The working log behind Authentication as Deployed: Login, SSO, MFA and Passkeys: every query with its population, the hand audit that produced the page's 45-paper population, the folds and their residue, the quotes checked against the papers, the external sources and the ones rejected, what could not be established, and the review findings. Corpus-wide caveats — the retrieval funnel, the extraction's stability, the provisional 2025–2026 venue-years — are on corpus and are not restated here.

This page carries no ~~DISCUSSION~~ block: comments belong on the content page. It adds no bibliography entries of its own and cites the same shared bibliography with the same keys as the content page.

roadmap listed this page under Assessed, and not written with the disposition: “46 papers unaudited, and the probe catches attacks on OAuth as well as deployment measurement. Gated on that audit; dropped if the deployment slice is under ~20.” The 46 came from one title-and-summary probe, auth_tight in scripts/gap_probe2.mjs.

The audit resolved the gate as follows:

Fixed before any figure was written, and reproduced verbatim from the header of scripts/auth_pop.mjs. A paper is IN the population if and only if all three hold:

1. Object — it measures authentication as deployed by services the authors do not control: login pages, login/password policies, SSO/OAuth/OIDC/SAML, MFA/2FA/RBA, passkeys/WebAuthn, account recovery, security notifications, or the session state a login establishes.
2. Unit — the measured unit is a population of at least ten such services, or an operator's own production login telemetry. Not the authors' own testbed, not a library, not a protocol model, not human participants.
3. Question — it asks what is deployed, available or configured, and reports per-service incidence. A paper that exploits a flaw in a handful of systems, analyses source code, or asks what users think is OUT even when it is about SSO.

A posture audit counts under (3) when it reports incidence across a sampled population: “n of N relying parties were vulnerable” is a deployment figure. That clause is what admits [1Sun, San-Tsai; Beznosov, Konstantin (2012): "The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], [2Jannett, Louis; Mladenov, Vladislav; Mainka, Christian; Schwenk, Jörg (2022): "DISTINCT: Identity Theft using In-Browser Communications in Dual-Window Single Sign-On", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], [3Ghasemisharif, Mohammad; Kanich, Chris; Polakis, Jason (2022): "Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] and [4Luo, Kaixuan; Wang, Xianbo; Fung, Pui Ho Adonis; Lau, Wing Cheong; Lecomte, Julien (2025): "Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms", in: Proceedings of the USENIX Security Symposium. (Link)], and it is the clause a reasonable person would most plausibly draw differently — see Judgement calls below.

Five probes over title + summary (the first is the roadmap's), unioned. None of these is a population; they are candidate generators, and every candidate was judged by hand.

Reproduce with:

node scripts/auth_audit.mjs            # the audit: probes, verdicts, assertions
node scripts/auth_report.mjs           # the page's figures
node scripts/auth_report.mjs --prevalence --wikitable   # every prevalence tuple, and the 45-paper table
python3 scripts/auth_recall.py --threshold 8            # the full-text recall pass (~7 min)
node scripts/auth_quotecheck.mjs       # 84 quote and figure checks

scripts/auth_audit.mjs refuses to print a population unless every candidate has a verdict, every verdict reason is distinct (a repeated reason is a canned reason, not evidence), every IN paper has a subgroup and a citekey, and no citekey is used twice. Its unedited output is embedded at the foot of this page; the summary:

Three quarters of the candidate pool is off topic, which is the fact the roadmap's gate existed to discover. The homonyms are worth recording because they will recur: MFA is the paper's own abbreviation for “Made for AdSense” in a 2011 search-spam study (verified in its full text); OpenID matches “OpenIDEO”, the design-idea platform; multi-factor is a sequence-fusion architecture in an NLP paper; and an RPKI relying party is a route-origin validator, which alone accounts for five candidates.

Subgroups of the 45, which are the page's section structure:

A title-and-summary candidate set is a recall claim, so it was tested. scripts/auth_recall.py streams every paper.cols.txt in the corpus (5,855 of the 5,859 records have one; the 4 without are counted as negatives), collapses whitespace — a PDF line break inside “single sign-on” otherwise hides it — and counts hits for four families: SSO, passkey/WebAuthn, MFA, and login surface.

Population definitions used, each naming its own denominator:

• the population = the 45 IN papers. Never “of 5,859”.
• web-platform papers = 1,622 papers whose platforms includes web. 42 of the 45 are in it; the three that are not are the operator-telemetry studies of Google and two universities.
• crawled = 1,120 papers with a crawlConfig object or the automated-web-crawl study type. 25 of the 45 are in it.
• papers with a crawl configuration inside the population = 23 of 45. Every crawlConfig share on the page divides by 23, not by 45 — more than half of this literature is manual audit or operator telemetry and has no crawl to configure.
• papers with an ethics object = 44 of 45; with an artifacts object = 41 of 45. Those are the denominators for the ethics and artifact rows, and they are not 45.

Two free-text fields are aggregated on the page, and both are folded by rules written into scripts/auth_report.mjs rather than by name_fold.mjs, because the shared fold canonicalises case and punctuation but does not merge synonyms.

Instruments (tools[].name), counted by paper. Rules: all Chrome/Chromium/Google Chrome spellings to one family; Firefox and GeckoFX together; Selenium; Puppeteer including puppeteer-extra; Playwright including “Microsoft Playwright”; CDP as its own row; mitmproxy and “MitM proxy”; Faker and RandExp as “synthetic-identity generator”; Twilio, Wit.ai, the Gmail API and G Suite as “registration plumbing”; Prolific and Mechanical Turk as “participant panel”; OpenWPM and Tracker Radar Collector each as their own row.

A widened absence check changed a claim before it was published. The draft read “nobody uses an off-the-shelf measurement framework: OpenWPM appears zero times”. OpenWPM really is zero, in tools[] and otherToolsMentioned[] alike — but widening the same check to Tracker Radar Collector, webXray and crawl4ai returned one paper, [9Senol, Asuman; Ukani, Alisha; Cutler, Dylan; Bilogrevic, Igor (2024): "The Double Edged Sword: Identifying Authentication Pages and their Fingerprinting Behavior", in: Proceedings of the ACM Web Conference 2024. (DOI)], which builds on DuckDuckGo's collector. The page now says “almost nobody”, names the exception, and the widened check is printed by auth_report.mjs §6a so the claim is script-backed rather than asserted. An absence claim that rests on one spelling of one tool is a probe result wearing a conclusion's clothes.

Residue: 203 distinct tool strings, 218 mentions, unmapped and printed in full in the embedded report output. It is not noise — it is the most informative part of the fold, because it is almost entirely one-off crawlers named after their own paper (SSOScan, Distinct, SAAT, Web3AuthChecker, QRLChecker, IDB-DETECTOR, FP-Extractor, PASSKEYS-RADAR, PASSKEYS-ATTACKER, Account Framework, Live-Monitor, Communication-Inspector). That is the finding the page states: this subfield builds bespoke instruments and reuses almost nothing, and OpenWPM appears zero times.

Sampling frames (population[].sourceList), counted by paper. Rules: Tranco; CrUX including “Chrome UX Report” and “Chrome User Experience Report”; Alexa; Majestic; Quantcast; Cisco Umbrella; 2fa.directory; Similarweb; HTTP Archive; Fortune 1000; “custom / not stated” for custom seed lists and not-stated; participant panels. Residue: 44 distinct strings, printed in full below — mostly per-paper artefacts (Google login traces, partner RP authentication logs, the FIDO Metadata Service, PASSKEYS-RADAR merged sources, DappRadar, npm and GitHub APIs) rather than spelling variants of a ranking list.

scripts/auth_quotecheck.mjs: 95 needles, 95 PASS, 0 FAIL (unedited output embedded below). Needles are sentence fragments rather than bare numbers — a bare “42.3%” is a true string in the wrong paper. Two exceptions, both in the block labelled “figures re-read from the paper”: 6,211 and 18.53 are checked as bare strings against one named paper each, because what they had to establish was that paper's denominator, and the sentences around them are checked separately.

The method needed three tiers, and the reason is worth recording because it will bite the next run:

1. Exact match in one of three renderings (paper.cols.txt, paper.txt, paper.norm.txt), after collapsing whitespace, joining hyphenation across line breaks, normalising ligatures and curly quotes, and folding case.
2. Token match with punctuation and hyphen tolerance. The rendering writes “sessions.” where the needle has “sessions”, and “pre- hijacking” where the paper's prose has “pre-hijacking”. Exact matching called 15 of 84 verbatim quotes a FAIL before this tier existed.
3. Column-splice tolerance. A two-column PDF drops the other column's words into the middle of a sentence: the paper really says “89.5% of 2.1 the RPs we evaluate do not offer options for invalidating active sessions”. The matcher walks the needle's tokens in order and accepts at most 8 injected words, printing the count. 8 needles matched only this way; the largest injections were 8 words (the SoK's passkey-support sentence, and the Google recovery-rate comparison).

Three needles were shortened or dropped rather than matched with a tolerance that would accept anything: SAAT's revocation sentence was split into two contiguous halves; the identity-account abstract's “80 out of 100 websites are vulnerable to the inconsistency threat” is spliced inside the hyphenated word “web-sites” and was replaced with the results-section fragment “sites are vulnerable to the inconsistency threat”; and its per-case sentence was dropped. Anything that could not be verified this way is not on the page.

One extraction quote turned out to be a near-paraphrase: the detection[] tuple for [10Kepkowski, Michal; Hanzlik, Lucjan; Wood, Ian; Kaafar, Mohamed Ali (2022): "How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy", in: Proceedings on Privacy Enhancing Technologies. (DOI)] records “We gathered 684 records of WebAuthn executions”, which is in the paper, but the sentence the page quotes instead is the clearer “we surveyed 1 million high traffic web sites and found 684 FIDO authentication deployments”. Both are verbatim; the second is the one a reader can act on.

Everything not in the corpus was fetched on 2026-09-11, never recalled. Two sub-agents did the first pass; every load-bearing claim below was then re-fetched independently by me, because a sub-agent's industry notes have previously come back leaning on listicles.

27 entries, all generated by node scripts/bibgen.mjs <venue>/<year>/<slug> from data/corpus2/.meta — publisher metadata, not recalled strings. 23 are population papers; the other four are cited in prose only: [12Lassak, Leona; Pan, Elleen; Ur, Blase; Golla, Maximilian (2024): "Why Aren't We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication", in: Proceedings of the USENIX Security Symposium. (Link)] (why passkey deployment stalls), [13Wang, Rui; Chen, Shuo; Wang, XiaoFeng (2012): "Signing Me onto Your Accounts through Facebook and Google: A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] (the founding web-SSO security study), [14Sahin, Sena; Al-Roomi, Suood Abdulaziz; Poteat, Tara; Li, Frank (2023): "Investigating the Password Policy Practices of Website Administrators", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] (the administrators' side of password policy) and [15Brandão, Luís T. A. N.; Christin, Nicolas; Danezis, George; Anonymous, (2015): "Toward Mending Two Nation-Scale Brokered Identification Systems", in: Proceedings on Privacy Enhancing Technologies. (DOI)] (brokered-identity history). The population's other 22 citekeys were already in the bibliography. Checks run before appending:

• scripts/bib_dedup_scan.py –bib on the merged file: 977 entries, 977 distinct citekeys, no same-DOI and no same-title pair. The scan's [D] candidate class (same year, same folded surname) printed 85 pairs, all previously judged and none of them mine except surname coincidences (wu2026_email against wu2026_tracking, zhang2025_qrcode against zhang2025_abusability, yan2024_stealing against yan2024_quality).
• Every {[key]} on both pages resolves against the merged bibliography: 51 distinct keys used across the two pages, 0 missing, and every one of the 27 new entries is cited. (The generic review caught that this very sentence had been counting itself: an unescaped citekey inside inline code still resolves, because monospace markup does not escape the plugin's syntax.)
• Author lists for PETS and USENIX are absent from the corpus index by construction. scripts/fetch_authors.py recovered nine from the venue landing pages; three PETS records failed to parse and were filled by hand from the paper's own first page — [16Corre, Kevin; Barais, Olivier; Sunyé, Gerson; Frey, Vincent; Crom, Jean-Michel (2017): "Why can't users choose their identity providers on the web?", in: Proceedings on Privacy Enhancing Technologies. (DOI)], [10Kepkowski, Michal; Hanzlik, Lucjan; Wood, Ian; Kaafar, Mohamed Ali (2022): "How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy", in: Proceedings on Privacy Enhancing Technologies. (DOI)] and [15Brandão, Luís T. A. N.; Christin, Nicolas; Danezis, George; Anonymous, (2015): "Toward Mending Two Nation-Scale Brokered Identification Systems", in: Proceedings on Privacy Enhancing Technologies. (DOI)] — then cross-checked against Crossref, which agreed on names and order in all three. The 2015 brokered-identity paper genuinely has a fourth author listed as “Anonymous”, on the PDF and in Crossref alike; the entry keeps it.
• Crossref caught a surname error. bibgen derived “Tchokodeu, Kevin Nsieyanji” for the CCS 2024 poster; Crossref gives family name “Nsieyanji Tchokodeu”, given name “Kevin”. Fixed before appending. Six DOIs were spot-checked against Crossref (titles, author order, year, venue) and the other five matched exactly.
• Two DBLP title artefacts fixed: “as aDefense” → “as a Defense” in [17Doerfler, Periwinkle; Thomas, Kurt; Marincenko, Maija; Ranieri, Juri; Jiang, Yu; Moscicki, Angelika; McCoy, Damon (2019): "Evaluating Login Challenges as a Defense Against Account Takeover", in: Proceedings of the ACM Web Conference. (DOI)], and the stray curly quotation marks in the title of [18Wei, Tongxin; Wang, Ding; Li, Yutong; Wang, Yuehuan (2025): ""Who is Trying to Access My Account?" Exploring User Perceptions and Reactions to Risk-based Authentication Notifications", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] normalised to ASCII.

