Cormac Herley

Principal Researcher

Publications

Afficher par:

- Identifying Incoherent Search Sessions: Search Click Fraud Remediation Under Real-World Constraints
  
  Runze Zhang, Ranjita Pai Sridhar, Mingxuan Yao, Zheng Yang, David Oygenblik, Haichuan Xu, Vacha Dave, Cormac Herley, Paul England, Brendan Saltaformaggio
  
  2025 IEEE Symposium on Security and Privacy (SP) | May 2025
  
  PDF DOI
- Can We Count on LLMs? The Fixed-Effect Fallacy and Claims of GPT-4 Capabilities
  
  Thomas Ball, Shuo Chen, Cormac Herley
  
  September 2024
  
  Preprint
- A Large-Scale Measurement of Cybercrime Against Individuals
  
  Casey Breen, Cormac Herley, Elissa M. Redmiles
  
  CHI 2022 | April 2022
  
  Publication
- Pushing on string: the «don’t care» region of password strength
  
  Dinei Florencio, Cormac Herley
  
  Communications ACM | September 2016
  
  Publication
- The Unfalsifiability of Security Claims
  
  Cormac Herley
  
  Proceedings of the 3rd Asian Symposium on Programming Languages and Systems (APLAS '05) | May 2016
  
  Publication
- Passwords and the Evolution of Imperfect Authentication
  
  Joe Bonneau, Cormac Herley, Paul C. van Oorschot, Frank Stajano
  
  Communications of ACM | June 2015
  
  Publication
- An Administrator’s Guide to Internet Password Research
  
  Dinei Florencio, Cormac Herley, Paul C. van Oorschot
  
  Usenix LISA | November 2014
  
  Publication
- Security, Cybercrime and Scale
  
  Cormac Herley
  
  September 2014
  
  Publication
- Telepathwords: Preventing Weak Passwords by Reading Users’ Minds
  
  Saranga Komanduri, Rich Shay, Lorrie Cranor, Cormac Herley, Stuart Schechter
  
  Proceedings of the 23rd USENIX Security Symposium | August 2014
  
  Publication
- Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts
  
  Dinei Florencio, Cormac Herley, Paul C. van Oorschot
  
  Usenix Security | August 2014
  
  Publication
- FUD: A Plea for Intolerance
  
  Dinei Florencio, Cormac Herley, Adam Shostack
  
  Communications ACM | June 2014
  
  Publication
- More is Not the Answer
  
  Cormac Herley
  
  IEEE Security and Privacy magazine | January 2014
  
  Publication
- Breaking our password hash habit: Why the sharing of users’ password choices for defensive analysis is an underprovisioned social good, and what we can do to encourage it.
  
  Cormac Herley, Stuart Schechter
  
  Workshop on the Economics of Information Security | June 2013
  
  Publication
- You Needn’t Build That: Reusable Ethics-Compliance Infrastructure for Human Subjects Research
  
  Cristian Bravo-Lillo, Serge Egelman, Cormac Herley, Stuart Schechter, Janice Tsai
  
  Cyber-security Research Ethics Dialog & Strategy Workshop (CREDS 2013) | May 2013
  
  Publication
- Detecting Malicious Landing Pages in Malware Distribution Networks
  
  Gang Wang, Jack W. Stokes, Cormac Herley, David Felstead
  
  IEEE DSN | January 2013
  
  Publication Projet
- Does My Password Go up to Eleven? The Impact of Password Meters on Password Selection
  
  Serge Egelman, Andreas Sotirakopoulos, Ildar Muslukhov, Konstantin Beznosov, Cormac Herley
  
  Proc. CHI | January 2013
  
  Publication
- Small World: Collisions Among Attackers in a Finite Population
  
  Cormac Herley
  
  WEIS | January 2013
  
  Publication
- When does Targeting make sense for an attacker?
  
  Cormac Herley
  
  IEEE Security and Privacy magazine | January 2013
  
  Publication
- Why Do Nigerian Scammers Say They are From Nigeria?
  
  Cormac Herley
  
  WEIS | June 2012
  
  Publication
- Why Do Nigerian Scammers Say They are From Nigeria?
  
  Cormac Herley
  
  WEIS | June 2012
  
  Publication
- The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
  
  Joseph Bonneau, Cormac Herley, Paul C. van Oorschot, Frank Stajano
  
  IEEE Symp. Security and Privacy | May 2012
  
  Publication
- A Research Agenda Acknowledging the Persistence of Passwords
  
  Cormac Herley, Paul van Oorschot
  
  IEEE Security & Privacy Magazine | January 2012
  
  Publication
- Is Everything We Know About Password Stealing Wrong?
  
  Dinei Florencio, Cormac Herley
  
  IEEE Security and Privacy magazine | January 2012
  
  Publication
- Why do Nigerian Scammers Say They are from Nigeria?
  
