Nils Gruschka

• Pöhn, Daniela & Gruschka, Nils (2025). Qualitative In-Depth Analysis of GDPR Data Subject Access Requests and Responses from Major Online Services. ICISSP. 1, s. 149–156. doi: 10.5220/0013093000003899. Fulltekst i vitenarkiv Vis sammendrag

  The European General Data Protection Regulation (GDPR) grants European users the right to access their data processed and stored by organizations. Although the GDPR contains requirements for data processing organizations (e. g., understandable data provided within a month), it leaves much flexibility. In-depth research on how online services handle data subject access request is sparse. Specifically, it is unclear whether online services comply with the individual GDPR requirements, if the privacy policies and the data subject access responses are coherent, and how the responses change over time. To answer these questions, we perform a qualitative structured review of the processes and data exports of significant online services to (1) analyze the data received in 2023 in detail, (2) compare the data exports with the privacy policies, and (3) compare the data exports from November 2018 and November 2023. The study concludes that the quality of data subject access responses varies amo ng the analyzed services, and none fulfills all requirements completely.

• Bisztray, Tamas; Cherif, Bilel; Dubniczky, Richard A.; Gruschka, Nils; Borsos, Bertalan & Ferrag, Mohamed Amine [Vis alle 9 forfattere av denne artikkelen] (2025). I Know Which LLM Wrote Your Code Last Summer: LLM generated Code Stylometry for Authorship Attribution. I Pintor, Maura; Jagielski, Matthew & Jia, @@ruoxi (Red.), AISec '25: Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security. Association for Computing Machinery (ACM). ISSN 9798400718953. s. 28–39. doi: 10.1145/3733799.3762964. Fulltekst i vitenarkiv Vis sammendrag

  As code generated by Large Language Models (LLMs) becomes more common, identifying the specific model behind each sample is increasingly important. This paper presents the first systematic study of LLM authorship attribution for C programs. We release CodeT5-Authorship, a novel LLM that uses only the encoder layers from the original CodeT5 encoder-decoder architecture. Our model’s encoder output (first token) is passed through a two-layer classification head with GELU activation and dropout, producing a probability distribution over possible authors. To evaluate our approach, we introduce LLM-AuthorBench, a benchmark of 32,000 compilable C programs generated by eight state-of-the-art LLMs across diverse tasks. We compare our model to seven traditional ML classifiers and eight fine-tuned transformer models, including BERT, RoBERTa, CodeBERT, ModernBERT, DistilBERT, DeBERTa-V3, Longformer, and LoRA-fine-tuned Qwen2-1.5B. In binary classification, our model achieves 97.56 % accuracy in telling apart source code written by related models such as GPT-4.1 and GPT-4o, and 95.40 % accuracy for multi-class attribution among five leading LLMs (Gemini 2.5 Flash, Claude 3.5 Haiku, GPT-4.1, Llama 3.3, and DeepSeek-V3). To support open science, we release the CodeT5-Authorship architecture, the LLM-AuthorBench dataset, and all relevant Google Colab scripts on GitHub: https://github.com/LLMauthorbench/.

• Büttner, Andre & Gruschka, Nils (2025). Device-Bound vs. Synced Credentials: A Comparative Evaluation of Passkey Authentication. ICISSP. 2. doi: 10.5220/0013380600003899. Fulltekst i vitenarkiv Vis sammendrag

  With passkeys, the FIDO Alliance introduces the ability to sync FIDO2 credentials across a user’s devices through passkey providers. This aims to mitigate user concerns about losing their devices and promotes the shift toward password-less authentication. As a consequence, many major online services have adopted passkeys. However, credential syncing has also created a debate among experts about their security guarantees. In this paper, we categorize the different access levels of passkeys to show how syncing credentials impacts their security and availability. Moreover, we use the established framework from Bonneau et al.’s Quest to Replace Passwords and apply it to different types of device-bound and synced passkeys. By this, we reveal relevant differences, particularly in their usability and security, and show that the security of synced passkeys is mainly concentrated in the passkey provider. We further provide practical recommendations for end users, passkey providers, and relying parties.