• How many authenticators are in the FIDO Metadata Service today. The endpoint returned HTTP 429 to every attempt from two networks. No count is published on the page; the 2023 paper's 160-authenticator figure is cited as that paper's, with its date.
• Whether passkey deployment has grown, and by how much. Four measurements exist and no two share a frame, a detection method, or a definition of “supports passkeys”. The page states the four and declines to draw a trend line. The 2026 census's own longitudinal figure is a directory-archive reconstruction, not a repeat of its own instrument.
• Anything about enterprise SSO. 39 papers in the corpus mention Entra, Okta, Azure AD, ADFS or Workspace; judged from their titles none has enterprise identity as its object, and I did not read all 39. No sampling frame for enterprise tenants was found either — the nearest thing in the population is a poster whose frame is 100 named companies [19Nsieyanji Tchokodeu, Kevin; Schulmann, Haya; Sobol, Gil; Waidner, Michael (2024): "Poster: Security of Login Interfaces in Modern Organizations", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)]. Both halves of that are weaker than the FedCM claim, which rests on a full-text count of one.
• FedCM's deployed footprint. Zero papers, and no public dataset. The page says so rather than guessing from the spec's existence.
• Whether the classification.method == llm absence is real or a publication lag. It is a true statement about this corpus (0 of 45, against 177 corpus-wide), but 2025–2026 is the thinnest slice of the corpus and the page says so in the same paragraph.
• The recall of the 144 title-only dismissals in the recall pass. See the box above; this is the audit's weakest step.
• Whether a public HTTP Archive query exists for navigator.credentials usage. The Web Almanac has no such chapter; a BigQuery check of HTTP Archive's JS-API tables was out of reach from this environment and is recorded as unchecked rather than absent.
• SOUPS. Much of the usability-adjacent deployment work is published there and the corpus does not include it. This is the single most consequential venue gap for this page, and it is named on the content page.

Four passes, all told explicitly that my context might not be exhaustive, and all handed the page text, the scripts, the unedited outputs and these notes. The three focused passes ran in parallel first; the generic pass ran after their findings were applied. Rejections are recorded as carefully as fixes: they are the only evidence of whether a reviewer earned its slot.

Re-ran every script, diffed against the committed outputs, mutation-tested the assertions, and re-derived the arithmetic.

Re-verified all 27 new BibTeX entries against Crossref or the venue landing page (titles, full author lists, author order, year, venue), re-checked ~40 numeric claims the quote checker does not cover, and tested the page's structural claims against competing papers.

Told to fetch rather than recall, and to verify this log's own External sources table rather than trust it.

No checklist, and it found the most. Thirteen findings; twelve accepted, one accepted as informational, none rejected outright — though two were accepted with a different fix than the one proposed.

Recorded because a page that only lists what reviewers found implies the author checked nothing:

• “Nobody uses an off-the-shelf measurement framework.” OpenWPM really is zero; widening the check to Tracker Radar Collector, webXray and crawl4ai returned one paper. See Folds above. The claim now names its exception and is printed by the script.
• Four absolute claims (“the only paper that…”, “only one paper publishes it”) were contradicted by the page's own citations two paragraphs later. Fixed before review; one of them ([22Ardi, Calvin; Calder, Matt (2023): "The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] and [23Chang, Li; Hsiao, Hsu-Chun; Jeng, Wei; Kim, Tiffany Hyun-Jin; Lin, Wei-Hsi (2017): "Security Implications of Redirection Trail in Popular Websites Worldwide", in: Proceedings of the ACM Web Conference. (DOI)] both publishing a sites-with-login denominator) had already been written into the same bullet that denied it.
• Two corpus-wide absence claims — FedCM and enterprise SSO — were originally written as population-level statements and then stated as corpus-level facts. They now rest on scripts/auth_absence_probe.py, a full-text sweep of all 5,853 papers with extracted text: FedCM appears in one paper, three times, all of them a bibliography entry; enterprise identity products appear in 39, all incidentally. Without the sweep, “no paper measures FedCM” would have been a claim about 45 papers dressed as a claim about 5,859.

Committed under scripts/ in the working repository and reproduced here so the audit trail is readable without repository access. auth_pop.mjs is the one to read: it holds the inclusion rule, all 184 hand verdicts with their per-paper reasons, the citekey map, and the assertions that make every other script refuse to run if any of that drifts.

Six URLs inside the raw output below are dead (a 401, three 404s, a 502, a 403). They are artifact links the papers themselves declared, reproduced verbatim; the rot is the finding, and rewriting them would falsify the trail. artifacts is the page about that.

Probes, the inclusion rule, the 184 hand verdicts, the citekey map, and the assertions.

auth_pop.mjs

// security:authentication — candidate probes and the hand audit behind the page's population.
//
// The roadmap queued this page with "46 papers unaudited" from one title+summary probe
// (auth_tight in scripts/gap_probe2.mjs) and gated it on this audit. This script is that
// audit. It is deliberately one file: the probes, the hand verdicts and the assertions live
// together so a verdict cannot drift away from the candidate it judges.
//
// INCLUSION RULE, fixed before any figure was written (2026-09-11). A paper is IN the
// population iff all three hold:
//   1. object — it measures authentication AS DEPLOYED by services the authors do not
//      control: login pages, login/password policies, SSO/OAuth/OIDC/SAML, MFA/2FA/RBA,
//      passkeys/WebAuthn, account recovery, security notifications, or the session state a
//      login establishes;
//   2. unit — the measured unit is a population of >=10 such services, or an operator's own
//      production login telemetry. Not the authors' own testbed, not a library, not a
//      protocol model, not human participants;
//   3. question — it asks what is deployed / available / configured / how exposed, and
//      reports per-service incidence. A paper that exploits a flaw in a handful of systems,
//      analyses source code, or asks what users think is OUT even when it is about SSO.
// Posture audits count under (3) when they report incidence across a sampled population:
// "n of N relying parties were vulnerable" is a deployment figure.
//
// Every OUT verdict carries its own reason. There is no default reason string.
//
// This module owns the probes, the hand map and the assertions. scripts/auth_audit.mjs
// prints the audit; scripts/auth_report.mjs computes the page's figures. Both import
// audit() from here, so a verdict cannot be true for one script and false for the other.
 
import { loadExtractions } from './lib.mjs';
 
const rows = loadExtractions();
const T = (p) => `${p.title ?? ''} • ${p.summary ?? ''}`;
 
// ---------------------------------------------------------------------------
// Probes over title+summary. Each is a CANDIDATE generator, never a population.
// ---------------------------------------------------------------------------
const PROBES = {
  // as queued on the roadmap, verbatim from scripts/gap_probe2.mjs
  tight: (p) =>
    /(single sign-?on|\bSSO\b|OAuth|OpenID|SAML|WebAuthn|passkey|\bFIDO\b|multi-?factor|two-?factor|\b2FA\b|\bMFA\b)/i.test(T(p)),
  // added 2026-09-11: the tight probe names only the branded mechanisms. The literature that
  // measures login deployment without naming one of them (login policies, password policies,
  // login-page discovery, recovery, session cookies) is invisible to it.
  mechanism: (p) =>
    /\blog ?-?in\b|\blogins?\b|\bsign-?in\b|\bsign ?up\b|\bsigning in\b|identity provider|relying part|\bOTP\b|\bTOTP\b|one-?time (password|code|pin)|\bU2F\b|security key|passwordless|magic link|account recovery|password reset|forgot password|account takeover|credential stuffing|session (management|cookie|hijack|fixation|integrity|token)|password manager/i.test(T(p)),
  // added 2026-09-11 as a recall check on the two words the field uses when it does not name
  // a mechanism. Both are far too broad to be a population; restricted to the web platform so
  // the hand audit stays finite, and the residue is reported rather than hidden.
  authnweb: (p) => /\bauthenticat/i.test(T(p)) && p.platforms.includes('web'),
  accountweb: (p) => /\baccounts?\b/i.test(T(p)) && p.platforms.includes('web'),
  // added 2026-09-11 after scripts/auth_recall.py streamed every paper.cols.txt in the corpus
  // (whitespace collapsed) for the four mechanism families. 155 papers scored >= 8 full-text
  // hits without being a title+summary candidate; positive control: 39 of the 41 papers the
  // audit had already put in the population also score >= 8, so the probe can see what it is
  // testing. The 155 are in scripts/auth_recall-output.txt. Eleven whose titles left open the
  // possibility that the object was web authentication deployment were read; they are listed
  // here so the candidate pool equals the set actually judged. The other 144 were dismissed on
  // their titles alone — that is a weaker step than the rest of this audit and is recorded as
  // such on provenance:security:authentication.
  recall: (p) => RECALL_READ.includes(p.slug),
};
 
const RECALL_READ = [
  'investigating-the-password-policy-practices-of-website-administrators',
  'the-state-of-the-samesite-studying-the-usage-effectiveness-and-adequacy-of-sames',
  'cookies-lack-integrity-real-world-implications',
  'toward-mending-two-nation-scale-brokered-identification-systems',
  'unmasking-the-security-and-usability-of-password-masking',
  'an-empirical-study-evaluation-of-modern-captchas',
  'one-email-many-faces-a-deep-dive-into-identity-confusion-in-email-aliases',
  'practical-data-access-minimization-in-trigger-action-platforms',
  'experimental-security-analysis-of-the-app-model-in-business-collaboration-platfo',
  'shattered-chain-of-trust-understanding-security-risks-in-cross-cloud-iot-access',
  'back-to-school-on-the-in-security-of-academic-vpns',
];
 
// ---------------------------------------------------------------------------
// Hand verdicts. Key = a substring of the title that matches exactly one candidate.
// [code, subgroup, reason]. subgroup is '' for every OUT verdict.
// Subgroups: SSO, MFA (incl. RBA and security notifications), PASSKEY, LOGINSURF
// (login-page discovery, login/password policy, account creation), POSTLOGIN, OPERATOR.
// ---------------------------------------------------------------------------
const V = {
  // ---------------- IN: SSO / OAuth / OIDC / SAML deployment ----------------
  'devil is in the (implementation) details': ['IN', 'SSO', 'black-box tested 96 Facebook-login relying parties from Google’s top-1,000 list and reports per-RP flaw incidence'],
  'SSOScan': ['IN', 'SSO', 'crawled 20,000 Quantcast sites for Facebook SSO integration and five flaw classes; reports SSO prevalence and enrolment success rates'],
  'Why can’t users choose their identity providers': ['IN', 'SSO', 'manual audit of Alexa top 500 classifying which identity providers each relying party accepts'],
  'O Single Sign-Off': ['IN', 'SSO', 'Alexa 1M crawl for SSO adoption per identity provider, plus session-management audit of relying parties'],
  'Identity-Account Inconsistency': ['IN', 'SSO', 'tested SSO account binding on 100 of the Alexa top 1,000 plus Fortune-1000 and university identity policies'],
  'DISTINCT': ['IN', 'SSO', 'instrumented crawl of Tranco top 1,000 measuring dual-window SSO flows and in-browser message handling per site'],
  'Everybody\'s Looking for SSOmething': ['IN', 'SSO', 'CrUX 100k crawl measuring OAuth adoption and requested scopes per site'],
  'Towards Automated Auditing for Account and Session Management': ['IN', 'SSO', 'automated audit of Facebook-SSO relying parties drawn from Majestic 100k for registration, revocation and session practices'],
  'Prevalence of Single Sign-On on the Web': ['IN', 'SSO', 'live crawls of CrUX top 1k/10k measuring login and third-party SSO prevalence with DOM and logo detection'],
  'Only as Strong as the Weakest Link': ['IN', 'SSO', 'measures brokered-SSO prevalence from a Tranco-derived SSO traffic dataset and audits the brokers found'],
  'Universal Cross-app Attacks': ['IN', 'SSO', 'black-box tested OAuth 2.0 configuration across 18 integration platforms and reports per-platform incidence; population is platforms, not websites'],
  'Connecting the Dots: An Investigative Study': ['IN', 'SSO', 'built 85,053 authentication webpages from Korean login-path keywords and measured KakaoTalk account-linking integration on 14,102 of them'],
 