  Cormac Herley
  
  WEIS | January 2012
  
  Publication
- Is Everything We Know About Password-Stealing Wrong?
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-132 | December 2011
  
  Publication
- Painless Migration from Passwords to Two Factor Authentication
  
  Ziqing Mao, Dinei Florencio, Cormac Herley
  
  WIFS | November 2011
  
  WIFS
  
  Publication
- A Large-Scale Study of File Prevalance
  
  Jack W. Stokes, Cormac Herley
  
  MSR-TR-2011-131 | November 2011
  
  Publication
- Sex, Lies and Cyber-crime Surveys
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-75 | June 2011
  
  Publication
- Where Do All the Attacks Go?
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-74 | June 2011
  
  Publication
- Popularity is Everything: A new approach to protecting passwords from statistical-guessing attacks
  
  Stuart Schechter, Cormac Herley, Michael Mitzenmacher
  
  The 5th USENIX Workshop on Hot Topics in Security (HotSec '10) | August 2010
  
  This paper scheduled to be made public 12:01AM, July 19.
  
  Publication
- Where Do Security Policies Come From?
  
  Dinei Florencio, Cormac Herley
  
  SOUPS | June 2010
  
  SOUPS Best paper award
  
  Publication
- Phishing and Money Mules
  
  Dinei Florencio, Cormac Herley
  
  WIFS | January 2010
  
  Publication
- The Plight of the Targeted Attacker in a World of Scale
  
  Cormac Herley
  
  WEIS | January 2010
  
  Publication
- Economics and the Underground Economy
  
  Cormac Herley, Dinei Florencio
  
  July 2009
  
  Black Hat
  
  Publication
- Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy
  
  Cormac Herley, Dinei Florencio
  
  MSR-TR-2009-34 | June 2009
  
  Publication
- So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users
  
  Cormac Herley
  
  MSR-TR-2009-46 | April 2009
  
  NSPW
  
  Publication
- Passwords: If We’re So Smart, Why Are We Still Using Them?
  
  Cormac Herley, P.C. van Oorschot, Andrew S. Patrick
  
  Proc. Financial Crypto | January 2009
  
  Publication
- A Robust Link-Translating Proxy Server Mirroring the Whole Web
  
  Ziqing Mao, Cormac Herley
  
  MSR-TR-2008-165 | November 2008
  
  Publication
- A Profitless Endeavor: Phishing as Tragedy of the Commons
  
  Cormac Herley, Dinei Florencio
  
  Proceedings in the New Security Paradigms Workshop | September 2008
  
  Publication
- Can «Something You Know» be Saved?
  
  Baris Coskun, Cormac Herley
  
  Proc. 11th Information Security Conference (ISC 2008) | September 2008
  
  Publication
- One Time Password Access to Any Server without Changing the Server
  
  Dinei Florencio, Cormac Herley
  
  September 2008
  
  Publication
- Protecting Financial Institutions from Brute-Force Attacks
  
  Cormac Herley, Dinei Florencio
  
  MSR-TR-2007-132 | September 2008
  
  Proceedings of the 1999 Haskell Workshop
  
  Publication
- Evaluating a Trial Deployment of Password Re-Use for Phishing Prevention
  
  Dinei Florencio, Cormac Herley
  
  Proc. Anti-phishing Working Group 2nd Annual eCrime Researchers Summit | October 2007
  
  Publication
- Do Strong Web Passwords Accomplish Anything?
  
  Dinei Florencio, Cormac Herley, Baris Coskun
  
  Proc. Second USENIX Workshop on Hot Topics in Security (HotSec '07) | August 2007
  
  Publication
- Do Strong Web Passwords Accomplish Anything?
  
  Dinei Florencio, Cormac Herley, Baris Coskun
  
  MSR-TR-2007-64 | June 2007
  
  Publication Publication
- A Large-Scale Study of Web Password Habits
  
  Dinei Florencio, Cormac Herley
  
  Proceedings of the 16th international conference on the World Wide Web | May 2007
  
  Publication
- KLASSP: Entering Passwords on a Spyware Infected Machine Using a Shared-Secret Proxy
  
  Dinei Florencio, Cormac Herley
  
  December 2006
  
  Publication Publication Publication
- KLASSP: Enterring Passwords from a Spyware Infected Machine
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-74 | December 2006
  
  Publication Publication
- A Large Scale Study of Web Password Habits
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-166 | November 2006
  
  Publication
- How to Login from an Internet Cafe Without Worrying about Keyloggers
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-12 | July 2006
  
  Publication Publication
- Password Rescue: A New Approach to Phishing Prevention
  
  Dinei Florencio, Cormac Herley
  
  July 2006
  
  Publication Publication
- Analyzing and Improving Anti-Phishing Schemes
  
  Dinei Florencio, Cormac Herley
  
  May 2006
  
  Publication Publication
- Analyzing and Improving a BitTorrent Network’s Performance Mechanisms
  
  Ashwin Bharambe, Cormac Herley, Venkata N. Padmanabhan, Venkat Padmanabhan
  
  April 2006
  
  Publication Publication
- ARGOS: Automatically extracting Repeating Objects from multimedia Streams
  
  Cormac Herley
  
  MSR-TR-2004-02 | February 2006
  
  IEEE/ACM Transactions on Networking
  
  Publication Publication
- Accurate Repeat Finding and Object Skipping Using Fingerprints
  
  Cormac Herley
  
  November 2005
  
  Publication Publication
- Inferring Similarity Between Music Objects with Application to Playlist Generation
  
