Back to Automating Login and Registration. Corpus-wide selection and extraction notes are on corpus. This is the page-specific query log.

• Run date: 2026-08-27 (UTC).
• Authoring agent: Cursor Grok 4.6, executing the drain item programming:registration (improve; 2.5 KB stub) directly rather than via a headless claude -p session. Review: three focused GPT 5.6 Sol medium passes on the frozen first draft (findings applied below), then one generic pass with no checklist after those fixes (see Review log).
• Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under /workspace/publications_dataset/data/.
• Read first: data/extract/OVERVIEW.md, the task spec, live programming:registration stub (rev 1739892438, 2,544 bytes), live programming:interaction (rev 1787833760 — underway, not edited), Ethics, Shepherd MADWeb PDF, Kubicek WWW 2024 author PDF.
• This is an extension of the stub. Title kept. No write to the publication mount. Wiki saves through scripts/dw.mjs with –if-rev on existing pages.

The stub named Shepherd, Dimova 2023, Ghasemisharif 2018, Zhou 2014, Cookie Hunter, Kubicek 2024, Englehardt 2018, Mathur, Senol 2022, Chatzimpyrros 2019. Zhou 2014 is SSOScan. Mathur is the 2023 Big Data & Society version of the 2020 political-email project. Chatzimpyrros is LNCS 2020. Shepherd / Mathur / Chatzimpyrros are out of corpus and labelled so.

All counts are papers unless labelled otherwise. Sentinels are not answers.

ROLE is a single-label hand map, not a regex fold. Residue of the 81 is 0 by construction: the report refuses to finish if the map and the schema set diverge. Tally: scale-register 8, scale-login 9, manual-session 9, lab-scanner 14, sso-study 2, newsletter 1, marketplace 6, social 10, other 11, mislabel 11.

Rejected probes (not published as counts): a loose register sweep (domain registration, “we did not register”, related work); lowercase shepherd (homograph). The capital-S probe hits 17 papers and was read, not counted as a tool. SCHEMA_MISS is not unioned into the 81.

scripts/verify_registration_figures.mjs: 63 needles, 0 missing, 6 shorter than 20 characters (flagged). Against paper.cols.txt, not crawlConfig.evidence.quote (one quote for the whole object).

Load-bearing pairings that were easy to get wrong:

• PETS 2022 59% / 5.5% from the body paragraph (of websites that sent mail / unsolicited marketing with no confirmation), not the abstract.
• Login-policies 39% from ground-truth manual accounts, not of 45.0K.
• Kubicek 25.7% (169,765) is of 660,202 unique domains, not of 504,509 loaded (that ratio is 33.7%). The PDF writes the 25.7% “among the loaded websites”.

Rejected: Similarweb / wmtips / SEO CAPTCHA-share pages.

• A 2026 CAPTCHA-provider mix including Turnstile.
• How often a Shepherd-style verifier disagrees with “the login form disappeared”.
• A hand split of the 129 ToS-mentioning crawling papers.
• Kubicek et al. inside the extraction.

• Publish 17, not 81, as the instrument figure; keep 81 visible because the neighbour already printed it. The 17 is a hand split of the 81, not a census of the 776 papers the schema did not mark as logged in.
• Do not edit programming:interaction in this sitting.
• Cite Kubicek from the PDF rather than omit the largest registration crawl.
• Date human CAPTCHA farms; do not present them as current best practice.
• login_diff.py is Shepherd's last step only (differential markers; token equality, not substring). It is not a login crawler.

15 new keys appended after a fresh live export. Reused: drakonakis2020_cookie, englehardt2018_email, senol2022_leaky, rautenstrauch2024_auth, kaizer2016_characterizing. Not used: ghasemisharif2023_bytecode, dimova2021cname, mathur2019_scale (wrong papers).

Unedited output of node scripts/report_registration.mjs (2026-08-27). The ROLE check printed OK and the process exited 0. Section I (full-text probes and the capital-S Shepherd hit list) is in scripts/report_registration-output.txt; it is an upper bound and was not published as a count.

==============================================================================
A. POPULATION
==============================================================================
corpus                                              5859
crawled  (crawlConfig OR automated-web-crawl)       1120
webCrawled  (crawled AND platforms includes web)    857   <- this page's denominator
  crawled but NOT web                               263

==============================================================================
B. crawlConfig.authentication — schema, of web crawls
==============================================================================
none 553 (64.5%); not-stated 204 (23.8%); account-registration 42 (4.9%);
manual-login 24 (2.8%); (no crawlConfig object) 19 (2.2%); automated-login 15 (1.8%).
stated (non-sentinel): 634 / 857 = 74.0%
schema "logged in of any kind": 81 / 857 = 9.5%

==============================================================================
C. same field, of all crawled papers (OVERVIEW.md row)
==============================================================================
stated: 779 / 1120 = 69.6%
sso among crawled: 1  (0 among webCrawled)
  USENIX/2024/darkfleece-probing-the-dark-side-of-android-subscription-apps  platforms=["mobile"]

==============================================================================
D. ROLE hand map over the 81
==============================================================================
scale-register 8 (9.9%); scale-login 9 (11.1%); manual-session 9 (11.1%);
lab-scanner 14 (17.3%); sso-study 2 (2.5%); newsletter 1 (1.2%);
marketplace 6 (7.4%); social 10 (12.3%); other 11 (13.6%); mislabel 11 (13.6%).
INSTRUMENT (scale-register ∪ scale-login): 17 / 857 = 2.0%
  of the 81 schema hits: 17 / 81 = 21.0%

==============================================================================
G. SCHEMA_MISS — closed list, not a sweep
==============================================================================
PETS/2018/i-never-signed-up-for-this-privacy-implications-of-email-tracking  auth=none  role=newsletter
USENIX/2018/o-single-sign-off-where-art-thou-an-empirical-analysis-of-single-sign-on-account  auth=none  role=sso-study
USENIX/2022/leaky-forms-a-study-of-email-and-password-exfiltration-before-form-submission  auth=none  role=form-nosubmit
PETS/2023/everybodys-looking-for-ssomething-a-large-scale-evaluation-on-the-privacy-of-oau  auth=none  role=sso-study
SCHEMA_MISS size: 4

==============================================================================
H. Kubicek WWW 2024 — in the bibliographic index, not in the extraction
==============================================================================
in extractions.jsonl: NO
paper.cols.txt: ABSENT. Cited from people.inf.ethz.ch/basin/pubs/www24.pdf
figures (author PDF, 2026-08-27): 660,202 unique; loaded 504,509;
  form on 25.7% (169,765) of 660,202 unique domains (PDF writes "among the loaded websites";
  169,765/504,509 loaded = 33.7%).

OK — ROLE covers the schema set both ways; SCHEMA_MISS keys exist and are not schema-logged.

Three focused passes on GPT 5.6 Sol medium, as directed for this sitting (the task spec's sonnet/fable split was overridden). They ran in parallel on the frozen first draft (out/freeze_registration/). The content page was not edited while those reviewers were running. Findings were applied, then a generic pass with no checklist on out/freeze_registration_generic/ (agent 5a44afde-2a4d-4fa4-85cb-33c2da9e4358). Every accept/reject is below. No GENERIC_REVIEW placeholder.

Ran after the focused findings were applied. No checklist. The content page was not edited while this reviewer ran.

[1]

Drakonakis, Kostas; Ioannidis, Sotiris; Polakis, Jason (2020): "The Cookie Hunter: Automated Black-box Auditing for Web Authentication and Authorization Flaws", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)