• Büttner, Andre; Gruschka, Nils; Broen, Sverre Stafsengen & Pöhn, Daniela (2025). Authentication Inconsistencies Across Online Services: A Multi-Scenario Security Analysis. I Coppens, Bart; Volckaert, Bruno; Naessens, Vincent & Sutter, Bjorn De (Red.), Availability, Reliability and Security: ARES 2025 International Workshops, Ghent, Belgium, August 11–14, 2025, Proceedings, Part IV. Springer. ISSN 9783032006394. doi: 10.1007/978-3-032-00639-4_10. Fulltekst i vitenarkiv Vis sammendrag

  Online services are integral to modern life, supporting activities such as communication, commerce, and travel. These services typically require user authentication, traditionally relying on user ID and password combinations. However, this approach is increasingly vulnerable to attacks such as phishing. Many services have adopted stronger authentication mechanisms, including multi-factor authentication, risk-based authentication, and passkeys. Despite extensive research on login procedures, limited attention has been given to these post-login authentication processes. This paper presents a first study investigating the interplay between multi-factor authentication and context-specific authentication for ten popular online services. The results indicate that various authentication methods and behaviors can be observed across different scenarios and services.

• Büttner, Andre & Gruschka, Nils (2024). Evaluating the Influence of Multi-Factor Authentication and Recovery Settings on the Security and Accessibility of User Accounts. ICISSP. doi: 10.5220/0012319000003648. Fulltekst i vitenarkiv Vis sammendrag

  Nowadays, most online services offer different authentication methods that users can set up for multi-factor authentication but also as a recovery method. This configuration must be done thoroughly to prevent an adversary’s access while ensuring the legitimate user does not lose access to their account. This is particularly important for fundamental everyday services, where either failure would have severe consequences. Nevertheless, little research has been done on the authentication of actual users regarding security and the risk of being locked out of their accounts. To foster research in this direction, this paper presents a study on the account settings of Google and Apple users. Considering the multi-factor authentication configuration and recovery options, we analyzed the account security and lock-out risks. Our results provide insights into the usage of multi-factor authentication in practice, show significant security differences between Google and Apple accounts, and reveal (More)

• Büttner, Andre; Pedersen, Andreas Thue; Wiefling, Stephan; Gruschka, Nils & Iacono, Luigi Lo (2024). Is It Really You Who Forgot the Password? When Account Recovery Meets Risk-Based Authentication, Ubiquitous Security. Springer Nature. ISSN 9789819712748. doi: 10.1007/978-981-97-1274-8_26. Fulltekst i vitenarkiv Vis sammendrag

  Risk-based authentication (RBA) is used in online services to protect user accounts from unauthorized takeover. RBA commonly uses contextual features that indicate a suspicious login attempt when the characteristic attributes of the login context deviate from known and thus expected values. Previous research on RBA and anomaly detection in authentication has mainly focused on the login process. However, recent attacks have revealed vulnerabilities in other parts of the authentication process, specifically in the account recovery function. Consequently, to ensure comprehensive authentication security, the use of anomaly detection in the context of account recovery must also be investigated. This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild. We analyzed the adoption of RBAR by five prominent online services (that are known to use RBA). Our findings confirm the use of RBAR at Google, LinkedIn, and Amazon. Furthermore, we provide insights into the different RBAR mechanisms of these services and explore the impact of multi-factor authentication on them. Based on our findings, we create a first maturity model for RBAR challenges. The goal of our work is to help developers, administrators, and policy-makers gain an initial understanding of RBAR and to encourage further research in this direction.

• Pöhn, Daniela; Gruschka, Nils; Ziegler, Leonhard & Büttner, Andre (2023). A framework for analyzing authentication risks in account networks. Computers & Security. ISSN 0167-4048. 135. doi: 10.1016/j.cose.2023.103515. Fulltekst i vitenarkiv
• Büttner, Andre & Gruschka, Nils (2023). Protecting FIDO Extensions Against Man-in-the-Middle Attacks, Emerging Technologies for Authorization and Authentication, 5th International Workshop, ETAA 2022, Copenhagen, Denmark, September 30, 2022, Revised Selected Papers. Springer. ISSN 9783031254673. s. 70–87. doi: 10.1007/978-3-031-25467-3_5. Fulltekst i vitenarkiv Vis sammendrag

  FIDO authentication has many advantages over password-based authentication, since it relies on proof of possession of a security key. It eliminates the need to remember long passwords and, in particular, is resistant to phishing attacks. Beyond that, the FIDO protocols consider protocol extensions for more advanced use cases such as online transactions. FIDO extensions, however, are not well protected from Man-in-the-Middle (MitM) attacks. This is because the specifications require a secure transport between client and server, but there exists no end-to-end protection between server and authenticator. In this paper, we discuss MitM scenarios in which FIDO extensions may be intercepted. We further propose an application-layer security protocol based on the CBOR Object Signing and Encryption (COSE) standard to mitigate these threats. This protocol was verified in a formal security evaluation using ProVerif and, finally, implemented in a proof-of-concept.