  Robert Ragno, Chris J.C. Burges, Cormac Herley
  
  November 2005
  
  Publication Publication
- Occlusion Removal with Minimum Number of Images
  
  Cormac Herley
  
  October 2005
  
  Publication Publication
- Stopping a Phishing Attack, Even when the Victims Ignore Warnings
  
  Dinei Florencio, Cormac Herley
  
  October 2005
  
  Publication
- Some Observations on BitTorrent Performance
  
  Ashwin Bharambe, Cormac Herley, Venkat Padmanabhan
  
  July 2005
  
  Publication Publication
- Understanding and Deconstructing BitTorrent Performance
  
  Ashwin Bharambe, Cormac Herley, Venkata N. Padmanabhan, Venkat Padmanabhan
  
  MSR-TR-2004-142 | December 2004
  
  Publication
- Detection and Deterrence of Counterfeiting of Valuable Documents
  
  Cormac Herley
  
  October 2004
  
  Publication Publication
- Recursive Method to Detect and Segment Multiple Rectangular Objects in Scanned Images
  
  Cormac Herley
  
  MSR-TR-2004-01 | January 2004
  
  Publication
- Recursive Method to Extract Rectangular Objects from Scans
  
  Cormac Herley
  
  October 2003
  
  Publication Publication
- Why Watermarking is Nonsense
  
  Cormac Herley
  
  September 2002
  
  Publication Publication
- Minimum Rate Sampling and Reconstruction of Signals with Arbitrary Frequency Support
  
  Cormac Herley
  
  July 1999
  
  Publication Publication

- Can We Count on LLMs? The Fixed-Effect Fallacy and Claims of GPT-4 Capabilities
  
  Thomas Ball, Shuo Chen, Cormac Herley
  
  September 2024
  
  Preprint
- Identifying Incoherent Search Sessions: Search Click Fraud Remediation Under Real-World Constraints
  
  Runze Zhang, Ranjita Pai Sridhar, Mingxuan Yao, Zheng Yang, David Oygenblik, Haichuan Xu, Vacha Dave, Cormac Herley, Paul England, Brendan Saltaformaggio
  
  2025 IEEE Symposium on Security and Privacy (SP) | May 2025
  
  PDF DOI
- A Large-Scale Measurement of Cybercrime Against Individuals
  
  Casey Breen, Cormac Herley, Elissa M. Redmiles
  
  CHI 2022 | April 2022
  
  Publication
- Pushing on string: the «don’t care» region of password strength
  
  Dinei Florencio, Cormac Herley
  
  Communications ACM | September 2016
  
  Publication
- The Unfalsifiability of Security Claims
  
  Cormac Herley
  
  Proceedings of the 3rd Asian Symposium on Programming Languages and Systems (APLAS '05) | May 2016
  
  Publication
- Passwords and the Evolution of Imperfect Authentication
  
  Joe Bonneau, Cormac Herley, Paul C. van Oorschot, Frank Stajano
  
  Communications of ACM | June 2015
  
  Publication
- An Administrator’s Guide to Internet Password Research
  
  Dinei Florencio, Cormac Herley, Paul C. van Oorschot
  
  Usenix LISA | November 2014
  
  Publication
- Security, Cybercrime and Scale
  
  Cormac Herley
  
  September 2014
  
  Publication
- Telepathwords: Preventing Weak Passwords by Reading Users’ Minds
  
  Saranga Komanduri, Rich Shay, Lorrie Cranor, Cormac Herley, Stuart Schechter
  
  Proceedings of the 23rd USENIX Security Symposium | August 2014
  
  Publication
- Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts
  
  Dinei Florencio, Cormac Herley, Paul C. van Oorschot
  
  Usenix Security | August 2014
  
  Publication
- FUD: A Plea for Intolerance
  
  Dinei Florencio, Cormac Herley, Adam Shostack
  
  Communications ACM | June 2014
  
  Publication
- More is Not the Answer
  
  Cormac Herley
  
  IEEE Security and Privacy magazine | January 2014
  
  Publication
- Breaking our password hash habit: Why the sharing of users’ password choices for defensive analysis is an underprovisioned social good, and what we can do to encourage it.
  
  Cormac Herley, Stuart Schechter
  
  Workshop on the Economics of Information Security | June 2013
  
  Publication
- You Needn’t Build That: Reusable Ethics-Compliance Infrastructure for Human Subjects Research
  
  Cristian Bravo-Lillo, Serge Egelman, Cormac Herley, Stuart Schechter, Janice Tsai
  
  Cyber-security Research Ethics Dialog & Strategy Workshop (CREDS 2013) | May 2013
  
  Publication
- Small World: Collisions Among Attackers in a Finite Population
  
  Cormac Herley
  
  WEIS | January 2013
  
  Publication
- Does My Password Go up to Eleven? The Impact of Password Meters on Password Selection
  
  Serge Egelman, Andreas Sotirakopoulos, Ildar Muslukhov, Konstantin Beznosov, Cormac Herley
  
  Proc. CHI | January 2013
  
  Publication
- Why Do Nigerian Scammers Say They are From Nigeria?
  