  // ---------------- IN: MFA / 2FA / risk-based authentication ----------------
  'Is Real-time Phishing Eliminated with FIDO': ['IN', 'MFA', 'audited which second factors and fallbacks Alexa top-100 sites offer alongside FIDO'],
  'Consistency of Two-Factor Authentication User Journeys': ['IN', 'MFA', 'two coders walked the full 2FA journey on 85 popular websites and coded factor consistency per site'],
  'We\'ve Disabled MFA for You': ['IN', 'MFA', 'audited MFA recovery documentation for 1,303 sites from 2fa.directory and tested recovery on 71'],
  'Multi-Factor and Risk-Based Authentication Availability': ['IN', 'MFA', 'created accounts and audited MFA, RBA and suspicious-login response on popular websites'],
  'Phish in Sheep\'s Clothing': ['IN', 'MFA', 'audited which login pages fingerprint the browser as a risk signal, across an Alexa-ranked population and 300 services'],
  'Who is Trying to Access My Account': ['IN', 'MFA', 'triggered risk-based-authentication paths on 251 websites and coded the 161 notifications they produced'],
  'Was This You?': ['IN', 'MFA', 'created accounts on Tranco top-100 sites, executed a suspicious login, and coded the 21 notification emails that arrived'],
 
  // ---------------- IN: passkeys / WebAuthn ----------------
  'Security Posture of Real-World FIDO2 Deployments': ['IN', 'PASSKEY', 'audited FIDO2 configuration at Tranco top-1k relying parties and tracked the FIDO metadata service longitudinally'],
  'The State of Passkeys': ['IN', 'PASSKEY', 'continuous passkey discovery over Tranco 1M and CrUX 18M, 208 confirmed implementations hand-audited, 103 security-tested'],
  'SoK: Web Authentication and Recovery': ['IN', 'PASSKEY', 'hand-audited passkey support across an Alexa top-300 sample alongside the recovery mechanisms of 22 end-to-end-encrypted providers'],
  'Framework for Abusability Analysis': ['IN', 'PASSKEY', 'stepped through passkey registration, portability, deletion and revocation on a Tranco 200 sample'],
  'How Not to Handle Keys': ['IN', 'PASSKEY', 'crawled the Cisco Umbrella 1M for navigator.credentials WebAuthn use and found 684 records; the earliest WebAuthn census in this corpus'],
  'Anchors of Trust': ['IN', 'PASSKEY', 'manually evaluated cross-device authentication as deployed by 27 services before the user half of the study'],
 
  // ---------------- IN: the login surface (pages, policies, account creation) ----------------
  'Redirection Trail': ['IN', 'LOGINSURF', 'located login pages across Alexa top-10k and top-1M and measured HTTPS posture of the login POST; reports how many sites offer login at all'],
  'Cookie Hunter': ['IN', 'LOGINSURF', 'automated account creation across 1.58M Alexa domains, then audited authentication-cookie and HSTS flaws per site'],
  'Pre-hijacked accounts': ['IN', 'LOGINSURF', 'manually tested account-creation and authentication workflows on 75 popular services for five pre-hijacking classes'],
  'Large-Scale Measurement of Website Login Policies': ['IN', 'LOGINSURF', 'automated account creation and login on CrUX top 1M to measure login policy per site'],
  'Measuring Website Password Creation Policies': ['IN', 'LOGINSURF', 'automated signups across Tranco-ranked domains, varying passwords to infer each site’s policy'],
  'Double Edged Sword': ['IN', 'LOGINSURF', 'crawled CrUX-ranked sites to identify authentication pages and then measured fingerprinting on them'],
  'Poster: Security of Login Interfaces': ['IN', 'LOGINSURF', 'scanned 73,431 login-page URLs belonging to 100 European companies; a poster, so treat the figures as preliminary'],
  'QR Code-based Login': ['IN', 'LOGINSURF', 'measured QR-login prevalence and workflow security across ranked websites'],
  'Stealing Trust': ['IN', 'LOGINSURF', 'probed wallet-based Web3 login APIs at 27 sites across 29 cases; the newest login mechanism anyone in this corpus measured'],
  'Survey of Account Security Interfaces': ['IN', 'LOGINSURF', 'scripted login sessions on 100 popular services and hand-coded what each account-security interface exposes'],
 
  // ---------------- IN: what a login leaves behind ----------------
  'To Auth or Not To Auth': ['IN', 'POSTLOGIN', 'paired authenticated and unauthenticated crawls of 200 popular sites, comparing XSS, headers, JavaScript and postMessage behind the login'],
  'Cookie Crumbles': ['IN', 'POSTLOGIN', 'measured cookie-prefix (__Host-/__Secure-) adoption in HTTP Archive data alongside a framework audit'],
 
  // ---------------- IN: operator-side login telemetry ----------------
  'Secrets, Lies, and Account Recovery': ['IN', 'OPERATOR', 'Google’s own secret-answer and recovery telemetry: recovery as deployed, measured from inside'],
  'Evaluating Login Challenges': ['IN', 'OPERATOR', 'Google login and recovery traces measuring how often challenges stop hijacking and how often they stop legitimate users'],
  'Empirical Measurement of Systemic 2FA Usability': ['IN', 'OPERATOR', '32M + 6M Duo 2FA log events and 17,085 support tickets from two mandatory university deployments'],
  'Gossamer': ['IN', 'OPERATOR', 'instrumented the production login systems of two universities for 3-7 months, 34M requests'],
 
  // ---------------- IN: added by the full-text recall probe ----------------
  'Unmasking the Security and Usability of Password Masking': ['IN', 'LOGINSURF', 'audited password-field masking as deployed on 100 CrUX top-1K domains before the participant studies'],
  'One Email, Many Faces': ['IN', 'LOGINSURF', 'tested how 18 platforms and 28 mail providers resolve alias addresses at signup, login and recovery — identifier handling as deployed'],
  'The State of the SameSite': ['IN', 'POSTLOGIN', 'longitudinal SameSite adoption across Alexa 500K plus breakage tests; the session-cookie hardening half of the post-login surface'],
  'Cookies Lack Integrity': ['IN', 'POSTLOGIN', 'Alexa 1M crawl for the shared-domain and HSTS conditions that let an attacker inject a session cookie'],
 
  // ---------------- OUT: read because of the recall probe, and rejected ----------------
  'Password Policy Practices of Website Administrators': ['USER', '', 'surveys and interviews 11 administrators about the policies they chose; the deployed policy itself is measured by the two Al Roomi crawls'],
  'Nation-Scale Brokered Identification': ['SYSTEM', '', 'privacy analysis and redesign of the GOV.UK Verify and Connect.gov hub designs; the extraction labels it simulation-or-theory-only with no measured population'],
  'Modern CAPTCHAs': ['ADJACENT', '', 'inspects CAPTCHA prevalence on 200 popular sites, but a bot challenge guards many flows and is not a claim about an identity; programming:registration owns CAPTCHA and this page points there'],
  'Data Access Minimization in Trigger-Action Platforms': ['ADJACENT', '', 'OAuth scopes inside IFTTT rules; the unit is a trigger-action rule, not a login'],
  'App Model in Business Collaboration Platforms': ['ADJACENT', '', 'OAuth app permissions in Slack and Teams directories; delegated authorization between apps rather than a user logging in'],
  'Shattered Chain of Trust': ['ADJACENT', '', 'OAuth-style access delegation between ten IoT clouds; the device-cloud population belongs with IoT, not web login'],
  'Academic VPNs': ['ADJACENT', '', 'VPN gateway and client authentication at universities; not a browser login surface'],
 
  // ---------------- OUT: the probe matched a different sense of the word ----------------
  'Fashion crimes': ['HOMONYM', '', 'MFA here is "Made for AdSense", the paper’s own expansion; it is a search-spam measurement'],
  'HybridEval': ['HOMONYM', '', 'the OpenID match is inside "OpenIDEO", the design-idea platform the paper samples from'],
  'EmpMFF': ['HOMONYM', '', '"multi-factor" is a sequence-fusion architecture for empathetic response generation'],
  'On Measuring RPKI Relying Parties': ['HOMONYM', '', 'a relying party in RPKI is a route-origin validator, not an SSO relying party'],
  'Behind the Scenes of RPKI': ['HOMONYM', '', 'measures RPKI relying-party software deployment among network operators, a different relying party entirely'],
  'Poster: RPKI Kill Switch': ['HOMONYM', '', 'poster on RPKI validator failure modes; the relying party is a route validator'],
  'Landscape of RPKI Relying Parties': ['HOMONYM', '', 'surveys which RPKI validator implementations operators run; nothing to do with web login'],
  'Stalloris': ['HOMONYM', '', 'RPKI relying-party downgrade attack, not web login'],
  'Signing in Four Public Software Package Registries': ['HOMONYM', '', '"signing" is package signing in PyPI/Maven/Docker Hub/Hugging Face, not signing in'],
  'Watching TV with the Second-Party': ['HOMONYM', '', 'matched on an incidental "sign-in" in a smart-TV ACR tracking study; Connected TV is its own roadmap item'],
  'Sheep\'s clothing, wolfish intent': ['HOMONYM', '', 'matched on "authenticat" inside an ad-review study; the object is problematic advertisements'],
 
  // ---------------- OUT: passwords as secrets, and password managers ----------------
  'Measuring password guessability for an entire university': ['PASSWORD', '', 'the university SSO system is only where the 42,563 passwords came from; the object is guessability'],
  'Science of Guessing': ['PASSWORD', '', '70M-password corpus analysis; no deployment measured'],
  'Passwords Are Not Always Stronger': ['PASSWORD', '', 'password strength across sites of different value, not what those sites deploy'],
  'Towards Reliable Storage of 56-bit Secrets': ['PASSWORD', '', 'human memory for secrets; a lab study'],
  'password discretization for click-based graphical passwords': ['PASSWORD', '', 'graphical-password scheme analysis'],
  'Multiple-Password Interference': ['PASSWORD', '', 'lab study of a geographic password scheme'],
  'Forgetting of Passwords': ['PASSWORD', '', 'memory model of password recall'],
  'Beyond Credential Stuffing': ['PASSWORD', '', 'password-similarity models; the population is leaked credentials'],
  'Don\'t Forget the Stuffing': ['PASSWORD', '', 'security impact of typo-tolerant checking, evaluated on leaked password sets'],
  'Araña': ['PASSWORD', '', 'characterises guessing attacks seen by two universities; the object is the attack traffic, not the deployment'],
  'Protecting accounts from credential stuffing': ['PASSWORD', '', 'a breach-alerting protocol and its Chrome deployment, not a measurement of others’ deployments'],
  'PassREfinder': ['PASSWORD', '', 'predicts credential-stuffing risk from password reuse; no authentication deployment measured'],
  'Neuroscience Meets Cryptography': ['PASSWORD', '', 'implicit-learning authentication primitive, lab only'],
  'Picture Gesture Authentication': ['PASSWORD', '', 'Windows 8 picture-password scheme security'],
  'Gesture Authentication for Smartphones': ['PASSWORD', '', 'gesture-password selection policies on phones'],
  'Emperor’s New Password Manager': ['PWMANAGER', '', 'security analysis of five web password managers; the object is the manager'],
  'Password Managers: Attacks and Defenses': ['PWMANAGER', '', 'browser password-manager autofill attacks'],
  'That Was Then, This Is Now': ['PWMANAGER', '', 'password-manager generation/storage/autofill evaluation'],
  'Analyzing the Usability of Popular Smartphone Password Managers': ['PWMANAGER', '', 'usability of mobile password managers'],
  'Why Older Adults (Don\'t) Use Password Managers': ['PWMANAGER', '', 'interview study of adoption'],
  'Why Users (Don\'t) Use Password Managers at a Large Educational Institution': ['PWMANAGER', '', 'survey of adoption inside one institution'],
  'started using the other': ['PWMANAGER', '', 'interview study of switching managers'],
  'Exploiting Leakage in Password Managers': ['PWMANAGER', '', 'injection attacks against managers'],
  'Master-Password-Protected Password Management': ['PWMANAGER', '', 'protocol analysis of manager sync'],
  'Zero Knowledge (About) Encryption': ['PWMANAGER', '', 'cryptographic analysis of three cloud password managers'],
  'Vault Raider': ['PWMANAGER', '', 'desktop UI attacks against managers'],
  'Phishing Attacks against Password Manager Browser Extensions': ['PWMANAGER', '', 'attacks on manager extensions; extension measurement is privacy:browser_extensions'],
  'They Would do Better if They Worked Together': ['PWMANAGER', '', 'tests 15 manager extensions against 39 minimal examples; the unit is the manager, not a site population'],
 