• Unsel, Vincent; Wiefling, Stephan; Gruschka, Nils & Iacono, Luigi Lo (2023). Risk-Based Authentication for OpenStack: A Fully Functional Implementation and Guiding Example. I Shehab, Mohamed (Red.), CODASPY '23: Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy. Association for Computing Machinery (ACM). ISSN 9798400700675. s. 237–243. doi: 10.1145/3577923.3583634. Fulltekst i vitenarkiv
• Hansen, Malte; Gruschka, Nils & Jensen, Meiko (2023). Introducing the Concept of Data Subject Rights as a Service Under the GDPR. I Jensen, Meiko; Ziegler, Sébastien & Schiffner, Stefan (Red.), Privacy Symposium: Data Protection Law International Convergence and Compliance with Innovative Technologies. Springer. ISSN 9783031449383. s. 17–31. doi: 10.1007/978-3-031-44939-0_2. Fulltekst i vitenarkiv
• Sæbø, Johan Ivar; Büttner, Andre; Gruschka, Nils; Jolliffe, Bob & McGee, Austin (2022). Where There is No CISO. I Zheng, Y.; Abbott, P. & Robles-Flores, J. A. (Red.), Freedom and Social Inclusion in a Connected World : 17th IFIP WG 9.4 International Conference on Implications of Information and Digital Technologies for Development. Springer. ISSN 9783031194290. doi: 10.1007/978-3-031-19429-0_12. Fulltekst i vitenarkiv
• Baramashetru, Chinmayi; Tarifa, Silvia Lizeth Tapia; Owe, Olaf & Gruschka, Nils (2022). A Policy Language to Capture Compliance of Data Protection Requirements. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 13274, s. 289–309. doi: 10.1007/978-3-031-07727-2_16. Fulltekst i vitenarkiv Vis sammendrag

  From the very outset of the digital era, the protection of personal data against unauthorized usage and distribution has been one of the most significant challenges in distributed services. For this reason, new regulations such as the European Union’s the General Data Protection Regulation grant users tight control over their data that is handled by service providers. Compliance with such regulations can take expensive refitting of the existing systems and manual work. We propose a formal language that can define properties like informed consent, data subject rights, and the lawfulness to capture data protection requirements. The language is designed to abstract ownership information to make data dependencies explicit. We formalise a notion of policy compliance. This can be useful in service architecture with various actors who necessarily do not trust each other and may have conflicting interests.

• Pöhn, Daniela; Gruschka, Nils & Ziegler, Leonhard (2022). Multi-Account Dashboard for Authentication Dependency Analysis, ARES 2022: The 17th International Conference on Availability, Reliability and Security. Association for Computing Machinery (ACM). ISSN 9781450396707. s. 1–13. doi: 10.1145/3538969.3538987. Fulltekst i vitenarkiv
• Büttner, Andre & Gruschka, Nils (2021). Enhancing FIDO Transaction Confirmation with Structured Data Formats. NIKT: Norsk IKT-konferanse for forskning og utdanning. ISSN 1892-0713. Fulltekst i vitenarkiv Vis sammendrag

  FIDO Transaction Confirmation is an extension for the FIDO authentication protocols to enable the verification and signing of digital transactions, e.g., for online banking. The standard currently considers only to include a transaction message text in the assertion which is signed by the user’s authenticator. However, this is not useful for more complex transactions and leaves room for ambiguities that might lead to security vulnerabilities. Therefore, we propose to include the transaction information to the FIDO protocols in a structured data format with a strictly defined schema to validate and sign transactions more reliably and securely.

