Category Archives: Call for papers

Conference announcements, etc.

CFP: Passwords 2016

Call for Papers
The 11th International Conference on Passwords

5-7 December 2016
Ruhr-University Bochum, Germany

The Passwords conference was launched in 2010 as a response to
the lack of robustness and usability of current personal
authentication practices and solutions. Annual participation has
doubled over the past three years. Since 2014, the conference
accepts peer-reviewed papers.


Research papers and short papers:
– Title and abstract submission: EXTENDED TO 2016-08-22 2016-07-04  (23:59 UTC-11)
– Paper submission: EXTENDED TO 2016-08-29 2016-07-11 (23:59 UTC-11)
– Notification of acceptance: 2016-10-17 2016-09-05
– Camera-ready from authors: 2016-10-31 2016-09-19

Hacker Talks:
– Talk proposal submission: 2016-09-15 (23:59 UTC-11)
– Notification of acceptance: 2016-09-30


More than half a billion user passwords have been compromised
over the last five years, including breaches at internet
companies such as Target, Adobe, Heartland, Forbes, LinkedIn,
Yahoo, and LivingSocial. Yet passwords, PIN codes, and similar
remain the most prevalent method of personal
authentication. Clearly, we have a systemic problem.

This conference gathers researchers, password crackers, and
enthusiastic experts from around the globe, aiming to better
understand the challenges surrounding the methods personal
authentication and passwords, and how to adequately solve these
problems. The Passwords conference series seek to provide a
friendly environment for participants with plenty opportunity to
communicate with the speakers before, during, and after their


We seek original contributions that present attacks, analyses,
designs, applications, protocols, systems, practical experiences,
and theory. Submitted papers may include, but are not limited to,
the following topics, all related to passwords and

– Technical challenges and issues:
– Cryptanalytic attacks
– Formal attack models
– Cryptographic protocols
– Dictionary attacks
– Digital forensics
– Online attacks/Rate-limiting
– Side-channel attacks
– Administrative challenges:
– Account lifecycle management
– User identification
– Password resets
– Cross-domain and multi-enterprise system access
– Hardware token administration
– Password “replacements”:
– 2FA and multifactor authentication
– Risk-based authentication
– Password managers
– Costs and economy
– Biometrics
– Continous authentication
– FIDO – U2F
– Deployed systems:
– Best practice reports
– Incident reports/Lessons learned
– Human factors:
– Usability
– Design & UX
– Social Engineering
– Memorability
– Accessibility
– Pattern predictability
– Gestures and graphical patterns
– Psychology
– Statistics (languages, age, demographics…)
– Ethics


Papers must be submitted as PDF using the Springer LNCS format
for Latex. Abstract and title must be submitted one week ahead of
the paper deadline.

We seek submissions for review in the following three categories:

– Research Papers
– Short Papers
– “Hacker Talks” (talks without academic papers attached)

RESEARCH PAPERS should describe novel, previously unpublished
technical contributions within the scope of the call. The papers
will be subjected to double-blind peer review by the program
committee. Paper length is limited to 16 pages (LNCS format)
excluding references and well-marked appendices. The paper
submitted for review must be anonymous, hence author names,
affiliations, acknowledgements, or obvious references must be
temporarily edited out for the review process. The program
committee may reject non-anonymized papers without reading
them. The submitted paper (in PDF format) must follow the
template described by Springer at

SHORT PAPERS will also be subject to peer review, where the
emphasis will be put on work in progress, hacker achievements,
industrial experiences, and incidents explained, aiming at
novelty and promising directions. Short paper submissions should
not be more than 6 pages in standard LNCS format in total. A
short paper must be labeled by the subtitle “Short
Paper”. Accepted short paper submissions may be included in the
conference proceedings. Short papers do not need to be
anonymous. The program committee may accept full research papers
as short papers.

HACKER TALKS are presentations without an academic paper
attached. They will typically explain new methods, techniques,
tools, systems, or services within the Passwords scope. Proposals
for Hacker Talks can be submitted by anybody (“hackers”,
academics, students, enthusiasts, etc.) in any format, but
typically will include a brief (2-3 paragraphs) description of
the talk’s content and the person presenting. They will be
evaluated by a separate subcommittee led by Per Thorsheim,
according to different criteria than those used for the refereed

At least one of the authors of each accepted paper must register
and present the paper at the workshop. Papers without a full
registration will be withdrawn from the proceedings and from the
workshop programme.

Papers that pass the peer review process and that are presented
at the workshop will be included in the event proceedings,
published by Springer in the Lecture Notes in Computer
Science (LNCS) series.

Papers must be unpublished and not being considered elsewhere for
publication. Plagiarism and self-plagiarism will be treated as a
serious offense.  Program committee members may submit papers but
program chairs may not.  The time frame for each presentation
will be either 30 or 45 minutes, including Q&A. Publication will
be by streaming, video and web.


