No Coffee, No Research

From global flight booking systems to our water supply, critical infrastructure is becoming more digital and interconnected every day. But this increasing connectivity also opens the door to cyberattacks that can disrupt our daily lives. That’s why CISPA Faculty member Julian Loss is dedicated to securing our critical infrastructure – with the help of cryptography and, naturally, plenty of coffee. He believes modern cryptography holds the key to solving some of the biggest challenges facing today’s infrastructure – if implemented correctly.

Usable-security researcher Maximilian Golla starts his day with two cups of milk, with a bit of coffee added. In this episode of "No Coffee, No Research," he talks to us about one of his current favorite topics: passkeys. Passkeys are a new authentication method that major services like Google, Amazon, and PayPal now offer as an alternative to traditional passwords. Maximilian is quite certain that, at least on large websites, passkeys will eventually replace passwords altogether – which is not a bad thing, as he considers them to be a much safer authentication method. "However, passkeys are not yet at the level they need to be to be perfect," he says. He and his team are working to address questions about the usability and security of passkeys. Anyone who wants to learn how passkeys work, why they are much more secure than passwords, and what challenges still exist should definitely check out this episode, recorded in German.

When it comes to coffee, there is one CISPA-Faculty you simply cannot leave out: Giancarlo Pellegrino! With most of his research group mostly running on coffee to fuel their research in web security, we asked him if the web is a safe place to spend a lot of time in. Giancarlo tells us how the web has developed over the last 30 years in terms of security, how things changed with the arrival of smartphones and mobile apps, and what the future may hold for the vast world of the web. Grab a coffee and get ready to be visited by the ghosts of internet past, present and yet to come!

Has Olaf Scholz ever called you to give you election tips? No? Lucky you! In the US state of New Hampshire in January 2024, many voters supposedly had US President Joe Biden on the phone, advising them not to go to the primaries. These kinds of fake calls, so-called robocalls, have become a popular election-campaign tool in the USA. There are also large numbers of AI-generated videos, images, and texts circulating worldwide. For us humans, these so-called deepfakes are almost impossible to recognize. Automated detection methods could and should help us in the future, says CISPA researcher Lea Schönherr in the latest episode of our interview series “No Coffee, No Research”. However, due to the rapid development of generative AI, these methods often reach their limits and are not yet robust enough. So, what can we do? Stay persistent and keep on researching—just like Lea.

He’s the worst nightmare of every CPU manufacturer’s security division: CISPA-Faculty Dr. Michael Schwarz! Whenever there’s a new CPU on the market, his and his team’s work of poking and prodding begins, revealing vulnerabilities and bugs along the way. Riding on his third coffee of the day, he tells us why one of the biggest advantages of our computers, their versatility, is what makes them more susceptible to bugs. He also discusses how the CPU market is about to change and why showing the world how to break an already released CPU can be a complicated ethical question. Get yourself a coffee and prepare for a ride through the world of hardware security!

"In the morning, one or two cups, and then another four or five throughout the day... CISPA researcher Ben Stock certainly lives up to the name of our series with his coffee consumption—and, of course, also with his research on web security. When asked how secure emails actually are, his clear response was: 'So-so.' He pointed out several reasons for this: no standard end-to-end encryption, insufficient security measures on the part of email providers, making emails the perfect tool for phishing attacks, and the lack of consistent security measures across different mail servers. Phew. Thankfully, Ben also offers tips on how we as users can at least protect ourselves a little."

If you’ve ever used AI tools such as ChatGPT, you might have wondered sometimes: where does that machine gets all its knowledge of the world from? Well, Franziska knows the answer: it learns it from your data. The data you leave on the internet, voluntarily or involuntarily. In terms of privacy, that is not ideal, as Machine learning models can leak private data. Which is especially critical in fields such as medicine. Luckily, Franziska and her team are working on improving the privacy of machine learning models, while also making sure their predictions are as accurate as possible. And also luckily, her research is heavily fueled by coffee! We brewed her a fresh one and asked her about her work.