• Windrich, Melanie; Speck, Andreas & Gruschka, Nils (2021). Representing Data Protection Aspects in Process Models by Coloring. I Gruschka, Nils; Rannenberg, Kai; Antunes, Luis & Drogkaris, Prokopios (Red.), Privacy Technologies and Policy: 9th Annual Privacy Forum, APF 2021. Springer Nature. ISSN 9783030766627. s. 143–155. doi: 10.1007/978-3-030-76663-4_8. Fulltekst i vitenarkiv
• Bisztray, Tamas; Gruschka, Nils; Bourlai, Thirimachos & Fritsch, Lothar (2021). Emerging Biometric Modalities and their Use: Loopholes in the Terminology of the GDPR and Resulting Privacy Risks. I Brömme, Arslan; Busch, Christoph; Damer, Naser; Dantcheva, Antitza; Gomez-Barrero, Marta; Raja, Kiran; Rathgeb, Christian; Sequeira, Ana F. & Uhl, Andreas (Red.), Proceedings of the 20th International Conference of the Biometrics Special Interest Group (BIOSIG2021). Gesellschaft für Informatik. ISSN 9781665426930. s. 81–90. Fulltekst i vitenarkiv Vis sammendrag

  Technological advancements allow biometric applications to be more omnipresent than in any other time before. This paper argues that in the current EU data protection regulation, classification applications using biometric data receive less protection compared to biometric recognition. We analyse preconditions in the regulatory language and explore how this has the potential to be the source of unique privacy risks for processing operations classifying individuals based on soft traits like emotions. This can have high impact on personal freedoms and human rights and, therefore, should be subject to data protection impact assessment.

• Fritsch, Lothar & Gruschka, Nils (2021). Extraction and Accumulation of Identity Attributes from the Internet of Things. I Roßnagel, Heiko; Schunk, Christian & Mödersheim, Sebastian (Red.), Open Identity Summit 2021 Proceedings. Gesellschaft für Informatik. ISSN 9783885797067. Fulltekst i vitenarkiv Vis sammendrag

  Internet of Things (IoT) devices with wireless communication provide person-relateable information usable as attributes in digital identities. By scanning and profiling these signals against location and time, identity attributes can be generated and accumulated. This article introduces the concept of harvesting identifiable information from IoT. It summarizes ongoing work that aims at assessing the amount of person-relatable attributes that can get extracted from public IoT signals. We present our experimental data collection in Oslo/Norway and discuss systematic harvesting, our preliminary results, and their implications.

• Büttner, Andre; Nguyen, Hoai Viet; Gruschka, Nils & Iacono, Luigi Lo (2021). Less is Often More: Header Whitelisting as Semantic Gap Mitigation in HTTP-Based Software Systems. I Jøsang, Audun; Futcher, Lynn & Hagen, Janne Merete (Red.), ICT Systems Security and Privacy Protection. Springer Nature. ISSN 9783030781200. s. 332–347. doi: 10.1007/978-3-030-78120-0_22. Fulltekst i vitenarkiv Vis sammendrag

  The web is the most wide-spread digital system in the world and is used for many crucial applications. This makes web application security extremely important and, although there are already many security measures, new vulnerabilities are constantly being discovered. One reason for some of the recent discoveries lies in the presence of intermediate systems—e.g. caches, message routers, and load balancers—on the way between a client and a web application server. The implementations of such intermediaries may interpret HTTP messages differently, which leads to a semantically different understanding of the same message. This so-called semantic gap can cause weaknesses in the entire HTTP message processing chain. In this paper we introduce the header whitelisting (HWL) approach to address the semantic gap in HTTP message processing pipelines. The basic idea is to normalize and reduce an HTTP request header to the minimum required fields using a whitelist before processing it in an intermediary or on the server, and then restore the original request for the next hop. Our results show that HWL can avoid misinterpretations of HTTP messages in the different components and thus prevent many attacks rooted in a semantic gap including request smuggling, cache poisoning, and authentication bypass.