  // ---------------- OUT: libraries, SDKs, frameworks, protocol models ----------------
  'On Breaking SAML': ['LIB', '', 'XML-signature-wrapping attacks against 14 SAML frameworks; the unit is the framework'],
  'Explicating SDKs': ['LIB', '', 'formal models of three authentication SDKs plus applications the authors picked'],
  'Vetting Single Sign-On SDK Implementations': ['LIB', '', 'symbolic execution of ten SSO SDKs'],
  'Cerberus': ['LIB', '', 'static analysis of 22 open-source OAuth server libraries'],
  'AuthSaber': ['LIB', '', 'program verification of 15 OpenID Connect libraries'],
  'A Formal Analysis of the FIDO UAF Protocol': ['LIB', '', 'ProVerif model plus Android app analysis; the unit is the protocol and the app'],
  'URL-based Authentication Bypass': ['LIB', '', 'static scan of 529 Java web applications; source code, not deployments'],
  'AUTHSCOPE': ['LIB', '', 'mutates authorization fields in 4,838 Android apps’ backends; mobile app-server pairs'],
 
  // ---------------- OUT: an attack, or a flaw hunt without population incidence ----------------
  'Signing Me onto Your Accounts': ['ATTACK', '', 'eight logic flaws found in a handful of high-profile IdPs and RPs; foundational, but no measured population'],
  'Clickjacking: Attacks and Defenses': ['ATTACK', '', 'OAuth appears as one attack scenario in Mechanical Turk experiments'],
  'OAuth Demystified': ['ATTACK', '', 'OAuth flaws in 600 Android apps; mobile, and the unit is the app'],
  'oauth access token abuse by collusion networks': ['ATTACK', '', 'measures an abuse ecosystem that consumes OAuth tokens, not the deployment of OAuth'],
  'Breaching Security Keys without Root': ['ATTACK', '', 'overlay deception against FIDO2 authenticators on Android'],
  'Password Reset MitM': ['ATTACK', '', 'an attack on reset flows, with a small hand-picked set of services and a participant study'],
  'missing authentication vulnerabilities in the wild': ['ATTACK', '', 'IPv4-wide scan for services with no authentication at all; network services, not web login (security:web_vulnerabilities territory)'],
  '403 Forbidden?': ['ATTACK', '', 'broken access control after login on 100 sites; authorization rather than authentication'],
  'Cross-Origin State Inference': ['ATTACK', '', 'XS-Leaks that reveal login state; the deployment measured is the leak, not the login'],
  'ALPACA': ['ATTACK', '', 'TLS application-layer protocol confusion'],
  'STEK Sharing is Not Caring': ['ATTACK', '', 'TLS session-ticket key sharing; transport, not web login'],
  'Breaking Authentication in DTLS-SRTP': ['ATTACK', '', 'WebRTC media-path authentication'],
  'When HTTPS Meets CDN': ['ATTACK', '', 'certificate delegation between site and CDN; security:tls_certificates territory'],
  'Automated detection of session fixation': ['ATTACK', '', 'a detection technique evaluated on applications the authors chose'],
  'SessionJuggler': ['SYSTEM', '', 'a login-from-untrusted-terminal system, not a measurement'],
  'Unexpected Dangers of Dynamic JavaScript': ['ATTACK', '', 'script-based data exfiltration; privacy:javascript territory'],
  'Malicious CAPTCHA Attack': ['ATTACK', '', 'a CAPTCHA-based attack, not authentication deployment'],
  'Messy States of Wiring': ['ATTACK', '', 'payment-system integration flaws'],
  'Hijackers Guide To The Galaxy': ['ATTACK', '', 'off-path resource hijacking; network layer'],
  'Fashion Faux Pas': ['ATTACK', '', 'fingerprinting evasion; privacy:fingerprinting territory'],
  'Cached and Confused': ['ATTACK', '', 'web cache deception; the auth match is incidental'],
 
  // ---------------- OUT: a system or defence the authors built ----------------
  'Sound-Proof': ['SYSTEM', '', 'a proposed second factor, evaluated in the lab'],
  'SWAT': ['SYSTEM', '', 'a proposed canvas-based authentication scheme'],
  'Let’s Authenticate': ['SYSTEM', '', 'a proposed certificate-based user authentication system'],
  'WPSE': ['SYSTEM', '', 'a browser-side defence; the authors state their Alexa 100k crawl "is not meant to provide a comprehensive coverage of the deployment of OAuth 2.0" — its IdP counts are cited on the page as a by-product, not as a census'],
  'Detecting Compromise of Passkey Storage': ['SYSTEM', '', 'a detection scheme for cloud passkey stores, simulation only'],
  'Passwords and FIDO2 Are Meant To Be Secret': ['SYSTEM', '', 'a proposed secure channel for browsers'],
  'Secondary Authentication Factor Manager': ['SYSTEM', '', 'a prototype manager; the nine-site audit is background for the design'],
  'Quite a mess in my cookie jar': ['SYSTEM', '', 'a classifier for authentication cookies validated on 70 sites; an instrument owned by programming:registration, cited on the page as a method'],
  'Tripwire': ['SYSTEM', '', 'honey accounts registered to detect site compromise; the object is breach detection'],
  'Detecting Structurally Anomalous Logins': ['SYSTEM', '', 'enterprise login-graph anomaly detection on internal logs'],
 
  // ---------------- OUT: the object is what people think or do ----------------
  'horrible key ring thing': ['USER', '', 'interviews with 21 UK banking customers'],
  'If HTTPS Were Secure': ['USER', '', 'mental-model interviews; 2FA appears only in a participant quote'],
  'FIDO2 Biometric WebAuthn': ['USER', '', 'three Prolific studies of misconceptions'],
  'Driving 2FA Adoption at Scale': ['USER', '', 'randomised notification experiments on Facebook users; an intervention study, not a deployment census'],
  'Is FIDO2 the Kingslayer': ['USER', '', 'comparative usability study'],
  'Why Aren\'t We Using Passkeys': ['USER', '', '32 expert interviews about deployment obstacles; cited on the page as the best evidence for why the curves are flat, but it measures no deployment'],
  'Broken Access: On the Challenges of Screen Reader': ['USER', '', 'accessibility evaluation of 12 authentication method types with six screen readers; the unit is the method, not a site population'],
  'Account Security Interfaces: Important, Unintuitive': ['USER', '', 'IPV clinic transcripts plus interface tests on four services; below the 10-service floor'],
  'Authentication Melee': ['USER', '', 'usability comparison of seven authentication schemes on a mock site; the unit is the scheme'],
  'Should I Worry?': ['USER', '', 'cross-cultural survey of incident response'],
  'Make Them Change it Every Week': ['USER', '', 'qualitative analysis of developer advice online'],
  'Third-Party Application Access for Google Accounts': ['USER', '', 'perception study of OAuth third-party access'],
  'Moving Beyond Set-It-And-Forget-It': ['USER', '', 'social-media privacy settings study'],
  'Phishing Susceptibility and the (In-)Effectiveness': ['USER', '', 'phishing-intervention field study in a hospital'],
  'Hidden in Plain Bytes': ['USER', '', 'interpersonal account compromise investigated through data exports'],
 
  // ---------------- OUT: abuse, fraud and account markets ----------------
  'Dissecting one click frauds': ['ABUSE', '', 'one-click fraud sites in Japan'],
  '@spam': ['ABUSE', '', 'Twitter spam accounts'],
  'Re: CAPTCHAs': ['ABUSE', '', 'CAPTCHA-solving services as a market'],
  'Dialing Back Abuse on Phone Verified Accounts': ['ABUSE', '', 'phone-verified account abuse at Google; the object is the abuse market'],
  'EVILCOHORT': ['ABUSE', '', 'malicious account communities'],
  'Towards Detecting Anomalous User Behavior': ['ABUSE', '', 'OSN behaviour anomaly detection'],
  'Man vs. Machine': ['ABUSE', '', 'crowdsourced abuse workers'],
  'An Army of Me': ['ABUSE', '', 'sockpuppets in discussion communities'],
  'Fifteen minutes of unwanted fame': ['ABUSE', '', 'detects and characterises doxing posts; matched on an incidental account mention'],
  'Hack for Hire': ['ABUSE', '', 'the account-hijacking services market'],
  'Stealthy Porn': ['ABUSE', '', 'illicit promotion imagery'],
  'Into the Deep Web': ['ABUSE', '', 'e-commerce fraud interviews with criminals'],
  'Sunrise to Sunset': ['ABUSE', '', 'phishing lifecycle; security:phishing territory'],
  'Behind the Tube': ['ABUSE', '', 'YouTube monetisation abuse'],
  'Ban Evasion': ['ABUSE', '', 'ban evasion on Wikipedia'],
  'TxPhishScope': ['ABUSE', '', 'Ethereum transaction phishing'],
  'Photography-based Multi-Feature Sybil Detection': ['ABUSE', '', 'Sybil detection from photo metadata'],
  'Buy and Sale of Social Media Accounts': ['ABUSE', '', 'account resale markets'],
  'Chameleon Channels': ['ABUSE', '', 'repurposed YouTube channels'],
  'Analyzing the AI Nudification': ['ABUSE', '', 'nudification app ecosystem'],
  'Doppelgänger Finder': ['ABUSE', '', 'stylometry on underground forums'],
  'role of web hosting providers': ['ABUSE', '', 'compromised-site remediation by hosters'],
  'Traveling the silk road': ['ABUSE', '', 'marketplace measurement'],
  'Understanding the Dark Side of Domain Parking': ['ABUSE', '', 'parked-domain monetisation chains; matched on the parking services’ account plumbing'],
  'Automated Detection of Automated Traffic': ['ABUSE', '', 'bot detection at an operator; programming:crawler_detection territory'],
  'Phishing Attacks on Modern Android': ['ABUSE', '', 'mobile UI phishing that harvests credentials; the unit is the Android app, not a web deployment'],
 
  // ---------------- OUT: another page on this wiki owns it ----------------
  'Exploiting TLS Client Authentication': ['ADJACENT', '', 'TLS client certificates as a tracking vector; privacy:fingerprinting and security:tls_certificates'],
  'XRay': ['ADJACENT', '', 'targeting transparency through account inputs; design:platforms'],
  'Checking Websites’ GDPR Consent Compliance for Marketing Emails': ['ADJACENT', '', 'newsletter consent; privacy:email_tracking and privacy:consent'],
  'Leave No Data Behind': ['ADJACENT', '', 'data erasure requests; the queued privacy:data_subject_rights page'],
  'Left or Right': ['ADJACENT', '', 'spam-filter bias; privacy:email_tracking'],
  'Warranted and Unwarranted Emails': ['ADJACENT', '', 'email classification poster'],
  'End-to-End Encrypted Cloud Storage': ['ADJACENT', '', 'cryptographic analysis of storage providers; the SoK covers its authentication angle'],
  'Swipe Left for Identity Theft': ['ADJACENT', '', 'dating-app data exposure; design:mobile_and_app_measurement'],
  'Echoes of Privacy': ['ADJACENT', '', 'voice-assistant profiling'],
  'Scraping Sticky Leftovers': ['ADJACENT', '', 'data left after account deletion; privacy:data_subject_rights'],
  'No Way to Sign Out': ['ADJACENT', '', 'app account-deletion compliance; design:mobile_and_app_measurement'],
  'Security and Privacy Failures in Popular 2FA Apps': ['ADJACENT', '', '22 Android TOTP apps; the unit is the app, so design:mobile_and_app_measurement'],
  'SMS One-Time Password Messages against Local Attackers': ['ADJACENT', '', 'Android OTP interception'],
};
 