  Cormac Herley
  
  WEIS | June 2012
  
  Publication
- A Research Agenda Acknowledging the Persistence of Passwords
  
  Cormac Herley, Paul van Oorschot
  
  IEEE Security & Privacy Magazine | January 2012
  
  Publication
- Painless Migration from Passwords to Two Factor Authentication
  
  Ziqing Mao, Dinei Florencio, Cormac Herley
  
  WIFS | November 2011
  
  WIFS
  
  Publication
- Economics and the Underground Economy
  
  Cormac Herley, Dinei Florencio
  
  July 2009
  
  Black Hat
  
  Publication
- So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users
  
  Cormac Herley
  
  MSR-TR-2009-46 | April 2009
  
  NSPW
  
  Publication
- Passwords: If We’re So Smart, Why Are We Still Using Them?
  
  Cormac Herley, P.C. van Oorschot, Andrew S. Patrick
  
  Proc. Financial Crypto | January 2009
  
  Publication
- Protecting Financial Institutions from Brute-Force Attacks
  
  Cormac Herley, Dinei Florencio
  
  MSR-TR-2007-132 | September 2008
  
  Proceedings of the 1999 Haskell Workshop
  
  Publication
- A Profitless Endeavor: Phishing as Tragedy of the Commons
  
  Cormac Herley, Dinei Florencio
  
  Proceedings in the New Security Paradigms Workshop | September 2008
  
  Publication
- Can «Something You Know» be Saved?
  
  Baris Coskun, Cormac Herley
  
  Proc. 11th Information Security Conference (ISC 2008) | September 2008
  
  Publication
- Evaluating a Trial Deployment of Password Re-Use for Phishing Prevention
  
  Dinei Florencio, Cormac Herley
  
  Proc. Anti-phishing Working Group 2nd Annual eCrime Researchers Summit | October 2007
  
  Publication
- Do Strong Web Passwords Accomplish Anything?
  
  Dinei Florencio, Cormac Herley, Baris Coskun
  
  Proc. Second USENIX Workshop on Hot Topics in Security (HotSec '07) | August 2007
  
  Publication
- Do Strong Web Passwords Accomplish Anything?
  
  Dinei Florencio, Cormac Herley, Baris Coskun
  
  MSR-TR-2007-64 | June 2007
  
  Publication Publication
- A Large-Scale Study of Web Password Habits
  
  Dinei Florencio, Cormac Herley
  
  Proceedings of the 16th international conference on the World Wide Web | May 2007
  
  Publication
- KLASSP: Enterring Passwords from a Spyware Infected Machine
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-74 | December 2006
  
  Publication Publication
- KLASSP: Entering Passwords on a Spyware Infected Machine Using a Shared-Secret Proxy
  
  Dinei Florencio, Cormac Herley
  
  December 2006
  
  Publication Publication Publication
- A Large Scale Study of Web Password Habits
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-166 | November 2006
  
  Publication
- Password Rescue: A New Approach to Phishing Prevention
  
  Dinei Florencio, Cormac Herley
  
  July 2006
  
  Publication Publication
- How to Login from an Internet Cafe Without Worrying about Keyloggers
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-12 | July 2006
  
  Publication Publication
- Analyzing and Improving Anti-Phishing Schemes
  
  Dinei Florencio, Cormac Herley
  
  May 2006
  
  Publication Publication
- Detection and Deterrence of Counterfeiting of Valuable Documents
  
  Cormac Herley
  
  October 2004
  
  Publication Publication
- Telepathwords: Preventing Weak Passwords by Reading Users’ Minds
  
  Saranga Komanduri, Rich Shay, Lorrie Cranor, Cormac Herley, Stuart Schechter
  
  Proceedings of the 23rd USENIX Security Symposium | August 2014
  
  Publication
- Sex, Lies and Cyber-crime Surveys
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-75 | June 2011
  
  Publication
- Inferring Similarity Between Music Objects with Application to Playlist Generation
  
  Robert Ragno, Chris J.C. Burges, Cormac Herley
  
  November 2005
  
  Publication Publication
- Minimum Rate Sampling and Reconstruction of Signals with Arbitrary Frequency Support
  
  Cormac Herley
  
  July 1999
  
  Publication Publication
- Breaking our password hash habit: Why the sharing of users’ password choices for defensive analysis is an underprovisioned social good, and what we can do to encourage it.
  
  Cormac Herley, Stuart Schechter
  
  Workshop on the Economics of Information Security | June 2013
  
  Publication
- Small World: Collisions Among Attackers in a Finite Population
  
  Cormac Herley
  
  WEIS | January 2013
  
  Publication
- Detecting Malicious Landing Pages in Malware Distribution Networks
  
  Gang Wang, Jack W. Stokes, Cormac Herley, David Felstead
  
  IEEE DSN | January 2013
  
  Publication Projet
- Popularity is Everything: A new approach to protecting passwords from statistical-guessing attacks
  
  Stuart Schechter, Cormac Herley, Michael Mitzenmacher
  
  The 5th USENIX Workshop on Hot Topics in Security (HotSec '10) | August 2010
  
  This paper scheduled to be made public 12:01AM, July 19.
  
