is Often More: Header Whitelisting as Semantic Gap Mitigation in HTTP-Based Software Systems. In Jøsang, Audun; Futcher, Lynn & Hagen, Janne Merete (Ed.), ICT Systems Security and Privacy Protection. Springer Nature. ISSN 978-3-030-78120-0. p. 332–347. doi: 10.1007/978-3-030-78120-0_22.

Published Oct. 9, 2020 11:20 AM - Last modified Feb. 28, 2022 3:28 PM