– General chair: Per Thorsheim, God Praksis AS (N)
– Program co-chair and host: Markus Dürmuth, Ruhr-University Bochum (DE)
– Program co-chair: Frank Stajano, University of Cambridge (UK)


– Adam Aviv, United States Naval Academy (USA)
– Lujo Bauer, Carnegie Mellon University (USA)
– Jeremiah Blocki, Microsoft Research/Purdue University (USA)
– Joseph Bonneau, Stanford University (USA)
– Heather Crawford, Florida Institute of Technology (USA)
– Bruno Crispo, KU Leuven (B) and University of Trento (IT)
– Serge Egelman, ICSI and University of California at Berkeley (USA)
– David Freeman, LinkedIn (USA)
– Simson Garfinkel, NIST (USA)
– Tor Helleseth, University of Bergen (N)
– Cormac Herley, Microsoft Research (USA)
– Graeme Jenkinson, University of Cambridge (UK)
– Mike Just, Heriot-Watt University (UK)
– Stefan Lucks, Bauhaus-University Weimar (D)
– Paul van Oorschot, Carleton University (CA)
– Angela Sasse, University College London (UK)
– Elizabeth Stobert, ETH Zurich (CH)


– Per Thorsheim, God Praksis AS (N)
– Stig F. Mjolsnes, Norwegian University of Science and Technology (N)
– Frank Stajano, University of Cambridge (UK)

More and updated information can be found at the conference website

A dubious cyber security conference

I’ve written before about dubious “academic” journals… and today I’m going to discuss a dubious “academic” conference (which is associated with some dubious journals, but it’s the conference that’s my focus today).

Fordham University has been running the “International Conference on Cyber Security” since 2009 and ICCS 2016 (labelled “Sixth” because they skipped 2011 and 2014) will take place in New York in July. This conference has an extremely reputable program committee and is run by Fordham and the Federal Bureau of Investigation (I expect you’ve heard of them … they investigate cybercrime in the USA…).

There’s also another “International Conference on Cyber Security (ICCS 2016)” running this year as well … it will take place in Zurich in July and is run by WASET (the World Academy of Science, Engineering and Technology). The program committee for this one is somewhat less prestigious (I sorry to say that I have not heard of any of them … and to my mind the most reputable looking person is “Wei Yan of Trend Micro” … except he’s currently on his fourth job since he left Trend Micro in 2010, so that makes me wonder how many of the people on the list know that they’re mentioned ?

There’s other reasons for feeling this conference might be a little dubious, not least that this is apparently the “Eighteenth ICCS”. That might lead you to believe that there have been seventeen previous ICCS events … but I did a lot of searches and failed to find any of them !

My searches did turn up the “2nd International Conference on Cyber Security (ICCS) 2016” which will take place at the Rajasthan Technical University, India — this one looks pretty respectable, with PC members from India and the USA.

So if you fancy going to Cyber Security Conference in 2016 then you are spoilt for choice, but I would not myself recommend travelling to Zurich. A key reason is that you may find that the Dorint Airport-Hotel, where ICCS 2016 is to be held may turn out to be a little crowded… the same hotel is hosting no fewer than 160 other International conferences at exactly the same time: click here for the full list!

Alternatively, if you can’t make it this year, put a note in your diary. The “31st International Conference on Cyber Security (ICCS 2029)” is planned to take place in Zurich on July 21–22 2029… Wei Jan is on the PC for that one too … and the submission deadline is as soon as March 31, 2029, so best to get a move on with finishing that paper!

As a final note, invited papers from ICCS 2016 (the Zurich version) are to be published in a special issue of “Advances in Cyber Security”. Now you might cynically think that this was an open access journal from WASEC, but no they have no journal with that title (and in fact neither does anyone else)… but what do you know, “Advances in Cyber Security” is a fine looking book published in December 2012 by none other than Fordham University Press. Small world, isn’t it!

CFP: Learning from Authoritative Security Experiment Results (LASER 2016)

This year, I’m on the PC for LASER 2016: the Oakland-attached workshop on Learning from Authoritative Security Experiment Results. The LASER 2016 CFP is now online, with a focus on methodologies for computer security experimentation, new experimental approaches, unexpected results or failed experiments, and, more generally, consideration of how to standardise scientific approaches to security research. Please consider submitting a paper — especially if you are pushing the boundaries on how we conduct experiments in the field of computer-security research!

The deadline is 29 January 2016. A limited number of student scholarships will be available to attend.

Continue reading CFP: Learning from Authoritative Security Experiment Results (LASER 2016)

Double bill: Password Hashing Competition + KeyboardPrivacy

Two interesting items from Per Thorsheim, founder of the PasswordsCon conference that we’re hosting here in Cambridge this December (you still have one month to submit papers, BTW).