  Publication
- A Robust Link-Translating Proxy Server Mirroring the Whole Web
  
  Ziqing Mao, Cormac Herley
  
  MSR-TR-2008-165 | November 2008
  
  Publication
- Analyzing and Improving a BitTorrent Network’s Performance Mechanisms
  
  Ashwin Bharambe, Cormac Herley, Venkata N. Padmanabhan, Venkat Padmanabhan
  
  April 2006
  
  Publication Publication
- Some Observations on BitTorrent Performance
  
  Ashwin Bharambe, Cormac Herley, Venkat Padmanabhan
  
  July 2005
  
  Publication Publication
- Understanding and Deconstructing BitTorrent Performance
  
  Ashwin Bharambe, Cormac Herley, Venkata N. Padmanabhan, Venkat Padmanabhan
  
  MSR-TR-2004-142 | December 2004
  
  Publication
- When does Targeting make sense for an attacker?
  
  Cormac Herley
  
  IEEE Security and Privacy magazine | January 2013
  
  Publication
- Why Do Nigerian Scammers Say They are From Nigeria?
  
  Cormac Herley
  
  WEIS | June 2012
  
  Publication
- The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
  
  Joseph Bonneau, Cormac Herley, Paul C. van Oorschot, Frank Stajano
  
  IEEE Symp. Security and Privacy | May 2012
  
  Publication
- Why do Nigerian Scammers Say They are from Nigeria?
  
  Cormac Herley
  
  WEIS | January 2012
  
  Publication
- Where Do All the Attacks Go?
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-74 | June 2011
  
  Publication
- Where Do Security Policies Come From?
  
  Dinei Florencio, Cormac Herley
  
  SOUPS | June 2010
  
  SOUPS Best paper award
  
  Publication
- The Plight of the Targeted Attacker in a World of Scale
  
  Cormac Herley
  
  WEIS | January 2010
  
  Publication
- One Time Password Access to Any Server without Changing the Server
  
  Dinei Florencio, Cormac Herley
  
  September 2008
  
  Publication
- Is Everything We Know About Password Stealing Wrong?
  
  Dinei Florencio, Cormac Herley
  
  IEEE Security and Privacy magazine | January 2012
  
  Publication
- Is Everything We Know About Password-Stealing Wrong?
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-132 | December 2011
  
  Publication
- Phishing and Money Mules
  
  Dinei Florencio, Cormac Herley
  
  WIFS | January 2010
  
  Publication
- ARGOS: Automatically extracting Repeating Objects from multimedia Streams
  
  Cormac Herley
  
  MSR-TR-2004-02 | February 2006
  
  IEEE/ACM Transactions on Networking
  
  Publication Publication
- Occlusion Removal with Minimum Number of Images
  
  Cormac Herley
  
  October 2005
  
  Publication Publication
- Recursive Method to Detect and Segment Multiple Rectangular Objects in Scanned Images
  
  Cormac Herley
  
  MSR-TR-2004-01 | January 2004
  
  Publication
- Recursive Method to Extract Rectangular Objects from Scans
  
  Cormac Herley
  
  October 2003
  
  Publication Publication
- A Large-Scale Study of File Prevalance
  
  Jack W. Stokes, Cormac Herley
  
  MSR-TR-2011-131 | November 2011
  
  Publication
- Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy
  
  Cormac Herley, Dinei Florencio
  
  MSR-TR-2009-34 | June 2009
  
  Publication
- A Profitless Endeavor: Phishing as Tragedy of the Commons
  
  Cormac Herley, Dinei Florencio
  
  Proceedings in the New Security Paradigms Workshop | September 2008
  
  Publication
- A Robust Link-Translating Proxy Server Mirroring the Whole Web
  
  Ziqing Mao, Cormac Herley
  
  MSR-TR-2008-165 | November 2008
  
  Publication
- Accurate Repeat Finding and Object Skipping Using Fingerprints
  
  Cormac Herley
  
  November 2005
  
  Publication Publication
- Stopping a Phishing Attack, Even when the Victims Ignore Warnings
  
  Dinei Florencio, Cormac Herley
  
  October 2005
  
  Publication
- Why Watermarking is Nonsense
  
  Cormac Herley
  
  September 2002
  
  Publication Publication
- Accurate Repeat Finding and Object Skipping Using Fingerprints
  
  Cormac Herley
  
  November 2005
  
  Publication Publication

- Can We Count on LLMs? The Fixed-Effect Fallacy and Claims of GPT-4 Capabilities
  
  Thomas Ball, Shuo Chen, Cormac Herley
  
  September 2024
  
  Preprint
- Economics and the Underground Economy
  
  Cormac Herley, Dinei Florencio
  
  July 2009
  
  Black Hat
  
  Publication
- Minimum Rate Sampling and Reconstruction of Signals with Arbitrary Frequency Support
  
  Cormac Herley
  
  July 1999
  
  Publication Publication
- Identifying Incoherent Search Sessions: Search Click Fraud Remediation Under Real-World Constraints
  
  Runze Zhang, Ranjita Pai Sridhar, Mingxuan Yao, Zheng Yang, David Oygenblik, Haichuan Xu, Vacha Dave, Cormac Herley, Paul England, Brendan Saltaformaggio
  