 
// Citekeys in literature:bibliography for every paper in the population, hand-keyed by title
// substring exactly like the verdicts above. audit() throws if a population paper has no key,
// so the page cannot cite a paper the bibliography does not carry, and cannot silently drop one.
export const KEYS = {
  'devil is in the (implementation) details': 'sun2012_devil',
  'SSOScan': 'zhou2014_ssoscan',
  'Why can’t users choose their identity providers': 'corre2017_users',
  'O Single Sign-Off': 'ghasemisharif2018_sso',
  'Identity-Account Inconsistency': 'liu2021_investigation',
  'DISTINCT': 'jannett2022_distinct',
  'Everybody\'s Looking for SSOmething': 'dimova2023_ssomething',
  'Towards Automated Auditing for Account and Session Management': 'ghasemisharif2022_saat',
  'Prevalence of Single Sign-On on the Web': 'ardi2023_prevalence',
  'Only as Strong as the Weakest Link': 'innocenti2025_only',
  'Universal Cross-app Attacks': 'luo2025_universal',
  'Connecting the Dots: An Investigative Study': 'kang2026_connecting',
  'Is Real-time Phishing Eliminated with FIDO': 'ulqinaku2021_real',
  'Consistency of Two-Factor Authentication User Journeys': 'lyastani2023_systematic',
  'We\'ve Disabled MFA for You': 'klivan2023_disabled',
  'Multi-Factor and Risk-Based Authentication Availability': 'gavazzi2023_multi',
  'Phish in Sheep\'s Clothing': 'lin2022_sheep',
  'Who is Trying to Access My Account': 'wei2025_trying',
  'Was This You?': 'sahin2025_this',
  'Security Posture of Real-World FIDO2 Deployments': 'kuchhal2023_evaluating',
  'The State of Passkeys': 'jannett2026_passkeys',
  'SoK: Web Authentication and Recovery': 'blessing2025_authentication',
  'Framework for Abusability Analysis': 'daffalla2025_framework',
  'How Not to Handle Keys': 'kepkowski2022_handle',
  'Anchors of Trust': 'zhang2026_anchors',
  'Redirection Trail': 'chang2017_security',
  'Cookie Hunter': 'drakonakis2020_cookie',
  'Pre-hijacked accounts': 'sudhodanan2022_hijacked',
  'Large-Scale Measurement of Website Login Policies': 'alroomi2023_login',
  'Measuring Website Password Creation Policies': 'alroomi2023_password',
  'Double Edged Sword': 'senol2024_double',
  'Poster: Security of Login Interfaces': 'tchokodeu2024_poster',
  'QR Code-based Login': 'zhang2025_qrcode',
  'Stealing Trust': 'yan2024_stealing',
  'Survey of Account Security Interfaces': 'bhattacharya2026_asi',
  'Unmasking the Security and Usability of Password Masking': 'hu2024_unmasking',
  'One Email, Many Faces': 'wu2026_email',
  'To Auth or Not To Auth': 'rautenstrauch2024_auth',
  'Cookie Crumbles': 'squarcina2023_cookie',
  'The State of the SameSite': 'khodayari2022_state',
  'Cookies Lack Integrity': 'zheng2015_cookies',
  'Secrets, Lies, and Account Recovery': 'bonneau2015_secrets',
  'Evaluating Login Challenges': 'doerfler2019_evaluating',
  'Empirical Measurement of Systemic 2FA Usability': 'reynolds2020_systemic',
  'Gossamer': 'bohuk2022_gossamer',
};
 
// ---------------------------------------------------------------------------
// Resolve the hand map against the candidate set, and refuse to return if it drifts.
// ---------------------------------------------------------------------------
export const SUBGROUPS = ['SSO', 'MFA', 'PASSKEY', 'LOGINSURF', 'POSTLOGIN', 'OPERATOR'];
export { rows, T, PROBES, V as VERDICTS };
export const fired = (p) => Object.entries(PROBES).filter(([, f]) => f(p)).map(([k]) => k);
 
export function audit() {
  const candidates = rows.filter((p) => fired(p).length > 0);
  const bySlug = new Map();
  const unmatchedKeys = [];
  const ambiguousKeys = [];
  for (const [key, verdict] of Object.entries(V)) {
    const hits = candidates.filter((p) => (p.title ?? '').includes(key));
    if (hits.length === 0) { unmatchedKeys.push(key); continue; }
    if (hits.length > 1) { ambiguousKeys.push([key, hits.map((h) => h.title)]); continue; }
    const p = hits[0];
    if (bySlug.has(p.slug)) throw new Error(`two hand-map keys match one paper: ${p.slug}`);
    bySlug.set(p.slug, { key, verdict, p });
  }
  const unjudged = candidates.filter((p) => !bySlug.has(p.slug));
  const IN = [...bySlug.values()].filter((x) => x.verdict[0] === 'IN');
  const keyEntries = Object.entries(KEYS);
  const usedKeys = new Set();
  for (const x of IN) {
    const hit = keyEntries.filter(([sub]) => (x.p.title ?? '').includes(sub));
    if (hit.length === 1) { x.citekey = hit[0][1]; usedKeys.add(hit[0][0]); }
    else x.citekey = null;
  }
 
  const problems = [];
  if (unmatchedKeys.length) problems.push(`hand-map keys matching no candidate: ${unmatchedKeys.join(' | ')}`);
  if (ambiguousKeys.length) problems.push(`ambiguous hand-map keys: ${ambiguousKeys.map(([k]) => k).join(' | ')}`);
  if (unjudged.length) problems.push(`candidates without a verdict: ${unjudged.map((p) => p.slug).join(' | ')}`);
  if (bySlug.size !== candidates.length) problems.push(`judged ${bySlug.size} of ${candidates.length} candidates`);
  for (const x of IN) if (!SUBGROUPS.includes(x.verdict[1])) problems.push(`IN paper with no subgroup: ${x.p.slug}`);
  for (const x of IN) if (!x.citekey) problems.push(`population paper with no citekey (or an ambiguous one): ${x.p.slug}`);
  const dupKeys = IN.map((x) => x.citekey).filter((k, i, a) => a.indexOf(k) !== i);
  if (dupKeys.length) problems.push(`one citekey used for two population papers: ${[...new Set(dupKeys)].join(' ')}`);
  for (const [sub] of keyEntries) if (!usedKeys.has(sub)) problems.push(`KEYS entry matching no population paper: ${sub}`);
  for (const x of bySlug.values()) if (x.verdict[0] !== 'IN' && x.verdict[1] !== '') problems.push(`OUT paper carrying a subgroup: ${x.p.slug}`);
  for (const x of bySlug.values()) if (!x.verdict[2] || x.verdict[2].length < 20) problems.push(`verdict reason too short to be a reason: ${x.p.slug}`);
  const reasons = [...bySlug.values()].map((x) => x.verdict[2]);
  if (new Set(reasons).size !== reasons.length) {
    const dup = reasons.filter((r, i) => reasons.indexOf(r) !== i);
    problems.push(`repeated verdict reason (a canned reason is not evidence): ${[...new Set(dup)].join(' / ')}`);
  }
  if (problems.length) {
    for (const p of problems) console.error(`AUDIT ASSERTION FAILED: ${p}`);
    throw new Error(`${problems.length} audit assertion(s) failed; refusing to return a population`);
  }
  return { candidates, bySlug, IN };
}

The audit report, including the numbers that answer the roadmap gate.

auth_audit.mjs

// security:authentication — prints the candidate audit behind the page's population.
//
// The roadmap queued this page with "46 papers unaudited" from a single title+summary probe
// (auth_tight in scripts/gap_probe2.mjs) and gated writing it on this audit. This script is
// that audit's report; the probes, the inclusion rule, the per-paper verdicts and the
// assertions live in scripts/auth_pop.mjs, which every consumer imports so a verdict cannot
// be true for one script and false for another.
//
// Usage: node scripts/auth_audit.mjs [--csv]
 
import { rows, PROBES, SUBGROUPS, audit } from './auth_pop.mjs';
 
const { candidates, bySlug, IN } = audit();
 
console.log('=== security:authentication — candidate audit ===');
console.log(`corpus: ${rows.length} extracted papers (data/extract/run1)`);
console.log('');
console.log('probe                  candidates  web-platform');
for (const [name, f] of Object.entries(PROBES)) {
  const h = rows.filter(f);
  console.log(`${name.padEnd(22)} ${String(h.length).padStart(10)}  ${String(h.filter((p) => p.platforms.includes('web')).length).padStart(12)}`);
}
console.log(`${'UNION (candidates)'.padEnd(22)} ${String(candidates.length).padStart(10)}  ${String(candidates.filter((p) => p.platforms.includes('web')).length).padStart(12)}`);
console.log('');
 
const byCode = new Map();
for (const { verdict } of bySlug.values()) byCode.set(verdict[0], (byCode.get(verdict[0]) ?? 0) + 1);
console.log('verdict        papers   share of candidates');
[...byCode.entries()].sort((a, b) => b[1] - a[1]).forEach(([c, n]) =>
  console.log(`${c.padEnd(14)} ${String(n).padStart(6)}   ${((n / candidates.length) * 100).toFixed(1)}%`));
 
console.log('');
console.log(`POPULATION: ${IN.length} papers of ${candidates.length} candidates (${((IN.length / candidates.length) * 100).toFixed(1)}%); ${candidates.length - IN.length} excluded`);
console.log('');
console.log('subgroup      papers');
const byGrp = new Map();
for (const x of IN) byGrp.set(x.verdict[1], (byGrp.get(x.verdict[1]) ?? 0) + 1);
for (const g of SUBGROUPS) console.log(`${g.padEnd(13)} ${String(byGrp.get(g) ?? 0).padStart(6)}`);
// The roadmap's gate was stated against the tight probe's own 46 candidates, so the numbers
// that answer it are printed here rather than derived by hand on three different pages.
const branded = IN.filter((x) => ['SSO', 'MFA', 'PASSKEY'].includes(x.verdict[1]));
const tightCands = [...bySlug.values()].filter((x) => PROBES.tight(x.p));
const tightIn = tightCands.filter((x) => x.verdict[0] === 'IN');
console.log(`\nthe roadmap's gate was ~20 papers measuring deployment, counted against the tight probe's 46:`);
console.log(`  tight-probe candidates: ${tightCands.length}; of those IN the population: ${tightIn.length}`);
console.log(`  branded-mechanism slice (SSO + MFA + PASSKEY): ${branded.length}; of those caught by the tight probe: ${branded.filter((x) => PROBES.tight(x.p)).length}`);
console.log(`  whole population as scoped here: ${IN.length}`);
 
console.log('');
console.log('population by year (2025-2026 are provisional venue-years, see literature:corpus)');
const yr = new Map();
for (const x of IN) yr.set(x.p.year, (yr.get(x.p.year) ?? 0) + 1);
[...yr.entries()].sort().forEach(([y, n]) => console.log(`  ${y}  ${'#'.repeat(n)} ${n}`));
console.log('population by venue');
const vn = new Map();
for (const x of IN) vn.set(x.p.venue, (vn.get(x.p.venue) ?? 0) + 1);
[...vn.entries()].sort((a, b) => b[1] - a[1]).forEach(([v, n]) => console.log(`  ${v.padEnd(8)} ${n}`));
console.log('population by platform label');
const pl = new Map();
for (const x of IN) for (const t of x.p.platforms) pl.set(t, (pl.get(t) ?? 0) + 1);
[...pl.entries()].sort((a, b) => b[1] - a[1]).forEach(([v, n]) => console.log(`  ${v.padEnd(22)} ${n}`));
 
console.log('');
console.log('--- the population, by subgroup, with the reason each paper is in it ---');
for (const g of SUBGROUPS) {
  console.log(`\n[${g}]`);
  IN.filter((x) => x.verdict[1] === g).sort((a, b) => a.p.year - b.p.year)
    .forEach((x) => console.log(`  ${x.p.year} ${x.p.venue.padEnd(8)} ${x.p.title}\n      ${x.verdict[2]}`));
}
 
console.log('\n--- excluded, with the reason per paper ---');
for (const code of [...byCode.keys()].filter((c) => c !== 'IN').sort()) {
  console.log(`\n[${code}] ${byCode.get(code)} papers`);
  [...bySlug.values()].filter((x) => x.verdict[0] === code).sort((a, b) => a.p.year - b.p.year)
    .forEach((x) => console.log(`  ${x.p.year} ${x.p.venue.padEnd(8)} ${x.p.title}\n      ${x.verdict[2]}`));
}
 
console.log(`\nASSERTIONS PASSED: ${candidates.length} candidates, all judged; ${IN.length} in population; every verdict reason distinct.`);
 
if (process.argv.includes('--csv')) {
  console.log('\nslug,year,venue,code,subgroup');
  for (const x of bySlug.values()) console.log(`${x.p.slug},${x.p.year},${x.p.venue},${x.verdict[0]},${x.verdict[1]}`);
}

Unedited output of the audit, including every verdict with its own reason.

auth_audit-output.txt

=== security:authentication — candidate audit ===
corpus: 5859 extracted papers (data/extract/run1)
 
probe                  candidates  web-platform
tight                          46            37
mechanism                      68            42
authnweb                       50            50
accountweb                     57            57
recall                         11             7
UNION (candidates)            184           147
 
verdict        papers   share of candidates
IN                 45   24.5%
ABUSE              26   14.1%
ATTACK             20   10.9%
ADJACENT           18   9.8%
USER               16   8.7%
PASSWORD           15   8.2%
PWMANAGER          13   7.1%
SYSTEM             12   6.5%
HOMONYM            11   6.0%
LIB                 8   4.3%
 
