• ---

• About

• ---

Prerequisites:

Many key concepts in computer security arise in user authentication, from cryptography, over usability, to Web standardization processes. This seminar aims at master's students in Computer Science or related fields, as it requires an understanding of the full stack of how cybersecurity is built in real systems.

Learning Objectives:

Students will gain a deep understanding of passwordless authentication schemes, enabling them to reason about their  usability,  deployability, and  security properties.

Seminar Content:

Starting with how passwords are used, why they are not secure, and how to reinforce them, the seminar will shed light on secure, usable alternatives to passwords on the Web. We will review research papers that study usability issues, misconceptions, security guarantees, or report on real-world deployments of passwordless authentication solutions like passkeys, hardware security keys, and legacy solutions like social logins or magic links. Students will read various recent scientific publications on passwordless user authentication solutions and write & review a seminar paper . During a hands-on experience, students are asked to present one passwordless authentication system, reason about its usability benefits, and explain how this authentication system might fail in practice.

Special Notes:

The seminar can host up to 12 students. The seminar will be hybrid with Zoom meetings and in-person presentations. Students are expected to write a 4-6 pages seminar paper (~4000 words), review a seminar paper (~500 words), and co-present their topic in front of class in a 20-minutes presentation.

Recommended Reading:

Papers will be shared via Stud.IP.

• ---

• Seminar Schedule

• ---

• ---

• Seminar Paper

• ---

Task:

Based on the provided and additional literature, the student is expected to provide an overview of the topic in regards to its potential security and usability benefits and problems. The seminar paper should explain how the topic effectively integrates usability or human factors with security or privacy, and clearly indicate the innovative aspects or lessons learned and cite relevant related work.

Formatting:

Papers must use the formatting template and be submitted as a PDF via HotCRP (a conference paper submission system). Submissions must be 4-6 pages (excluding bibliography, and appendices, double column, ~4000 words). All submissions must clearly relate to the human aspects of security or privacy. Your paper should be gender neutral, inclusive, and respectful. A variety of guidance exists on this topic.

Topics:

Some recommended related literature can be found on Stud.IP.

Additional Resources:

• FIDO Promises a Life Without Passwords - By Jeff Crume (IBM Technology)
• Passwords vs. Passkeys - FIDO Bites Back! - By Jeff Crume (IBM Technology)
• Passkeys 101 by Tim Cappalli (Microsoft)
• From Magic Links to Passkeys: The Future of Passwordless Authentication on the Web - By Maximilian Golla (MPI-SP)
• Mitigating Users Misconceptions about FIDO2 Biometrics - By Leona Lassak (Ruhr University Bochum)
• Why Aren't We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication - By Leona Lassak (Ruhr University Bochum)

• ---

• Review

• ---

Students are expected to read and review (~500 words) one seminar paper. The reviewing details are provided during the in-person meeting. I like to emphasize the importance of kind and constructive reviews.

Here are 3 easy steps to improve your review:

1. Start with thanking the authors and mentioning something positive.

   "Thank you for your work on improving ... I appreciate the effort to ..."

2. Be kind and constructive and describe a path forward.

   "I suggest clarifying the high-level idea of the approach by adding a paragraph at the beginning of Section 3."

3. Do not refer to the authors directly in your review, but direct comments toward the seminar paper. We are reviewing the paper, not the authors.

   "The paper should more precisely explain how ..."

Reviewers are responsible for all text they submit as part of their review. As such, you should ensure your reviews are accurate and constructive. All seminar papers are considered confidential and should not be publicly discussed or shared.

• ---

• Talk (Co-Presented)

• ---

Presenters:

As a hands-on experience, students are asked to demonstrate their authentication scheme and co-present their topic in front of the class (about 15 minutes incl. demo). The idea of this presentation is to provide an overview of the topic and reason about potential usability issues and benefits of the presented authentication scheme.

Here are two easy steps to improve your talk:

1. Outline your talk without PowerPoint. What is a good motivation? What is the most important result? What is the main takeaway at the end?
2. Practice! Please rehearse your talk multiple times. There is nothing more distressing than a presenter who is surprised by their own slides.

Audience:

Members of the audience are expected to actively contribute to a discussion by asking questions and engaging with the topic.

Talk Schedule:

• ---

• Time and Location

• ---

Date:

The seminar will take place on Thursdays, starting April 9, 2026.

Time:

10.00 - 12.00 (c.t.).

Location:

• Online via Zoom (Link can be found in Stud.IP).
• All presentations will happen in-person in Building 1101 (Main Building), Room H121, Welfengarten 1, 30167 Hannover.