  2025 IEEE Symposium on Security and Privacy (SP) | May 2025
  
  PDF DOI
- A Large-Scale Measurement of Cybercrime Against Individuals
  
  Casey Breen, Cormac Herley, Elissa M. Redmiles
  
  CHI 2022 | April 2022
  
  Publication
- The Unfalsifiability of Security Claims
  
  Cormac Herley
  
  Proceedings of the 3rd Asian Symposium on Programming Languages and Systems (APLAS '05) | May 2016
  
  Publication
- Security, Cybercrime and Scale
  
  Cormac Herley
  
  September 2014
  
  Publication
- Telepathwords: Preventing Weak Passwords by Reading Users’ Minds
  
  Saranga Komanduri, Rich Shay, Lorrie Cranor, Cormac Herley, Stuart Schechter
  
  Proceedings of the 23rd USENIX Security Symposium | August 2014
  
  Publication
- Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts
  
  Dinei Florencio, Cormac Herley, Paul C. van Oorschot
  
  Usenix Security | August 2014
  
  Publication
- Breaking our password hash habit: Why the sharing of users’ password choices for defensive analysis is an underprovisioned social good, and what we can do to encourage it.
  
  Cormac Herley, Stuart Schechter
  
  Workshop on the Economics of Information Security | June 2013
  
  Publication
- You Needn’t Build That: Reusable Ethics-Compliance Infrastructure for Human Subjects Research
  
  Cristian Bravo-Lillo, Serge Egelman, Cormac Herley, Stuart Schechter, Janice Tsai
  
  Cyber-security Research Ethics Dialog & Strategy Workshop (CREDS 2013) | May 2013
  
  Publication
- Does My Password Go up to Eleven? The Impact of Password Meters on Password Selection
  
  Serge Egelman, Andreas Sotirakopoulos, Ildar Muslukhov, Konstantin Beznosov, Cormac Herley
  
  Proc. CHI | January 2013
  
  Publication
- Detecting Malicious Landing Pages in Malware Distribution Networks
  
  Gang Wang, Jack W. Stokes, Cormac Herley, David Felstead
  
  IEEE DSN | January 2013
  
  Publication Projet
- Why Do Nigerian Scammers Say They are From Nigeria?
  
  Cormac Herley
  
  WEIS | June 2012
  
  Publication
- The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes
  
  Joseph Bonneau, Cormac Herley, Paul C. van Oorschot, Frank Stajano
  
  IEEE Symp. Security and Privacy | May 2012
  
  Publication
- Why do Nigerian Scammers Say They are from Nigeria?
  
  Cormac Herley
  
  WEIS | January 2012
  
  Publication
- Painless Migration from Passwords to Two Factor Authentication
  
  Ziqing Mao, Dinei Florencio, Cormac Herley
  
  WIFS | November 2011
  
  WIFS
  
  Publication
- Popularity is Everything: A new approach to protecting passwords from statistical-guessing attacks
  
  Stuart Schechter, Cormac Herley, Michael Mitzenmacher
  
  The 5th USENIX Workshop on Hot Topics in Security (HotSec '10) | August 2010
  
  This paper scheduled to be made public 12:01AM, July 19.
  
  Publication
- Where Do Security Policies Come From?
  
  Dinei Florencio, Cormac Herley
  
  SOUPS | June 2010
  
  SOUPS Best paper award
  
  Publication
- Phishing and Money Mules
  
  Dinei Florencio, Cormac Herley
  
  WIFS | January 2010
  
  Publication
- The Plight of the Targeted Attacker in a World of Scale
  
  Cormac Herley
  
  WEIS | January 2010
  
  Publication
- A Profitless Endeavor: Phishing as Tragedy of the Commons
  
  Cormac Herley, Dinei Florencio
  
  Proceedings in the New Security Paradigms Workshop | September 2008
  
  Publication
- Can «Something You Know» be Saved?
  
  Baris Coskun, Cormac Herley
  
  Proc. 11th Information Security Conference (ISC 2008) | September 2008
  
  Publication
- One Time Password Access to Any Server without Changing the Server
  
  Dinei Florencio, Cormac Herley
  
  September 2008
  
  Publication
- Evaluating a Trial Deployment of Password Re-Use for Phishing Prevention
  
  Dinei Florencio, Cormac Herley
  
  Proc. Anti-phishing Working Group 2nd Annual eCrime Researchers Summit | October 2007
  
  Publication
- Do Strong Web Passwords Accomplish Anything?
  
