Maximilian Golla

Postdoc at the Max Planck Institute for Security and Privacy in Bochum, Germany

Hi there!

I'm a postdoctoral researcher interested in usable security and privacy. While I studied computer science, I later specialized in information security and developed an interest for usability and human factors in computer security.

During my PhD, I focused on exploring the usability and security of password-based user authentication. At the time, I was a scholar of the DFG (German Research Foundation) research training group UbiCrypt. I worked extensively with Blase Ur from SUPERgroup at the University of Chicago and Adam J. Aviv from GWUSEC Lab at the George Washington University. I received my PhD in 2019 from Ruhr University Bochum, where I was advised by Prof. Dr. Markus Dürmuth.

Since October 2019, I'm a postdoc at the Max Planck Institute for Security and Privacy in Bochum, Germany. The research of our group at MPI-SP focuses on computer security, privacy, and human-computer interaction (HCI). We are especially working on methods to help users make better security and privacy decisions, as well as, to make complex computer systems more usable for non-technical users.

Interests

User Authentication

Privacy Controls

User Authentication
- Passwords (Strength, Recovery, Management, Quantum ...)
- Mobile Authentication (PINs, Patterns, Biometrics)
- Notifications (Reuse, WebAuthn, 2FA)
- Passwordless (FIDO2 & biometric WebAuthn)
- Access Control (Smart Home & IoT)
- Alternative Schemes (Implicit Memory, Gamification)

Privacy Controls
- Social Networks (Targeting & Transparency Tools)
- Voice Assistants (Private Mode & Accidental Triggers)
- Secure Communication (Messenger & Email Encryption)

Education

Doctorate (Dr.-Ing.) — Summa cum laude (With highest honors)
- Usable Security and Privacy
- «On the Usability and Security of Password-Based User Authentication» — Distinguished Thesis Award
- Ruhr University Bochum
Master of Science (M.Sc., Engineer) — Very good
- IT Security - Network & Systems
- «Graphical Fallback Authentication»
- Ruhr University Bochum
Bachelor of Engineering (B.Eng., Engineer) — Good
- Computer Science - Communication in Distributed Systems
- «Security Audit of a Web Interface for Building Automation»
- University of Applied Sciences Würzburg-Schweinfurt

Contact

Maximilian Golla
Max Planck Institute for Security and Privacy
Ruhr University Bochum, ID 2/129
Universitaetsstr. 150, 44780 Bochum
maximilian.golla@rub.de

MPI-SP RUB Twitter Slack GitHub Google Hall of Fame PGP Key

Peer-Reviewed Publications

Below you can find a list of selected papers and posters.
Last update: January 2022

Citation Profiles:
Google Scholar DBLP ORCID iD IEEE Xplore ACM DL ResearchGate

2022
Elsevier Computer Speech & Language — Special Issue on Voice Privacy — Journal Publication
Exploring Accidental Triggers of Smart Speakers
Lea Schönherr, Maximilian Golla, Thorsten Eisenhofer, Jan Wiele, Dorothea Kolossa, and Thorsten Holz
- Preprint Website
2021
International Conference on Cryptology and Network Security (CANS '21) — December, 2021 — Vienna, Austria
Towards Quantum Large-Scale Password Guessing on Real-World Distributions
Markus Dürmuth, Maximilian Golla, Philipp Markert, Lars Schlieper, and Alexander May
- Paper Slides Talk
ACM Transactions on Privacy and Security (TOPS '21) — November, 2021 — Journal Publication
On the Security of Smartphone Unlock PINs
Philipp Markert, Daniel V. Bailey, Maximilian Golla, Markus Dürmuth, and Adam J. Aviv
- Paper Website Dataset
USENIX Security Symposium (SSYM '21) — August, 2021 — Virtual Conference (Acceptance: 18.7%)
"It's Stored, Hopefully, on an Encrypted Server": Mitigating Users' Misconceptions About FIDO2 Biometric WebAuthn
Leona Lassak, Annika Hildebrandt, Maximilian Golla, and Blase Ur
- Extended Version Paper
  
