Florentin Putz, M.Sc.

Deployable and Usable Security / Acoustic Communication / Researcher

Contact Information

Pankratiusstraße 2
D-64289 Darmstadt
S2|20 203
fputz@seemoo.tu-darmstadt.de
+49 6151 16-25475
+49 6151 16-25471
Homepage

Biography

Florentin Putz is a researcher at the Secure Mobile Networking Lab. His research focuses on deployable and usable security for smartphones and the Internet of Things. He currently explores innovative physical layers for device pairing based on acoustic communication. He received his B.Sc. (2016) and M.Sc. (2019) degrees from Technical University of Darmstadt, Germany. During his master's studies, he was a visiting graduate student at the University of British Columbia, Canada.

Research Interests

Strong Authentication, Trust Establishment
Usable Security
Device Bootstrapping, Provisioning, Pairing
Acoustic Communication

Teaching

(2020 – 2023) Coordination and teaching assistant of course Physical Layer Security in Wireless Systems
Selected seminar topics in (Advanced) Seminar on Networking, Security, Mobility, and Wireless Communications
Selected lab topics in Secure Mobile Networking Lab/Project

Awards

Best Paper Award at CSCW 2024 (for our paper on PairSonic)
Best Paper Award at CHI 2023 (for our paper on FIDO2 usability)
emergenCITY Collaboration Award 2023 (for our paper on FIDO2 usability)
KuVS Award 2020 (nationwide award for the best Master's thesis in Germany on communication and distributed systems)
Datenlotsen Award 2020 (for one of the best Master's theses in STEM at TU Darmstadt
Best Student Award 2020 (for the best Master's degree at TU Darmstadt's electrical engineering department)

Offered Theses Topics

Type

Year

No results match your search criteria.

2024 In progress

Secure Acoustic Communication for Smartphone Authentication

Supervisor: Florentin Putz

...

2024 In progress

Usable Authentication for End-to-End Encrypted Messengers

Supervisor: Florentin Putz

...

2023 Completed (May 2024)

Deployable Crisis Communication with Smartphones by Combining Acoustic and Radio Communication

Supervisor: Florentin Putz Bastian Bloessl

...

2024 Completed

Acoustic Communication: Ubiquitous ad-hoc communication?

Supervisor: Florentin Putz

I offer challenging topics on all aspects of the acoustic physical layer, which allows smartphones to use their integrated audio hardware for wireless communication, similar to radio communication. The main use case is short-range communication, e.g., for pairing. The advantage: We can implement custom physical layers without expensive SDRs. Contact me if you have any research ideas on this topic. Strong experience with signal processing is required.

2023 Completed (January 2024)

Design and Evalution of Infrastructureless Emergency Communication

Supervisor: Bastian Bloessl Florentin Putz

...

2023 Completed

Power Characterization of Acoustic Communication and Other Wireless Ad-Hoc Communication Technologies for Smartphones and the Internet of Things

Supervisor: Florentin Putz

...

2023 Completed

Measuring Acoustic Communication Schemes

Supervisor: Florentin Putz

...

2022 In progress

Exploring a Digital Intermediary for Smart Home Privacy Communications

Supervisor: Matthias Gazzari Florentin Putz

...

2022 Completed

Enterprise Authentication Systems

Supervisor: Florentin Putz

Enterprise Authentication Systems

2022 Completed

Smartphone Pairing Schemes

Supervisor: Florentin Putz

...

2021 Completed (July 2022)

Impact of Multi-Path Effects on Acoustic Keylogging Systems

Supervisor: Matthias Gazzari Florentin Putz

...

2022 Completed

Implementation and Evaluation of Short-Range Aerial Acoustic Communication Systems for Smartphones

Supervisor: Florentin Putz

...

2022 Completed

Channel Characterization for Aerial Acoustic Communication Systems

Supervisor: Florentin Putz

...

2021 Completed

FIDO2 Platform Authenticators

Supervisor: Florentin Putz

...

2021 Completed

Evaluation of Acoustic Communication Schemes

Supervisor: Florentin Putz

...

2021 Completed

Evaluation of Ultra-Wideband for Secure Device Pairing

Supervisor: Alexander Heinrich Florentin Putz

Evaluation of Ultra-Wideband for Secure Device Pairing

2021 Completed

Analyzing the Deployment of Device-Specific Android Security Features

Supervisor: Florentin Putz

Analyzing the Deployment of Device-Specific Android Security Features

2021 Completed

Investigating the Pitfalls of FIDO2 Usability in Practice

Supervisor: Florentin Putz

Publications

Type

Year

Show awards only

No results match your search criteria.