  Dinei Florencio, Cormac Herley, Baris Coskun
  
  Proc. Second USENIX Workshop on Hot Topics in Security (HotSec '07) | August 2007
  
  Publication
- A Large-Scale Study of Web Password Habits
  
  Dinei Florencio, Cormac Herley
  
  Proceedings of the 16th international conference on the World Wide Web | May 2007
  
  Publication
- KLASSP: Entering Passwords on a Spyware Infected Machine Using a Shared-Secret Proxy
  
  Dinei Florencio, Cormac Herley
  
  December 2006
  
  Publication Publication Publication
- Password Rescue: A New Approach to Phishing Prevention
  
  Dinei Florencio, Cormac Herley
  
  July 2006
  
  Publication Publication
- Analyzing and Improving Anti-Phishing Schemes
  
  Dinei Florencio, Cormac Herley
  
  May 2006
  
  Publication Publication
- Analyzing and Improving a BitTorrent Network’s Performance Mechanisms
  
  Ashwin Bharambe, Cormac Herley, Venkata N. Padmanabhan, Venkat Padmanabhan
  
  April 2006
  
  Publication Publication
- Accurate Repeat Finding and Object Skipping Using Fingerprints
  
  Cormac Herley
  
  November 2005
  
  Publication Publication
- Inferring Similarity Between Music Objects with Application to Playlist Generation
  
  Robert Ragno, Chris J.C. Burges, Cormac Herley
  
  November 2005
  
  Publication Publication
- Occlusion Removal with Minimum Number of Images
  
  Cormac Herley
  
  October 2005
  
  Publication Publication
- Stopping a Phishing Attack, Even when the Victims Ignore Warnings
  
  Dinei Florencio, Cormac Herley
  
  October 2005
  
  Publication
- Some Observations on BitTorrent Performance
  
  Ashwin Bharambe, Cormac Herley, Venkat Padmanabhan
  
  July 2005
  
  Publication Publication
- Detection and Deterrence of Counterfeiting of Valuable Documents
  
  Cormac Herley
  
  October 2004
  
  Publication Publication
- Recursive Method to Extract Rectangular Objects from Scans
  
  Cormac Herley
  
  October 2003
  
  Publication Publication
- Why Watermarking is Nonsense
  
  Cormac Herley
  
  September 2002
  
  Publication Publication
- Pushing on string: the «don’t care» region of password strength
  
  Dinei Florencio, Cormac Herley
  
  Communications ACM | September 2016
  
  Publication
- Passwords and the Evolution of Imperfect Authentication
  
  Joe Bonneau, Cormac Herley, Paul C. van Oorschot, Frank Stajano
  
  Communications of ACM | June 2015
  
  Publication
- An Administrator’s Guide to Internet Password Research
  
  Dinei Florencio, Cormac Herley, Paul C. van Oorschot
  
  Usenix LISA | November 2014
  
  Publication
- FUD: A Plea for Intolerance
  
  Dinei Florencio, Cormac Herley, Adam Shostack
  
  Communications ACM | June 2014
  
  Publication
- More is Not the Answer
  
  Cormac Herley
  
  IEEE Security and Privacy magazine | January 2014
  
  Publication
- Small World: Collisions Among Attackers in a Finite Population
  
  Cormac Herley
  
  WEIS | January 2013
  
  Publication
- When does Targeting make sense for an attacker?
  
  Cormac Herley
  
  IEEE Security and Privacy magazine | January 2013
  
  Publication
- Why Do Nigerian Scammers Say They are From Nigeria?
  
  Cormac Herley
  
  WEIS | June 2012
  
  Publication
- Is Everything We Know About Password Stealing Wrong?
  
  Dinei Florencio, Cormac Herley
  
  IEEE Security and Privacy magazine | January 2012
  
  Publication
- A Research Agenda Acknowledging the Persistence of Passwords
  
  Cormac Herley, Paul van Oorschot
  
  IEEE Security & Privacy Magazine | January 2012
  
  Publication
- Passwords: If We’re So Smart, Why Are We Still Using Them?
  
  Cormac Herley, P.C. van Oorschot, Andrew S. Patrick
  
  Proc. Financial Crypto | January 2009
  
  Publication
- Is Everything We Know About Password-Stealing Wrong?
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-132 | December 2011
  
  Publication
- A Large-Scale Study of File Prevalance
  
  Jack W. Stokes, Cormac Herley
  
  MSR-TR-2011-131 | November 2011
  
  Publication
- Sex, Lies and Cyber-crime Surveys
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-75 | June 2011
  
  Publication
- Where Do All the Attacks Go?
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2011-74 | June 2011
  
  Publication
- Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy
  
  Cormac Herley, Dinei Florencio
  
  MSR-TR-2009-34 | June 2009
  
  Publication
- So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users
  
  Cormac Herley
  
  MSR-TR-2009-46 | April 2009
  
  NSPW
  
  Publication
- A Robust Link-Translating Proxy Server Mirroring the Whole Web
  
  Ziqing Mao, Cormac Herley
  
  MSR-TR-2008-165 | November 2008
  
  Publication
- Protecting Financial Institutions from Brute-Force Attacks
  
  Cormac Herley, Dinei Florencio
  
  MSR-TR-2007-132 | September 2008
  
  Proceedings of the 1999 Haskell Workshop
  
  Publication
- Do Strong Web Passwords Accomplish Anything?
  