  Slides
  
  USENIX Security 21 PasswordsCon 21
  
  Source Code
USENIX Security Symposium (SSYM '21) — August, 2021 — Virtual Conference (Acceptance: 18.7%)
Are Privacy Dashboards Good for End Users? Evaluating User Perceptions and Reactions to Google's My Activity
Florian M. Farke, David G. Balash, Maximilian Golla, Markus Dürmuth, and Adam J. Aviv
- Extended Version Paper
  
  Slides Talk
USENIX Security Symposium (SSYM '21) — August, 2021 — Virtual Conference (Acceptance: 18.7%)
Driving 2FA Adoption at Scale: Optimizing Two-Factor Authentication Notification Design Patterns
Maximilian Golla, Grant Ho, Marika Lohmus, Monica Pulluri, and Elissa M. Redmiles
- Paper Slides Talk
2020
IEEE Symposium on Security and Privacy (SP '20) — May, 2020 — San Francisco, California, USA (Acceptance: 12.3%)
This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs
Philipp Markert, Daniel V. Bailey, Maximilian Golla, Markus Dürmuth, and Adam J. Aviv
- Paper Slides Talk Website Dataset
2019
USENIX Symposium on Usable Privacy and Security (SOUPS '19) — August, 2019 — Santa Clara, California, USA ( Distinguished Poster Award)
POSTER: "What was that site doing with my Facebook password?" Designing Password-Reuse Notifications
Miranda Wei, Maximilian Golla, Juliette Hainline, Lydia Filipe, Markus Dürmuth, Elissa Redmiles, and Blase Ur
- Poster Session
PhD Thesis — Ruhr University Bochum (RUB) — May, 2019 — Bochum, Germany ( Distinguished Thesis Award)
On the Usability and Security of Password-Based User Authentication
Maximilian Golla
- PhD Thesis Slides
IEEE Symposium on Security and Privacy (SP '19) — May, 2019 — San Francisco, California, USA (Acceptance: 11.7%)
Reasoning Analytically About Password-Cracking Software
Enze Liu, Amanda Nakanishi, Maximilian Golla, David Cash, Blase Ur
- Paper
  