First, the Password Hashing Competition “have selected Argon2 as a basis for the final PHC winner”, which will be “finalized by end of Q3 2015”. This is about selecting a new password hashing scheme to improve on the state of the art and make brute force password cracking harder. Hopefully we’ll have some good presentations about this topic at the conference.

Second, and unrelated: Per Thorsheim and Paul Moore have launched a privacy-protecting Chrome plugin called Keyboard Privacy to guard your anonymity against websites that look at keystroke dynamics to identify users. So, you might go through Tor, but the site recognizes you by your typing pattern and builds a typing profile that “can be used to identify you at other sites you’re using, were identifiable information is available about you”. Their plugin intercepts your keystrokes, batches them up and delivers them to the website at a constant pace, interfering with the site’s ability to build a profile that identifies you.

Passwords 2015 call for papers

The  9th International Conference on Passwords will be held at Cambridge, UK on 7-9 December 2015.

Launched in 2010 by Per Thorsheim,  Passwordscon is a lively and entertaining conference series dedicated solely to passwords. Passwordscon’s unique mix of refereed papers and hacker talks encourages a kind of cross-fertilization that I’m sure you’ll find both entertaining and fruitful.

Paper submissions are due by 7 September 2015. Selected papers will be included in the event proceedings, published by Springer in the Lecture Notes in Computer Science (LNCS) series.

We hope to see lots of you there!

Graeme Jenkinson, Local arrangements chair

Decepticon: International Conference on Deceptive Behavior

Call for papers

We are proud to present DECEPTICON 2015 – International Conference on Deceptive Behavior, to be held 24-26 August 2015 at the University of Cambridge, UK. Decepticon brings together researchers, practitioners, and like-minded individuals with a taste for interdisciplinary science in the detection and prevention of deception.

We are organising two panel sessions; one on Future Directions in Lie Detection Research with Aldert Vrij, Par-Anders Granhag, Steven Porter and Timothy Levine, and one on Technology Assisted Lie Detection with Jeff Hancock, Judee Burgoon, Bruno Verschuere and Giorgio Ganis. We broadly and warmly welcome people with varying scientific backgrounds. To cover the diversity of approaches to deception research, our scientific committee members are experts in fields from psychology to computer science, and from philosophy to behavioral economics. For example, scientific committee members from the University of Cambridge are Ross Anderson, Nicholas Humphrey, Peter Robinson and Sophie Van Der Zee.

We strongly encourage practitioners, academics and students alike to submit abstracts that touch on the topic of deception. The extended deadline for abstract submissions (max. 300 words) for an oral, panel or poster presentation is 8 APRIL 2015. Interested in attending, but don’t feel like presenting? You can register for the conference here.

Please visit our webpage for more information. We are happy to answer any questions!

We hope to see you in Cambridge,



WEIS 2015 call for papers

The 2015 Workshop on the Economics of Information Security will be held at Delft, the Netherlands, on 22-23 June 2015. Paper submissions are due by 27 February 2015. Selected papers will be invited for publication in a special issue of the Journal of Cybersecurity, a new, interdisciplinary, open-source journal published by Oxford University Press.

We hope to see lots of you in Delft!

Passwords’14 in Trondheim

Passwords^14 is part of a lively and entertaining conference series started by password hacker Per Thorsheim in 2010 and devoted solely to passwords.

Up to now it was mostly invited talks and hacks but this year we’re also having scientific papers, which will be peer-reviewed. Proceedings will be published in Springer LNCS. Submission deadline 27 October 2014.

Call for papers:

Conference site:

See you in Trondheim, Norway, 8-10 December 2014.

Call for Papers: 14th Privacy Enhancing Technologies Symposium (PETS 2014)

The Privacy Enhancing Technologies Symposium (PETS) aims to advance the state of the art and foster a world-wide community of researchers and practitioners to discuss innovation and new perspectives.

PETS seeks paper submissions for its 14th event to be held in Amsterdam, Netherlands, July 16–18, 2014 (of which I am program chair). Papers should present novel practical and/or theoretical research into the design, analysis, experimentation, or fielding of privacy-enhancing technologies. While PETS has traditionally been home to research on anonymity systems and privacy-oriented cryptography, we strongly encourage submissions in a number of both well-established and some emerging privacy-related topics.

Abstracts should be submitted by 10 February 2014, with full papers submitted by 13 February 2014. For further details, see the call for papers.

WEIS 2014 call for papers

Next year’s Workshop on the Economics of Information Security (WEIS 2014) will be at Penn State on June 23–24. The call for papers is now out; papers are due by the end of February.

It will be fascinating to see what effects the Snowden revelations will have on the community’s thinking about security standards and regulation, the incentives for information sharing and cooperation, and the economics of privacy, to mention only three of the workshop’s usual topics. Now that we’ve had six months to think things through, how do you think the security game has changed, and why? Do we need minor changes to our models, or major ones? Are we in the same policy world, or a quite different one? WEIS could be particularly interesting next year. Get writing!