  Dinei Florencio, Cormac Herley, Baris Coskun
  
  MSR-TR-2007-64 | June 2007
  
  Publication Publication
- KLASSP: Enterring Passwords from a Spyware Infected Machine
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-74 | December 2006
  
  Publication Publication
- A Large Scale Study of Web Password Habits
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-166 | November 2006
  
  Publication
- How to Login from an Internet Cafe Without Worrying about Keyloggers
  
  Dinei Florencio, Cormac Herley
  
  MSR-TR-2006-12 | July 2006
  
  Publication Publication
- ARGOS: Automatically extracting Repeating Objects from multimedia Streams
  
  Cormac Herley
  
  MSR-TR-2004-02 | February 2006
  
  IEEE/ACM Transactions on Networking
  
  Publication Publication
- Understanding and Deconstructing BitTorrent Performance
  
  Ashwin Bharambe, Cormac Herley, Venkata N. Padmanabhan, Venkat Padmanabhan
  
  MSR-TR-2004-142 | December 2004
  
  Publication
- Recursive Method to Detect and Segment Multiple Rectangular Objects in Scanned Images
  
  Cormac Herley
  
  MSR-TR-2004-01 | January 2004
  
  Publication

Cormac Herley

Publications

Identifying Incoherent Search Sessions: Search Click Fraud Remediation Under Real-World Constraints

Can We Count on LLMs? The Fixed-Effect Fallacy and Claims of GPT-4 Capabilities

A Large-Scale Measurement of Cybercrime Against Individuals

Pushing on string: the «don’t care» region of password strength

The Unfalsifiability of Security Claims

Passwords and the Evolution of Imperfect Authentication

An Administrator’s Guide to Internet Password Research

Security, Cybercrime and Scale

Telepathwords: Preventing Weak Passwords by Reading Users’ Minds

Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts

FUD: A Plea for Intolerance

More is Not the Answer

Breaking our password hash habit: Why the sharing of users’ password choices for defensive analysis is an underprovisioned social good, and what we can do to encourage it.

You Needn’t Build That: Reusable Ethics-Compliance Infrastructure for Human Subjects Research

Detecting Malicious Landing Pages in Malware Distribution Networks

Does My Password Go up to Eleven? The Impact of Password Meters on Password Selection

Small World: Collisions Among Attackers in a Finite Population

When does Targeting make sense for an attacker?

Why Do Nigerian Scammers Say They are From Nigeria?

Why Do Nigerian Scammers Say They are From Nigeria?

The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes

A Research Agenda Acknowledging the Persistence of Passwords

Is Everything We Know About Password Stealing Wrong?

Why do Nigerian Scammers Say They are from Nigeria?

Is Everything We Know About Password-Stealing Wrong?

Painless Migration from Passwords to Two Factor Authentication

A Large-Scale Study of File Prevalance

Sex, Lies and Cyber-crime Surveys

Where Do All the Attacks Go?

Popularity is Everything: A new approach to protecting passwords from statistical-guessing attacks

Where Do Security Policies Come From?

Phishing and Money Mules

The Plight of the Targeted Attacker in a World of Scale

Economics and the Underground Economy

Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy

So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users

Passwords: If We’re So Smart, Why Are We Still Using Them?

A Robust Link-Translating Proxy Server Mirroring the Whole Web

A Profitless Endeavor: Phishing as Tragedy of the Commons

Can «Something You Know» be Saved?

One Time Password Access to Any Server without Changing the Server

Protecting Financial Institutions from Brute-Force Attacks

Evaluating a Trial Deployment of Password Re-Use for Phishing Prevention

Do Strong Web Passwords Accomplish Anything?

Do Strong Web Passwords Accomplish Anything?

A Large-Scale Study of Web Password Habits

KLASSP: Entering Passwords on a Spyware Infected Machine Using a Shared-Secret Proxy

KLASSP: Enterring Passwords from a Spyware Infected Machine

A Large Scale Study of Web Password Habits

How to Login from an Internet Cafe Without Worrying about Keyloggers

Password Rescue: A New Approach to Phishing Prevention

Analyzing and Improving Anti-Phishing Schemes

Analyzing and Improving a BitTorrent Network’s Performance Mechanisms

ARGOS: Automatically extracting Repeating Objects from multimedia Streams

Accurate Repeat Finding and Object Skipping Using Fingerprints

Inferring Similarity Between Music Objects with Application to Playlist Generation

Occlusion Removal with Minimum Number of Images

Stopping a Phishing Attack, Even when the Victims Ignore Warnings

Some Observations on BitTorrent Performance

Understanding and Deconstructing BitTorrent Performance

Detection and Deterrence of Counterfeiting of Valuable Documents

Recursive Method to Detect and Segment Multiple Rectangular Objects in Scanned Images

Recursive Method to Extract Rectangular Objects from Scans

Why Watermarking is Nonsense

Minimum Rate Sampling and Reconstruction of Signals with Arbitrary Frequency Support

Can We Count on LLMs? The Fixed-Effect Fallacy and Claims of GPT-4 Capabilities

Identifying Incoherent Search Sessions: Search Click Fraud Remediation Under Real-World Constraints

A Large-Scale Measurement of Cybercrime Against Individuals

Pushing on string: the «don’t care» region of password strength

The Unfalsifiability of Security Claims

Passwords and the Evolution of Imperfect Authentication

An Administrator’s Guide to Internet Password Research

Security, Cybercrime and Scale

Telepathwords: Preventing Weak Passwords by Reading Users’ Minds

Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts

FUD: A Plea for Intolerance

More is Not the Answer

Breaking our password hash habit: Why the sharing of users’ password choices for defensive analysis is an underprovisioned social good, and what we can do to encourage it.