• Bisztray, Tamas; Gruschka, Nils; Mavroeidis, Vasileios & Fritsch, Lothar (2020). Data Protection Impact Assessment in Identity Control Management with a Focus on Biometrics. I Roßnagel, Heiko; Schunck, Christian H.; Mödersheim, Sebastian & Hühnlein, Detlef (Red.), Open Identity Summit 2020. Gesellschaft für Informatik. ISSN 9783885796992. s. 185–192. doi: 10.18420/ois2020_17. Fulltekst i vitenarkiv
• Bisztray, Tamas & Gruschka, Nils (2019). Privacy impact assessment: Comparing methodologies with a focus on practicality. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 11875 LNCS, s. 3–19. doi: 10.1007/978-3-030-35055-0_1. Fulltekst i vitenarkiv
• Wiefling, Stephan; Gruschka, Nils & Iacono, Luigi Lo (2019). Even Turing Should Sometimes Not Be Able to Tell: Mimicking Humanoid Usage Behavior for Exploratory Studies of Online Service. I Askarov, Aslan; Hansen, René Rydhof & Rafnsson, Willard (Red.), Secure IT Systems - 24th Nordic Conference, NordSec 2019. Springer Nature. ISSN 9783030350543. s. 188–203. doi: 10.1007/978-3-030-35055-0_12. Fulltekst i vitenarkiv
• Gruschka, Nils & Bisztray, Tamas (2019). Privacy Impact Assessment: Comparing Methodologies with a Focus on Practicality. I Askarov, Aslan; Hansen, René Rydhof & Rafnsson, Willard (Red.), Secure IT Systems - 24th Nordic Conference, NordSec 2019. Springer Nature. ISSN 9783030350543. s. 3–19. doi: 10.1007/978-3-030-35055-0_1. Fulltekst i vitenarkiv
• Gruschka, Nils; Iacono, Luigi Lo & Tolsdorf, Jan (2018). Classification of android app permissions: Tell me what app you are and i tell you what you are allowed to do. Proceedings of the ... European conference on information warfare and security. ISSN 2048-8602. 2018-June, s. 181–189. Fulltekst i vitenarkiv
• Gruschka, Nils; Mavroeidis, Vasileios; Vishi, Kamer & Jensen, Meiko (2018). Privacy Issues and Data Protection in Big Data: A Case Study Analysis under GDPR. I Abe, Naoki; Liu, Huan; Hu, Xiaohua; Ahmed, Nesreen; Qiao, Mu; Song, Yang; Kossmann, Donald; Liu, Bing; Lee, Kisung; Tang, Jiliang; He, Jingrui & Saltz, Jeffrey (Red.), 2018 IEEE International Conference on Big Data (Big Data), Seattle, 10-13 Dec. 2018. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538650356. s. 5027–5033. doi: 10.1109/BigData.2018.8622621. Fulltekst i vitenarkiv Vis sammendrag

  Big data has become a great asset for many organizations, promising improved operations and new business opportunities. However, big data has increased access to sensitive information that when processed can directly jeopardize the privacy of individuals and violate data protection laws. As a consequence, data controllers and data processors may be imposed tough penalties for non-compliance that can result even to bankruptcy. In this paper, we discuss the current state of the legal regulations and analyse different data protection and privacy-preserving techniques in the context of big data analysis. In addition, we present and analyse two real-life research projects as case studies dealing with sensitive data and actions for complying with the data regulation laws. We show which types of information might become a privacy risk, the employed privacy-preserving techniques in accordance with the legal requirements, and the influence of these techniques on the data processing phase and the research results.

Se alle arbeider i NVA

• Bieker, Felix; Conca, Silvia de; Gruschka, Nils; Jensen, Meiko & Schiering, Ina (2024). Privacy and Identity Management. Sharing in a Digital World. Springer Nature. ISBN 9783031579783. 342 s. doi: 10.1007/978-3-031-57978-3. Fulltekst i vitenarkiv
• Gruschka, Nils; Rannenberg, Kai; Antunes, Luis & Drogkaris, Prokopios (2021). Privacy Technologies and Policy: 9th Annual Privacy Forum, APF 2021. Springer Nature. ISBN 9783030766627. 169 s. Fulltekst i vitenarkiv
• Gruschka, Nils (2018). Secure IT Systems - 23rd Nordic Conference, NordSec 2018, Oslo, Norway, November 28-30, 2018, Proceedings. Springer Nature. ISBN 9783030036379. 486 s. Fulltekst i vitenarkiv

Se alle arbeider i NVA

• Bieker, Felix; Conca, Silvia de; Gruschka, Nils; Jensen, Meiko & Schiering, Ina (2024). Preface. IFIP Advances in Information and Communication Technology. ISSN 1868-4238. 695, s. v–vi. Fulltekst i vitenarkiv
• Bisztray, Tamas; Gruschka, Nils; Bourlai, Thirimachos & Fritsch, Lothar (2021). Emerging Biometric Modalities and their Use: Loopholes in the Terminology of the GDPR and Resulting Privacy Risks. Fulltekst i vitenarkiv Vis sammendrag

  Technological advancements allow biometric applications to be more omnipresent than in any other time before. This paper argues that in the current EU data protection regulation, classification applications using biometric data receive less protection compared to biometric recognition. We analyse preconditions in the regulatory language and explore how this has the potential to be the source of unique privacy risks for processing operations classifying individuals based on soft traits like emotions. This can have high impact on personal freedoms and human rights and, therefore, should be subject to data protection impact assessment.