  IEEE SP 19 PasswordsCon 19
  
  IEEE SP 19 PasswordsCon 19
  
  Source Code
ISOC Workshop on Usable Security (USEC '19) — February, 2019 — San Diego, California, USA
Work in Progress: A Comparative Long-Term Study of Fallback Authentication
Philipp Markert, Maximilian Golla, Elizabeth Stobert, and Markus Dürmuth
- Paper Slides
ISOC Workshop on Usable Security (USEC '19) — February, 2019 — San Diego, California, USA
Work in Progress: On the In-Accuracy and Influence of Android Pattern Strength Meters
Maximilian Golla, Jan Rimkus, Adam J. Aviv, and Markus Dürmuth
- Paper Slides
2018
ACM Conference on Computer and Communications Security (CCS '18) — October, 2018 — Toronto, Canada (Acceptance: 16.6%)
"What was that site doing with my Facebook password?" Designing Password-Reuse Notifications
Maximilian Golla, Miranda Wei, Juliette Hainline, Lydia Filipe, Markus Dürmuth, Elissa Redmiles, and Blase Ur
- Paper Slides Talk
ACM Conference on Computer and Communications Security (CCS '18) — October, 2018 — Toronto, Canada (Acceptance: 16.6%)
On the Accuracy of Password Strength Meters
Maximilian Golla and Markus Dürmuth
- Paper Slides Talk Website Source Code
USENIX Security Symposium (SSYM '18) — August, 2018 — Baltimore, Maryland, USA (Acceptance: 19.1%)
Rethinking Access Control and Authentication for the Home Internet of Things (IoT)
Weijia He, Maximilian Golla, Roshni Padhi, Jordan Ofek, Markus Dürmuth, Earlence Fernandes, and Blase Ur
- Paper Slides Talk
Who Are You?! Adventures in Authentication Workshop (WAY '18) — August, 2018 — Baltimore, Maryland, USA
"Will Any Password Do?" Exploring Rate-Limiting on the Web
Maximilian Golla, Theodor Schnitzler, and Markus Dürmuth
- Paper Slides
Who Are You?! Adventures in Authentication Workshop (WAY '18) — August, 2018 — Baltimore, Maryland, USA
Bars, Badges, and High Scores: On the Impact of Password Strength Visualizations
Maximilian Golla, Björn Hahn, Karsten Meyer zu Selhausen, Henry Hosseini, and Markus Dürmuth
- Paper Slides
Who Are You?! Adventures in Authentication Workshop (WAY '18) — August, 2018 — Baltimore, Maryland, USA
The Password Doesn't Fall Far: How Service Influences Password Choice
Miranda Wei, Maximilian Golla, and Blase Ur
- Paper Slides
2017
Who Are You?! Adventures in Authentication Workshop (WAY '17) — July, 2017 — Santa Clara, California, USA
"I want my money back!" Limiting Online Password-Guessing Financially
Maximilian Golla, Daniel V. Bailey, and Markus Dürmuth
- Paper Slides
USENIX Symposium on Usable Privacy and Security (SOUPS '17) — July, 2017 — Santa Clara, California, USA
POSTER: Towards Implicit Visual Memory-Based Authentication
Claude Castelluccia, Markus Dürmuth, Maximilian Golla, and Fatma Deniz
- Poster Session
ISOC Network and Distributed System Security Symposium (NDSS '17) — February, 2017 — San Diego, California, USA (Acceptance: 16.1%)
Towards Implicit Visual Memory-Based Authentication
Claude Castelluccia, Markus Dürmuth, Maximilian Golla, and Fatma Deniz
- Paper Slides Talk Website
ISOC Workshop on Usable Security (USEC '17) — February, 2017 — San Diego, California, USA
EmojiAuth: Quantifying the Security of Emoji-based Authentication
Maximilian Golla, Dennis Detering, and Markus Dürmuth
- Paper Slides
2016
ACM Conference on Computer and Communications Security (CCS '16) — October, 2016 — Vienna, Austria (Acceptance: 16.5%)
On the Security of Cracking-Resistant Password Vaults
Maximilian Golla, Benedict Beuscher, and Markus Dürmuth
- Paper Slides Talk Source Code
2015
International Conference on Passwords (PASSWORDS '15) — December, 2015 — Cambridge, United Kingdom
Analyzing 4 Million Real-World Personal Knowledge Questions
Maximilian Golla and Markus Dürmuth
- Paper Slides Talk

Community Service, Committees, and Reviewing Activities

Last update: October 2021

Reviewer: ACM Conference on Human Factors in Computing Systems (CHI '22)
Reviewer: ACM Transactions on Privacy and Security (TOPS '21)
Reviewer: IEEE Transactions on Information Forensics and Security (TIFS '21)
Program Committee and Poster Chair: 17th Symposium on Usable Privacy and Security (SOUPS '21)
External Reviewer: 42nd IEEE Symposium on Security and Privacy (SP '21)
Reviewer: 16th International Conference on Wirtschaftsinformatik (WI '21)
Reviewer: IEEE Transactions on Emerging Topics in Computing (TETC '20)
Program Chair: 6th Who Are You?! Adventures in Authentication Workshop (WAY '20)
Program Committee and Poster Chair: 16th Symposium on Usable Privacy and Security (SOUPS '20)
Publicity Chair: 5th European Workshop on Usable Security (EuroUSEC '20)
Reviewer: ACM Transactions on Privacy and Security (TOPS '20)
External Reviewer: 29th USENIX Security Symposium (SSYM '20)
Poster Jury: 15th Symposium on Usable Privacy and Security (SOUPS '19)
Program Chair: 5th Who Are You?! Adventures in Authentication Workshop (WAY '19)
Program Committee and Publicity Chair: 4th European Workshop on Usable Security (EuroUSEC '19)
Program Committee: 4th Who Are You?! Adventures in Authentication Workshop (WAY '18)
Reviewer: 39th International Conference on Information Systems (ICIS '18)
Program Committee: 2018 Networked Privacy Workshop at ACM CHI (NPW '18)
External Reviewer: 3rd Who Are You?! Adventures in Authentication Workshop (WAY '17)
External Reviewer: 26th USENIX Security Symposium (SSYM '17)
Reviewer: ACM Transactions on Privacy and Security (TOPS '17)
Reviewer: 11th International Conference on Passwords (PASSWORDS '16)