POPULATION: 45 papers of 184 candidates (24.5%); 139 excluded
 
subgroup      papers
SSO               12
MFA                7
PASSKEY            6
LOGINSURF         12
POSTLOGIN          4
OPERATOR           4
 
the roadmap's gate was ~20 papers measuring deployment, counted against the tight probe's 46:
  tight-probe candidates: 46; of those IN the population: 22
  branded-mechanism slice (SSO + MFA + PASSKEY): 25; of those caught by the tight probe: 21
  whole population as scoped here: 45
 
population by year (2025-2026 are provisional venue-years, see literature:corpus)
  2012  # 1
  2014  # 1
  2015  ## 2
  2017  ## 2
  2018  # 1
  2019  # 1
  2020  ## 2
  2021  ## 2
  2022  ####### 7
  2023  ######### 9
  2024  ##### 5
  2025  ####### 7
  2026  ##### 5
population by venue
  USENIX   16
  CCS      9
  NDSS     6
  WWW      5
  PETS     4
  IEEE-SP  4
  IMC      1
population by platform label
  web                    42
  other-online-service   11
  mobile                 9
  offline                3
  iot                    1
 
--- the population, by subgroup, with the reason each paper is in it ---
 
[SSO]
  2012 CCS      The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems.
      black-box tested 96 Facebook-login relying parties from Google’s top-1,000 list and reports per-RP flaw incidence
  2014 USENIX   SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities
      crawled 20,000 Quantcast sites for Facebook SSO integration and five flaw classes; reports SSO prevalence and enrolment success rates
  2017 PETS     Why can’t users choose their identity providers on the web?
      manual audit of Alexa top 500 classifying which identity providers each relying party accepts
  2018 USENIX   O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On Account Hijacking and Session Management on the Web
      Alexa 1M crawl for SSO adoption per identity provider, plus session-management audit of relying parties
  2021 WWW      An Investigation of Identity-Account Inconsistency in Single Sign-On.
      tested SSO account binding on 100 of the Alexa top 1,000 plus Fortune-1000 and university identity policies
  2022 CCS      DISTINCT: Identity Theft using In-Browser Communications in Dual-Window Single Sign-On.
      instrumented crawl of Tranco top 1,000 measuring dual-window SSO flows and in-browser message handling per site
  2022 IEEE-SP  Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments.
      automated audit of Facebook-SSO relying parties drawn from Majestic 100k for registration, revocation and session practices
  2023 PETS     Everybody's Looking for SSOmething: A large-scale evaluation on the privacy of OAuth authentication on the web
      CrUX 100k crawl measuring OAuth adoption and requested scopes per site
  2023 IMC      The Prevalence of Single Sign-On on the Web: Towards the Next Generation of Web Content Measurement.
      live crawls of CrUX top 1k/10k measuring login and third-party SSO prevalence with DOM and logo detection
  2025 IEEE-SP  "Only as Strong as the Weakest Link": On the Security of Brokered Single Sign-On on the Web.
      measures brokered-SSO prevalence from a Tranco-derived SSO traffic dataset and audits the brokers found
  2025 USENIX   Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms
      black-box tested OAuth 2.0 configuration across 18 integration platforms and reports per-platform incidence; population is platforms, not websites
  2026 NDSS     Connecting the Dots: An Investigative Study on Linking Private User Data Across Messaging Apps
      built 85,053 authentication webpages from Korean login-path keywords and measured KakaoTalk account-linking integration on 14,102 of them
 
[MFA]
  2021 USENIX   Is Real-time Phishing Eliminated with FIDO? Social Engineering Downgrade Attacks against FIDO Protocols
      audited which second factors and fallbacks Alexa top-100 sites offer alongside FIDO
  2022 USENIX   Phish in Sheep's Clothing: Exploring the Authentication Pitfalls of Browser Fingerprinting
      audited which login pages fingerprint the browser as a risk signal, across an Alexa-ranked population and 300 services
  2023 NDSS     A Systematic Study of the Consistency of Two-Factor Authentication User Journeys on Top-Ranked Websites
      two coders walked the full 2FA journey on 85 popular websites and coded factor consistency per site
  2023 CCS      "We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments.
      audited MFA recovery documentation for 1,303 sites from 2fa.directory and tested recovery on 71
  2023 USENIX   A Study of Multi-Factor and Risk-Based Authentication Availability
      created accounts and audited MFA, RBA and suspicious-login response on popular websites
  2025 NDSS     ”Who is Trying to Access My Account?” Exploring User Perceptions and Reactions to Risk-based Authentication Notifications
      triggered risk-based-authentication paths on 251 websites and coded the 161 notifications they produced
  2025 NDSS     Was This You? Investigating the Design Considerations for Suspicious Login Notifications
      created accounts on Tranco top-100 sites, executed a suspicious login, and coded the 21 notification emails that arrived
 
[PASSKEY]
  2022 PETS     How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy
      crawled the Cisco Umbrella 1M for navigator.credentials WebAuthn use and found 684 records; the earliest WebAuthn census in this corpus
  2023 CCS      Evaluating the Security Posture of Real-World FIDO2 Deployments.
      audited FIDO2 configuration at Tranco top-1k relying parties and tracked the FIDO metadata service longitudinally
  2025 PETS     SoK: Web Authentication and Recovery in the Age of End-to-End Encryption
      hand-audited passkey support across an Alexa top-300 sample alongside the recovery mechanisms of 22 end-to-end-encrypted providers
  2025 USENIX   A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models
      stepped through passkey registration, portability, deletion and revocation on a Tranco 200 sample
  2026 USENIX   The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web
      continuous passkey discovery over Tranco 1M and CrUX 18M, 208 confirmed implementations hand-audited, 103 security-tested
  2026 NDSS     Anchors of Trust: A Usability Study on User Awareness, Consent, and Control in Cross-Device Authentication
      manually evaluated cross-device authentication as deployed by 27 services before the user half of the study
 
[LOGINSURF]
  2017 WWW      Security Implications of Redirection Trail in Popular Websites Worldwide.
      located login pages across Alexa top-10k and top-1M and measured HTTPS posture of the login POST; reports how many sites offer login at all
  2020 CCS      The Cookie Hunter: Automated Black-box Auditing for Web Authentication and Authorization Flaws.
      automated account creation across 1.58M Alexa domains, then audited authentication-cookie and HSTS flaws per site
  2022 USENIX   Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
      manually tested account-creation and authentication workflows on 75 popular services for five pre-hijacking classes
  2023 USENIX   A Large-Scale Measurement of Website Login Policies
      automated account creation and login on CrUX top 1M to measure login policy per site
  2023 CCS      Measuring Website Password Creation Policies At Scale.
      automated signups across Tranco-ranked domains, varying passwords to infer each site’s policy
  2024 WWW      The Double Edged Sword: Identifying Authentication Pages and their Fingerprinting Behavior.
      crawled CrUX-ranked sites to identify authentication pages and then measured fingerprinting on them
  2024 CCS      Poster: Security of Login Interfaces in Modern Organizations.
      scanned 73,431 login-page URLs belonging to 100 European companies; a poster, so treat the figures as preliminary
  2024 CCS      Stealing Trust: Unraveling Blind Message Attacks in Web3 Authentication.
      probed wallet-based Web3 login APIs at 27 sites across 29 cases; the newest login mechanism anyone in this corpus measured
  2024 CCS      Unmasking the Security and Usability of Password Masking.
      audited password-field masking as deployed on 100 CrUX top-1K domains before the participant studies
  2025 USENIX   Demystifying the (In)Security of QR Code-based Login in Real-world Deployments
      measured QR-login prevalence and workflow security across ranked websites
  2026 USENIX   Inconsistent, Incomplete, and Insecure: A Survey of Account Security Interfaces
      scripted login sessions on 100 popular services and hand-coded what each account-security interface exposes
  2026 NDSS     One Email, Many Faces: A Deep Dive into Identity Confusion in Email Aliases
      tested how 18 platforms and 28 mail providers resolve alias addresses at signup, login and recovery — identifier handling as deployed
 
[POSTLOGIN]
  2015 USENIX   Cookies Lack Integrity: Real-World Implications
      Alexa 1M crawl for the shared-domain and HSTS conditions that let an attacker inject a session cookie
  2022 IEEE-SP  The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies.
      longitudinal SameSite adoption across Alexa 500K plus breakage tests; the session-cookie hardening half of the post-login surface
  2023 USENIX   Cookie Crumbles: Breaking and Fixing Web Session Integrity
      measured cookie-prefix (__Host-/__Secure-) adoption in HTTP Archive data alongside a framework audit
  2024 IEEE-SP  To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape.
      paired authenticated and unauthenticated crawls of 200 popular sites, comparing XSS, headers, JavaScript and postMessage behind the login
 
[OPERATOR]
  2015 WWW      Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google.
      Google’s own secret-answer and recovery telemetry: recovery as deployed, measured from inside
  2019 WWW      Evaluating Login Challenges as aDefense Against Account Takeover.
      Google login and recovery traces measuring how often challenges stop hijacking and how often they stop legitimate users
  2020 USENIX   Empirical Measurement of Systemic 2FA Usability
      32M + 6M Duo 2FA log events and 17,085 support tickets from two mandatory university deployments
  2022 USENIX   Gossamer: Securely Measuring Password-based Logins
      instrumented the production login systems of two universities for 3-7 months, 34M requests
 
--- excluded, with the reason per paper ---
 
[ABUSE] 26 papers
  2010 CCS      Dissecting one click frauds.
      one-click fraud sites in Japan
  2010 CCS      @spam: the underground on 140 characters or less.
      Twitter spam accounts
  2010 USENIX   Re: CAPTCHAs—Understanding CAPTCHA-Solving Services in an Economic Context
      CAPTCHA-solving services as a market
  2013 WWW      The role of web hosting providers in detecting compromised websites.
      compromised-site remediation by hosters
  2013 WWW      Traveling the silk road: a measurement analysis of a large anonymous online marketplace.
      marketplace measurement
  2014 CCS      Dialing Back Abuse on Phone Verified Accounts.
      phone-verified account abuse at Google; the object is the abuse market
  2014 USENIX   Towards Detecting Anomalous User Behavior in Online Social Networks
      OSN behaviour anomaly detection
  2014 USENIX   Man vs. Machine: Practical Adversarial Detection of Malicious Crowdsourcing Workers
      crowdsourced abuse workers
  2014 IEEE-SP  Doppelgänger Finder: Taking Stylometry to the Underground.
      stylometry on underground forums
  2014 USENIX   Understanding the Dark Side of Domain Parking
      parked-domain monetisation chains; matched on the parking services’ account plumbing
  2015 USENIX   EVILCOHORT: Detecting Communities of Malicious Accounts on Online Services
      malicious account communities
  2017 WWW      An Army of Me: Sockpuppets in Online Discussion Communities.
      sockpuppets in discussion communities
  2017 IMC      Fifteen minutes of unwanted fame: detecting and characterizing doxing.
      detects and characterises doxing posts; matched on an incidental account mention
  2018 CCS      Phishing Attacks on Modern Android.
      mobile UI phishing that harvests credentials; the unit is the Android app, not a web deployment
  2019 WWW      Hack for Hire: Exploring the Emerging Market for Account Hijacking.
      the account-hijacking services market
  2019 IEEE-SP  Stealthy Porn: Understanding Real-World Adversarial Images for Illicit Online Promotion.
      illicit promotion imagery
  2020 NDSS     Into the Deep Web: Understanding E-commerce Fraud from Autonomous Chat with Cybercriminals
      e-commerce fraud interviews with criminals
  2020 USENIX   Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale
      phishing lifecycle; security:phishing territory
  2022 USENIX   Behind the Tube: Exploitative Monetization of Content on YouTube
      YouTube monetisation abuse
  2022 WWW      Characterizing, Detecting, and Predicting Online Ban Evasion.
      ban evasion on Wikipedia
  2022 USENIX   Automated Detection of Automated Traffic
      bot detection at an operator; programming:crawler_detection territory
  2023 CCS      TxPhishScope: Towards Detecting and Understanding Transaction-based Phishing on Ethereum.
      Ethereum transaction phishing
  2023 PETS     Detect Your Fingerprint in Your Photographs: Photography-based Multi-Feature Sybil Detection
      Sybil detection from photo metadata
  2025 IMC      Exploration of the Dynamics of Buy and Sale of Social Media Accounts.
      account resale markets
  2025 USENIX   Analyzing the AI Nudification Application Ecosystem
      nudification app ecosystem
  2026 USENIX   Chameleon Channels: Measuring YouTube Accounts Repurposed for Deception and Profit
      repurposed YouTube channels
 