• Gruschka, Nils; Antunes, Luís Filipe Coelho; Rannenberg, Kai & Drogkaris, Prokopios (2021). Preface. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 12703, s. v–v. Fulltekst i vitenarkiv
• Baramashetru, Chinmayi; Tarifa, Silvia Lizeth Tapia; Gruschka, Nils & Owe, Olaf (2025). Data Privacy Compliance by Construction in Distributed Systems. GDPR Enforcement, Privacy by Design and Consent-Based Data Handling. Universitetet i Oslo. Fulltekst i vitenarkiv Vis sammendrag

  As digital systems increasingly rely on the collection and processing of personal data, it becomes difficult to ensure balance between data processing and user’s privacy. In response to increasing data mishandling and complex regulatory landscapes, the European Union enacted the General Data Protection Regulation (GDPR) to enforce structured and transparent handling of personal data. It introduces strict obligations for data privacy by design and default, consent based processing, and purpose limitation, yet its legal abstraction offers little guidance for technical implementation. This thesis investigates how data protection requirements, especially those mentioned in the GDPR can be formally modeled and enforced through programming language techniques. It develops a sequence of language-based techniques to offer data privacy compliance by construction in distributed, actor-based systems, with user consent and purpose based processing at its core. The first contribution proposes a policy specification language that concisely expresses data privacy requirements, usage restrictions, and captures consent. It is designed as a high-level, declarative abstraction for capturing users’ privacy preferences and systematically aligning them with GDPR principles within Distributed systems. It expresses the notion of policy compliance for a distributed system with multiple actors with conflicting policies. Furthermore, it uses a taxonomy-based expression for policy filtering and supports granular policy specification. To bridge the gap between policy level reasoning and programming Language support, the thesis next presents a privacy-aware active object language (PAOL) that integrates GDPR concepts such as consent, purpose limitation, personal data, and data privacy compliance as programming language constructs in its syntax and semantics. It ensures that operations on personal data are checked at runtime and each step or operation is supported by valid, current consent. This runtime enforcement is next complemented by a type system for enforcing GDPR-aligned behavior statically. TyPAOL extends the PAOL by incorporating a type and constraint inference system to enforce GDPR based data privacy policies. It adopts a hybrid type checking mechanism that shifts compliance checks from execution to method activation. This approach ensures that no method execution proceeds unless all the generated type constraints are satisfied at method activation, thereby avoiding mid-execution failures. It provides a formal proof of soundness and ensures data privacy compliance for a running object within a well typed-configuration. In order to validate our programs, a rewriting logic based framework i.e., Maude, is used to develop a proof of concept of the proposed framework.

• Büttner, Andre; Gruschka, Nils & Sæbø, Johan Ivar (2024). Security of Evolving Authentication Technologies. Universitetet i Oslo. Fulltekst i vitenarkiv Vis sammendrag

  In today’s digital age, people are burdened with a plethora of online profiles, e.g., for social media, banking, and governmental services. Traditionally, passwords have been the primary method to sign in to those accounts. They, however, are increasingly recognized as insecure. Thus, service providers implement new technologies to protect their users. This thesis explores the security of modern authentication technologies, focusing on multi-factor authentication, passwordless authentication, and self-sovereign identity (SSI). The research reveals that many users configure their accounts poorly, entailing the risk of account takeovers or account lockouts. The thesis also presents the first systematic study on risk-based account recovery, a hitherto overlooked concept that impacts the users' security and accessibility. Moreover, FIDO2, a recent innovation aimed at replacing passwords, is found to have vulnerabilities in certain conditions. A protocol is therefore suggested that can prevent such vulnerabilities effectively. Finally, a review of authentication in the context of data subject rights uncovers questionable practices, which inspired the proposal of an SSI-based concept to mitigate associated security and privacy risks.

Se alle arbeider i NVA