2024 27th ACM Conference on Computer-Supported Cooperative Work and Social Computing (CSCW 2024) Conference

PairSonic: Helping Groups Securely Exchange Contact Information

Florentin Putz Steffen Haesler Thomas Völkl Maximilian Gehring Nils Rollshausen Matthias Hollick

PDF BibTeX DOI: 10.1145/3678884.3681818

Abstract

Securely exchanging contact information is essential for establishing trustworthy communication channels that facilitate effective online collaboration. However, current methods are neither user-friendly nor scalable for large groups of users. In response, we introduce PairSonic, a novel group pairing protocol that extends trust from physical encounters to online communication. PairSonic simplifies the pairing process by automating the tedious verification tasks of previous methods through an acoustic out-of-band channel using smartphones' built-in hardware. Our protocol not only facilitates connecting users for computer-supported collaboration, but also provides a more user-friendly and scalable solution to the authentication ceremonies currently used in end-to-end encrypted messengers like Signal or WhatsApp. PairSonic is available as open-source software: https://github.com/seemoo-lab/pairsonic

2024 Proceedings of the ACM on Human-Computer Interaction Article

Sounds Good? Fast and Secure Contact Exchange in Groups

Florentin Putz Steffen Haesler Matthias Hollick

PDF BibTeX DOI: 10.1145/3686964

Abstract

Trustworthy digital communication requires the secure exchange of contact information, but current approaches lack usability and scalability for larger groups of users. We evaluate the usability of two secure contact exchange systems: the current state of the art, SafeSlinger, and our newly designed protocol, PairSonic, which extends trust from physical encounters to spontaneous online communication. Our lab study (N=45) demonstrates PairSonic's superior usability, automating the tedious verification tasks from previous approaches via an acoustic out-of-band channel. Although participants significantly preferred our system, minimizing user effort surprisingly decreased the perceived security for some users, who associated security with complexity. We discuss user perceptions of the different protocol components and identify remaining usability barriers for CSCW application scenarios.

2024 2024 IEEE Conference on Communications and Network Security (CNS) Conference

A Data-Driven Evaluation of the Current Security State of Android Devices

Ernst Leierzopf René Mayrhofer Michael Roland Wolfgang Studier Lawrence Dean Martin Seiffert Florentin Putz Lucas Becker Daniel Thomas

BibTeX DOI: 10.1109/CNS62487.2024.10735682

Abstract

Android’s fast-paced development cycles and the large number of devices from different manufacturers do not allow for an easy comparison between different devices’ security and privacy postures. Manufacturers each adapt and update their respective firmware images. Furthermore, images published on OEM websites do not necessarily match those installed in the field. Relevant software aspects do not remain static after initial device release, but need to be measured on real devices that receive these updates. There are various potential sources for collecting such attributes, including webscraping, crowdsourcing, and dedicated device farms. However, raw data alone is not helpful in making meaningful decisions on device security and privacy. We make a website available to access collected data. Our implementation focuses on reproducible requests and supports filtering by OEMs, devices, device models, and attributes. To improve usability, we further propose a security score grounded on the list of attributes. Based on input from Android experts, including a focus group and eight individuals, we have created a method that derives attribute weights from the importance of attributes for mitigating threats on the Android platform. We derive weights for general use cases and suggest possible examples for more specialized weights for groups of confidentiality/privacy-sensitive users and integrity-sensitive users. Since there is no one-size-fits-all setting for Android devices, our website provides the possibility to adapt all parameters of the calculated security score to individual needs.

2023 29th Annual International Conference on Mobile Computing and Networking (ACM MobiCom '23) Conference

Introducing FreeSpeaker - A Modular Smart Home Hub Prototyping Platform

Hermann Leinweber Jonatan Crystall Frank Hessel Florentin Putz Matthias Hollick

PDF BibTeX DOI: 10.1145/3570361.3614080

Abstract

Smart home speakers have become a commodity item in many households and provide interesting research opportunities in areas like wireless communication and human-computer interaction. Commercial devices do not provide sufficient access for many research tasks. We present a modular smart home hub designed specifically for research purposes. The electronic and mechanical components are designed with reproducibility in mind and can be easily recombined for a project's needs. Additionally, we show applications of the hub in different scenarios.

2023 31st Interdisciplinary Information Management Talks Conference

A Large-Scale Data Collection and Evaluation Framework for Android Device Security Attributes

Ernst Leierzopf Michael Roland René Mayrhofer Florentin Putz

PDF BibTeX DOI: 10.35011/IDIMT-2023-63

Abstract

Android’s fast-lived development cycles and increasing amounts of manufacturers and device models make a comparison of relevant security attributes, in addition to the already difficult comparison of features, more challenging. Most smartphone reviews only consider offered features in their analysis. Smartphone manufacturers include their own software on top of the Android Open Source Project (AOSP) to improve user experience, to add their own pre-installed apps or apps from third-party sponsors, and to distinguish themselves from their competitors. These changes affect the security of smartphones. It is insufficient to validate device security state only based on measured data from real devices for a complete assessment. Promised major version releases, security updates, security update schedules of devices, and correct claims on security and privacy of pre-installed software are some aspects, which need statistically significant amounts of data to evaluate. Lack of software and security updates is a common reason for shorter lifespans of electronics, especially for smartphones. Validating the claims of manufacturers and publishing the results creates incentives towards more sustainable maintenance and longevity of smartphones. We present a novel scalable data collection and evaluation framework, which includes multiple sources of data like dedicated device farms, crowdsourcing, and webscraping. Our solution improves the comparability of devices based on their security attributes by providing measurements from real devices.