[ADJACENT] 18 papers
  2014 USENIX   XRay: Enhancing the Web’s Transparency with Differential Correlation
      targeting transparency through account inputs; design:platforms
  2018 PETS     Exploiting TLS Client Authentication for Widespread User Tracking
      TLS client certificates as a tracking vector; privacy:fingerprinting and security:tls_certificates
  2020 USENIX   Shattered Chain of Trust: Understanding Security Risks in Cross-Cloud IoT Access Delegation
      OAuth-style access delegation between ten IoT clouds; the device-cloud population belongs with IoT, not web login
  2021 NDSS     On the Insecurity of SMS One-Time Password Messages against Local Attackers in Modern Mobile Devices
      Android OTP interception
  2022 USENIX   Practical Data Access Minimization in Trigger-Action Platforms
      OAuth scopes inside IFTTT rules; the unit is a trigger-action rule, not a login
  2022 USENIX   Experimental Security Analysis of the App Model in Business Collaboration Platforms
      OAuth app permissions in Slack and Teams directories; delegated authorization between apps rather than a user logging in
  2022 PETS     Checking Websites’ GDPR Consent Compliance for Marketing Emails
      newsletter consent; privacy:email_tracking and privacy:consent
  2022 PETS     Leave No Data Behind – Empirical Insights into Data Erasure from Online Services
      data erasure requests; the queued privacy:data_subject_rights page
  2022 WWW      Left or Right: A Peek into the Political Biases in Email Spam Filtering Algorithms During US Election 2020.
      spam-filter bias; privacy:email_tracking
  2022 IEEE-SP  Scraping Sticky Leftovers: App User Information Left on Servers After Account Deletion.
      data left after account deletion; privacy:data_subject_rights
  2023 USENIX   An Empirical Study & Evaluation of Modern CAPTCHAs
      inspects CAPTCHA prevalence on 200 popular sites, but a bot challenge guards many flows and is not a claim about an identity; programming:registration owns CAPTCHA and this page points there
  2023 USENIX   Back to School: On the (In)Security of Academic VPNs
      VPN gateway and client authentication at universities; not a browser login surface
  2023 CCS      Poster: Towards a Dataset for the Discrimination between Warranted and Unwarranted Emails.
      email classification poster
  2023 USENIX   Security and Privacy Failures in Popular 2FA Apps
      22 Android TOTP apps; the unit is the app, so design:mobile_and_app_measurement
  2024 CCS      End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem.
      cryptographic analysis of storage providers; the SoK covers its authentication angle
  2024 USENIX   Swipe Left for Identity Theft: An Analysis of User Data Privacy Risks on Location-based Dating Apps
      dating-app data exposure; design:mobile_and_app_measurement
  2025 PETS     Echoes of Privacy: Uncovering the Profiling Practices of Voice Assistants
      voice-assistant profiling
  2025 USENIX   No Way to Sign Out? Unpacking Non-Compliance with Google Play's App Account Deletion Requirements
      app account-deletion compliance; design:mobile_and_app_measurement
 
[ATTACK] 20 papers
  2010 WWW      Automated detection of session fixation vulnerabilities.
      a detection technique evaluated on applications the authors chose
  2012 IEEE-SP  Signing Me onto Your Accounts through Facebook and Google: A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services.
      eight logic flaws found in a handful of high-profile IdPs and RPs; foundational, but no measured population
  2012 USENIX   Clickjacking: Attacks and Defenses
      OAuth appears as one attack scenario in Mechanical Turk experiments
  2014 CCS      OAuth Demystified for Mobile Application Developers.
      OAuth flaws in 600 Android apps; mobile, and the unit is the app
  2014 IEEE-SP  When HTTPS Meets CDN: A Case of Authentication in Delegated Service.
      certificate delegation between site and CDN; security:tls_certificates territory
  2015 USENIX   The Unexpected Dangers of Dynamic JavaScript
      script-based data exfiltration; privacy:javascript territory
  2016 WWW      Tell Me About Yourself: The Malicious CAPTCHA Attack.
      a CAPTCHA-based attack, not authentication deployment
  2017 IMC      Measuring and mitigating oauth access token abuse by collusion networks.
      measures an abuse ecosystem that consumes OAuth tokens, not the deployment of OAuth
  2017 IEEE-SP  The Password Reset MitM Attack.
      an attack on reset flows, with a small hand-picked set of services and a participant study
  2020 NDSS     Cross-Origin State Inference (COSI) Attacks: Leaking Web Site States through XS-Leaks
      XS-Leaks that reveal login state; the deployment measured is the leak, not the login
  2020 USENIX   Cached and Confused: Web Cache Deception in the Wild
      web cache deception; the auth match is incidental
  2021 USENIX   ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating Cracks in TLS Authentication
      TLS application-layer protocol confusion
  2021 USENIX   Messy States of Wiring: Vulnerabilities in Emerging Personal Payment Systems
      payment-system integration flaws
  2021 USENIX   The Hijackers Guide To The Galaxy: Off-Path Taking Over Internet Resources
      off-path resource hijacking; network layer
  2022 IMC      No keys to the kingdom required: a comprehensive investigation of missing authentication vulnerabilities in the wild.
      IPv4-wide scan for services with no authentication at all; network services, not web login (security:web_vulnerabilities territory)
  2023 IEEE-SP  Fashion Faux Pas: Implicit Stylistic Fingerprints for Bypassing Browsers' Anti-Fingerprinting Defenses.
      fingerprinting evasion; privacy:fingerprinting territory
  2024 CCS      Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays exploiting Limited Display Authenticators.
      overlay deception against FIDO2 authenticators on Android
  2025 IEEE-SP  403 Forbidden? Ethically Evaluating Broken Access Control in the Wild.
      broken access control after login on 100 sites; authorization rather than authentication
  2025 USENIX   STEK Sharing is Not Caring: Bypassing TLS Authentication in Web Servers using Session Tickets
      TLS session-ticket key sharing; transport, not web login
  2026 USENIX   Analyzing the WebRTC Ecosystem and Breaking Authentication in DTLS-SRTP
      WebRTC media-path authentication
 
[HOMONYM] 11 papers
  2011 CCS      Fashion crimes: trending-term exploitation on the web.
      MFA here is "Made for AdSense", the paper’s own expansion; it is a search-spam measurement
  2020 IMC      On Measuring RPKI Relying Parties.
      a relying party in RPKI is a route-origin validator, not an SSO relying party
  2022 CCS      Behind the Scenes of RPKI.
      measures RPKI relying-party software deployment among network operators, a different relying party entirely
  2022 CCS      Poster: RPKI Kill Switch.
      poster on RPKI validator failure modes; the relying party is a route validator
  2022 USENIX   Stalloris: RPKI Downgrade Attack
      RPKI relying-party downgrade attack, not web login
  2023 WWW      HybridEval: A Human-AI Collaborative Approach for Evaluating Design Ideas at Scale.
      the OpenID match is inside "OpenIDEO", the design-idea platform the paper samples from
  2023 WWW      EmpMFF: A Multi-factor Sequence Fusion Framework for Empathetic Response Generation.
      "multi-factor" is a sequence-fusion architecture for empathetic response generation
  2024 IEEE-SP  Signing in Four Public Software Package Registries: Quantity, Quality, and Influencing Factors.
      "signing" is package signing in PyPI/Maven/Docker Hub/Hugging Face, not signing in
  2024 IMC      Watching TV with the Second-Party: A First Look at Automatic Content Recognition Tracking in Smart TVs.
      matched on an incidental "sign-in" in a smart-TV ACR tracking study; Connected TV is its own roadmap item
  2025 CCS      Poster: Exploring the Landscape of RPKI Relying Parties.
      surveys which RPKI validator implementations operators run; nothing to do with web login
  2025 PETS     Sheep's clothing, wolfish intent: Automated detection and evaluation of problematic 'allowed' advertisements
      matched on "authenticat" inside an ad-review study; the object is problematic advertisements
 
[LIB] 8 papers
  2012 USENIX   On Breaking SAML: Be Whoever You Want to Be
      XML-signature-wrapping attacks against 14 SAML frameworks; the unit is the framework
  2013 USENIX   Explicating SDKs:  Uncovering Assumptions Underlying Secure Authentication and Authorization
      formal models of three authentication SDKs plus applications the authors picked
  2017 CCS      AUTHSCOPE: Towards Automatic Discovery of Vulnerable Authorizations in Online Services.
      mutates authorization fields in 4,838 Android apps’ backends; mobile app-server pairs
  2018 USENIX   Vetting Single Sign-On SDK Implementations via Symbolic Reasoning
      symbolic execution of ten SSO SDKs
  2021 NDSS     A Formal Analysis of the FIDO UAF Protocol
      ProVerif model plus Android app analysis; the unit is the protocol and the app
  2022 CCS      Cerberus: Query-driven Scalable Vulnerability Detection in OAuth Service Provider Implementations.
      static analysis of 22 open-source OAuth server libraries
  2024 CCS      AuthSaber: Automated Safety Verification of OpenID Connect Programs.
      program verification of 15 OpenID Connect libraries
  2025 CCS      Be Aware of What You Let Pass: Demystifying URL-based Authentication Bypass Vulnerability in Java Web Applications.
      static scan of 529 Java web applications; source code, not deployments
 
[PASSWORD] 15 papers
  2012 IEEE-SP  The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords.
      70M-password corpus analysis; no deployment measured
  2012 USENIX   Neuroscience Meets Cryptography: Designing Crypto Primitives Secure Against Rubber Hose Attacks
      implicit-learning authentication primitive, lab only
  2013 CCS      Measuring password guessability for an entire university.
      the university SSO system is only where the 42,563 passwords came from; the object is guessability
  2013 WWW      Security implications of password discretization for click-based graphical passwords.
      graphical-password scheme analysis
  2013 USENIX   On the Security of Picture Gesture Authentication
      Windows 8 picture-password scheme security
  2014 USENIX   Towards Reliable Storage of 56-bit Secrets in Human Memory
      human memory for secrets; a lab study
  2015 NDSS     Passwords Are Not Always Stronger on the Other Side of the Fence
      password strength across sites of different value, not what those sites deploy
  2015 NDSS     Multiple-Password Interference in the GeoPass User Authentication Scheme
      lab study of a geographic password scheme
  2018 USENIX   Forgetting of Passwords: Ecological Theory and Data
      memory model of password recall
  2019 IEEE-SP  Beyond Credential Stuffing: Password Similarity Models Using Neural Networks.
      password-similarity models; the population is leaked credentials
  2019 USENIX   Protecting accounts from credential stuffing with password breach alerting
      a breach-alerting protocol and its Chrome deployment, not a measurement of others’ deployments
  2020 IEEE-SP  Gesture Authentication for Smartphones: Evaluation of Gesture Password Selection Policies.
      gesture-password selection policies on phones
  2021 CCS      Don't Forget the Stuffing! Revisiting the Security Impact of Typo-Tolerant Password Authentication.
      security impact of typo-tolerant checking, evaluated on leaked password sets
  2023 USENIX   Araña: Discovering and Characterizing Password Guessing Attacks in Practice
      characterises guessing attacks seen by two universities; the object is the attack traffic, not the deployment
  2024 IEEE-SP  PassREfinder: Credential Stuffing Risk Prediction by Representing Password Reuse between Websites on a Graph.
      predicts credential-stuffing risk from password reuse; no authentication deployment measured
 
[PWMANAGER] 13 papers
  2014 USENIX   The Emperor’s New Password Manager: Security Analysis of Web-based Password Managers
      security analysis of five web password managers; the object is the manager
  2014 USENIX   Password Managers: Attacks and Defenses
      browser password-manager autofill attacks
  2019 CCS      "I don't see why I would ever want to use it": Analyzing the Usability of Popular Smartphone Password Managers.
      usability of mobile password managers
  2020 USENIX   That Was Then, This Is Now: A Security Evaluation of Password Generation, Storage, and Autofill in Browser-Based Password Managers
      password-manager generation/storage/autofill evaluation
  2021 USENIX   Why Older Adults (Don't) Use Password Managers
      interview study of adoption
  2021 IEEE-SP  They Would do Better if They Worked Together: The Case of Interaction Problems Between Password Managers and Websites.
      tests 15 manager extensions against 39 minimal examples; the unit is the manager, not a site population
  2022 USENIX   Why Users (Don't) Use Password Managers at a Large Educational Institution
      survey of adoption inside one institution
  2023 CCS      "I just stopped using one and started using the other": Motivations, Techniques, and Challenges When Switching Password Managers.
      interview study of switching managers
  2024 USENIX   Exploiting Leakage in Password Managers via Injection Attacks
      injection attacks against managers
  2025 IEEE-SP  Security Analysis of Master-Password-Protected Password Management Protocols.
      protocol analysis of manager sync
  2025 USENIX   Phishing Attacks against Password Manager Browser Extensions
      attacks on manager extensions; extension measurement is privacy:browser_extensions
  2026 USENIX   Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers
      cryptographic analysis of three cloud password managers
  2026 NDSS     Vault Raider: Stealthy UI-based Attacks Against Password Managers in Desktop Environments
      desktop UI attacks against managers
 