2023 ACM 2023 CHI Conference on Human Factors in Computing Systems Conference

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Leon Würsching Florentin Putz Steffen Haesler Matthias Hollick

PDF BibTeX DOI: 10.1145/3544548.3580993

Abstract

Modern smartphones support FIDO2 passwordless authentication using either external security keys or internal biometric authentication, but it is unclear whether users appreciate and accept these new forms of web authentication for their own accounts. We present the first lab study (N=87) comparing platform and roaming authentication on smartphones, determining the practical strengths and weaknesses of FIDO2 as perceived by users in a mobile scenario. Most participants were willing to adopt passwordless authentication during our in-person user study, but closer analysis shows that participants prioritize usability, security, and availability differently depending on the account type. We identify remaining adoption barriers that prevent FIDO2 from succeeding password authentication, such as missing support for contemporary usage patterns, including account delegation and usage on multiple clients.

2023 WiSec '23: 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

DEMO: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

Markus Scheck Florentin Putz Frank Hessel Hermann Leinweber Jonatan Crystall Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00024180

Abstract

Smart speakers are highly privacy-sensitive devices: They are located in our homes and provide an Internet-enabled microphone, making them a prime target for attackers. The pairing between a client device and the speaker must be protected to prohibit adversaries from accessing the device. Most commercial protocols are vulnerable to nearby adversaries as they do not probe for human presence at the speaker or proximity between both devices. In addition to security, the protocol must provide a user-friendly way for initial bootstrapping of the speaker. We design an open pairing protocol for the establishment of a shared secret between both devices using acoustic messaging to guarantee proximity, and release our implementation for the smart speaker as well as Android and Linux clients as open-source software on GitHub.

2021 2021 Conference on Computer Supported Cooperative Work and Social Computing Conference

Connected Self-Organized Citizens in Crises: An Interdisciplinary Resilience Concept for Neighborhoods

Steffen Haesler Ragnar Mogk Florentin Putz Kevin Logan Nadja Thiessen Katharina Kleinschnitger Lars Baumgärtner Jan-Philipp Stroscher Christian Reuter Michèle Knodt Matthias Hollick

PDF BibTeX DOI: 10.1145/3462204.3481749

2021 4th International Workshop on Emerging Technologies for Authorization and Authentication Conference

Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions

Florentin Putz Steffen Schön Matthias Hollick

PDF BibTeX DOI: 10.1007/978-3-030-93747-8_2

Abstract

The FIDO2 standards for strong authentication on the Internet define an extension interface, which allows them to flexibly adapt to future use cases. The domain of establishing new FIDO2 extensions, however, is currently limited to web browser developers and members of the FIDO alliance. We show how researchers and developers can design and implement their own extensions for using FIDO2 as a well-established and secure foundation to demonstrate innovative authentication concepts or to support custom deployments. Our open-source implementation targets the full FIDO2 stack, such as the Chromium web browser and hardware tokens, to enable tailor-made authentication based on the power of the existing FIDO2 ecosystem. To give an overview of existing extensions, we survey all published FIDO2 extensions by manually inspecting the source code of major web browsers and authenticators. Their current design, however, hinders the implementation of custom extensions, and they only support a limited number of extensions out of the box. We discuss weaknesses of current implementations and identify the lack of extension pass-through as a major limitation in current FIDO2 clients.

2020 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

Acoustic Integrity Codes: Secure Device Pairing Using Short-Range Acoustic Communication

Florentin Putz Flor Álvarez Jiska Classen

PDF BibTeX DOI: 10.1145/3395351.3399420

Abstract

Secure Device Pairing (SDP) relies on an out-of-band channel to authenticate devices. This requires a common hardware interface, which limits the use of existing SDP systems. We propose to use short-range acoustic communication for the initial pairing. Audio hardware is commonly available on existing off-the-shelf devices and can be accessed from user space without requiring firmware or hardware modifications. We improve upon previous approaches by designing Acoustic Integrity Codes (AICs): a modulation scheme that provides message authentication on the acoustic physical layer. We analyze their security and demonstrate that we can defend against signal cancellation attacks by designing signals with low autocorrelation. Our system can detect overshadowing attacks using a ternary decision function with a threshold. In our evaluation of this SDP scheme’s security and robustness, we achieve a bit error ratio below 0.1% for a net bit rate of 100 bps with a signal-to-noise ratio (SNR) of 14 dB. Using our open-source proof-of-concept implementation on Android smartphones, we demonstrate pairing between different smartphone models.