[SYSTEM] 12 papers
  2012 WWW      SessionJuggler: secure web login from an untrusted terminal using session hijacking.
      a login-from-untrusted-terminal system, not a measurement
  2014 WWW      Quite a mess in my cookie jar!: leveraging machine learning to protect web authentication.
      a classifier for authentication cookies validated on 70 sites; an instrument owned by programming:registration, cited on the page as a method
  2015 PETS     Toward Mending Two Nation-Scale Brokered Identification Systems
      privacy analysis and redesign of the GOV.UK Verify and Connect.gov hub designs; the extraction labels it simulation-or-theory-only with no measured population
  2015 USENIX   Sound-Proof: Usable Two-Factor Authentication Based on Ambient Sound
      a proposed second factor, evaluated in the lab
  2017 IMC      Tripwire: inferring internet site compromise.
      honey accounts registered to detect site compromise; the object is breach detection
  2017 CCS      Detecting Structurally Anomalous Logins Within Enterprise Networks.
      enterprise login-graph anomaly detection on internal logs
  2018 USENIX   WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring
      a browser-side defence; the authors state their Alexa 100k crawl "is not meant to provide a comprehensive coverage of the deployment of OAuth 2.0" — its IdP counts are cited on the page as a by-product, not as a census
  2019 WWW      SWAT: Seamless Web Authentication Technology.
      a proposed canvas-based authentication scheme
  2022 NDSS     Let’s Authenticate: Automated Certificates for User Authentication
      a proposed certificate-based user authentication system
  2023 USENIX   "If I could do this, I feel anyone could:" The Design and Evaluation of a Secondary Authentication Factor Manager
      a prototype manager; the nine-site audit is background for the design
  2025 USENIX   Detecting Compromise of Passkey Storage on the Cloud
      a detection scheme for cloud passkey stores, simulation only
  2025 CCS      Passwords and FIDO2 Are Meant To Be Secret: A Practical Secure Authentication Channel for Web Browsers.
      a proposed secure channel for browsers
 
[USER] 16 papers
  2015 NDSS     “They brought in the horrible key ring thing!” Analysing the Usability of Two-Factor Authentication in UK Online Banking
      interviews with 21 UK banking customers
  2015 WWW      Authentication Melee: A Usability Analysis of Seven Web Authentication Systems.
      usability comparison of seven authentication schemes on a mock site; the unit is the scheme
  2019 IEEE-SP  "If HTTPS Were Secure, I Wouldn't Need 2FA" - End User and Administrator Mental Models of HTTPS.
      mental-model interviews; 2FA appears only in a participant quote
  2019 IEEE-SP  "Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response.
      cross-cultural survey of incident response
  2019 CCS      Moving Beyond Set-It-And-Forget-It Privacy Settings on Social Media.
      social-media privacy settings study
  2020 IEEE-SP  Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication.
      comparative usability study
  2021 USENIX   "It's Stored, Hopefully, on an Encrypted Server'': Mitigating Users' Misconceptions About FIDO2 Biometric WebAuthn
      three Prolific studies of misconceptions
  2021 USENIX   Driving 2FA Adoption at Scale: Optimizing Two-Factor Authentication Notification Design Patterns
      randomised notification experiments on Facebook users; an intervention study, not a deployment census
  2022 USENIX   Security and Privacy Perceptions of Third-Party Application Access for Google Accounts
      perception study of OAuth third-party access
  2023 IEEE-SP  Investigating the Password Policy Practices of Website Administrators.
      surveys and interviews 11 administrators about the policies they chose; the deployed policy itself is measured by the two Al Roomi crawls
  2023 USENIX   Account Security Interfaces: Important, Unintuitive, and Untrustworthy
      IPV clinic transcripts plus interface tests on four services; below the 10-service floor
  2023 CCS      "Make Them Change it Every Week!": A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication.
      qualitative analysis of developer advice online
  2024 USENIX   Why Aren't We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication
      32 expert interviews about deployment obstacles; cited on the page as the best evidence for why the curves are flat, but it measures no deployment
  2025 WWW      Broken Access: On the Challenges of Screen Reader Assisted Two-Factor and Passwordless Authentication.
      accessibility evaluation of 12 authentication method types with six screen readers; the unit is the method, not a site population
  2025 CCS      Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital.
      phishing-intervention field study in a hospital
  2025 CCS      Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data Exports.
      interpersonal account compromise investigated through data exports
 
ASSERTIONS PASSED: 184 candidates, all judged; 45 in population; every verdict reason distinct.

Every figure on the page, with its denominator, plus the 45-paper table generator.

auth_report.mjs

// security:authentication — every figure the page publishes, with its denominator.
//
// Population: the 45 papers whose verdict is IN in scripts/auth_pop.mjs (the hand audit of
// 184 candidates). Counts are of PAPERS. Sentinels (not-stated / none-mentioned) are printed
// as themselves and never folded into a stated value. Base rates for the whole corpus and for
// the 1,622 web-platform papers are printed next to any share of the population, because a
// share that matches the base rate is not a finding about this literature.
//
// Usage: node scripts/auth_report.mjs [--prevalence] [--quotes]
 
import { rows, audit, SUBGROUPS } from './auth_pop.mjs';
import { POPULATIONS, isSentinel } from './lib.mjs';
 
const { candidates, IN } = audit();
const pop = IN.map((x) => x.p);
const grp = new Map(IN.map((x) => [x.p.slug, x.verdict[1]]));
const web = rows.filter((p) => p.platforms.includes('web'));
const crawled = rows.filter(POPULATIONS.crawled);
 
const pct = (n, d) => (d === 0 ? 'n/a' : `${((n / d) * 100).toFixed(1)}%`);
const h = (s) => console.log(`\n===== ${s} =====`);
 
console.log('security:authentication — report');
console.log(`corpus: ${rows.length} extracted papers, 7 venues, 2010-2026 (data/extract/run1)`);
console.log(`candidates from five probes: ${candidates.length}`);
console.log(`POPULATION (hand audit, inclusion rule in scripts/auth_pop.mjs): ${pop.length} papers`);
// Denominators have to be honest in both directions: 45/1622 would put three papers that are
// not web-platform papers over the web-platform denominator, and 45/1120 would put twenty
// papers that ran no crawl over the crawl denominator. Both numerators are subsetted first.
const popWeb = pop.filter((p) => p.platforms.includes('web'));
const popCrawled = pop.filter(POPULATIONS.crawled);
console.log(`  web-platform: ${popWeb.length} of the ${pop.length} population papers = ${pct(popWeb.length, web.length)} of the ${web.length} web-platform papers`);
console.log(`  ran a crawl:  ${popCrawled.length} of the ${pop.length} population papers = ${pct(popCrawled.length, crawled.length)} of the ${crawled.length} papers that ran a crawl`);
console.log(`  have a crawlConfig object: ${pop.filter((p) => p.crawlConfig !== null).length} of ${pop.length} (the denominator for every crawlConfig share below)`);
console.log(`  2022 or later: ${pop.filter((p) => p.year >= 2022).length} of ${pop.length}`);
 
h('1. Population shape');
console.log('subgroup      papers  first  last');
for (const g of SUBGROUPS) {
  const ps = pop.filter((p) => grp.get(p.slug) === g);
  console.log(`${g.padEnd(13)} ${String(ps.length).padStart(6)}  ${Math.min(...ps.map((p) => p.year))}   ${Math.max(...ps.map((p) => p.year))}`);
}
console.log('\nby year  (2025-2026 are provisional venue-years)');
const yr = new Map();
for (const p of pop) yr.set(p.year, (yr.get(p.year) ?? 0) + 1);
for (let y = 2010; y <= 2026; y++) console.log(`  ${y}  ${String(yr.get(y) ?? 0).padStart(2)}  ${'#'.repeat(yr.get(y) ?? 0)}`);
console.log('\nby three-year window, with the corpus-wide window size for scale');
for (const [a, b] of [[2010, 2012], [2013, 2015], [2016, 2018], [2019, 2021], [2022, 2024], [2025, 2026]]) {
  const n = pop.filter((p) => p.year >= a && p.year <= b).length;
  const c = rows.filter((p) => p.year >= a && p.year <= b).length;
  console.log(`  ${a}-${b}  ${String(n).padStart(2)} of ${String(c).padStart(4)} corpus papers  (${pct(n, c)})`);
}
console.log('\nby subgroup and three-year window — which mechanism the field was measuring when');
console.log(`${'window'.padEnd(10)} ${SUBGROUPS.map((g) => g.padStart(10)).join(' ')}`);
for (const [a, b] of [[2010, 2012], [2013, 2015], [2016, 2018], [2019, 2021], [2022, 2024], [2025, 2026]]) {
  const cells = SUBGROUPS.map((g) => String(pop.filter((p) => grp.get(p.slug) === g && p.year >= a && p.year <= b).length).padStart(10));
  console.log(`${`${a}-${b}`.padEnd(10)} ${cells.join(' ')}`);
}
console.log('\nby venue, against the venue’s own size');
const vn = new Map();
for (const p of pop) vn.set(p.venue, (vn.get(p.venue) ?? 0) + 1);
[...vn.entries()].sort((a, b) => b[1] - a[1]).forEach(([v, n]) => {
  const tot = rows.filter((p) => p.venue === v).length;
  console.log(`  ${v.padEnd(8)} ${String(n).padStart(2)} of ${String(tot).padStart(4)}  (${pct(n, tot)})`);
});
 
h('2. What the population measured — every detection tuple with a stated prevalence');
let tuples = 0, withPrev = 0;
for (const p of pop) { tuples += p.detection.length; withPrev += p.detection.filter((d) => d.prevalence).length; }
console.log(`${tuples} detection tuples across ${pop.length} papers; ${withPrev} carry a prevalence string`);
console.log(`papers with at least one prevalence: ${pop.filter((p) => p.detection.some((d) => d.prevalence)).length} of ${pop.length}`);
if (process.argv.includes('--prevalence')) {
  for (const g of SUBGROUPS) {
    console.log(`\n---------- [${g}] ----------`);
    for (const p of pop.filter((q) => grp.get(q.slug) === g).sort((a, b) => a.year - b.year)) {
      console.log(`\n${p.year} ${p.venue} — ${p.title}`);
      const ns = p.population.filter((x) => x.n).map((x) => `${x.n} ${x.unit} (${x.sourceList})`);
      console.log(`  population[]: ${ns.length ? ns.join('; ') : '(no n stated)'}`);
      for (const d of p.detection) {
        if (!d.prevalence) continue;
        console.log(`  * ${d.phenomenon} — ${d.prevalence}`);
        console.log(`      technique: ${d.technique ?? '(none)'} | metric: ${d.metric ?? '(none)'}`);
        console.log(`      quote [${d.evidence?.section ?? '?'}]: "${(d.evidence?.quote ?? '').replace(/\s+/g, ' ')}"`);
      }
    }
  }
}
 
h('3. Instruments, folded, with the unmapped residue printed');
// Fold rule: the raw tools[] strings for this population are mostly browsers and drivers under
// several spellings. Everything not matched by a rule is printed below as residue.
const TOOLFOLD = [
  [/^(google )?chrom(e|ium)( browser)?$/i, 'Chrome/Chromium'],
  [/^(mozilla )?firefox$|^geckofx$/i, 'Firefox'],
  [/^safari$/i, 'Safari'], [/^(microsoft )?edge$/i, 'Edge'], [/^brave( browser)?$/i, 'Brave'],
  [/^selenium( webdriver)?$/i, 'Selenium'],
  [/^puppeteer$|^puppeteer-extra/i, 'Puppeteer'],
  [/^(microsoft )?playwright$/i, 'Playwright'],
  [/^chrome devtools protocol$/i, 'CDP (direct)'],
  [/^(mitm ?proxy|mitmproxy)$/i, 'mitmproxy'],
  [/^openwpm$/i, 'OpenWPM'],
  [/^tracker radar collector$/i, 'Tracker Radar Collector'],
  [/^(tranco|the tranco list)$/i, 'Tranco'],
  [/^(chrome ux report|crux|google crux)/i, 'CrUX'],
  [/^alexa/i, 'Alexa'], [/^majestic/i, 'Majestic'], [/^quantcast/i, 'Quantcast'],
  [/^2fa\.?directory$|^2fa directory$/i, '2fa.directory'],
  [/^(faker|randexp)$/i, 'synthetic-identity generator'],
  [/^(twilio|wit\.ai|gmail api|google g suite)$/i, 'registration plumbing (SMS/mail/CAPTCHA)'],
  [/^consent-o-matic$/i, 'Consent-O-Matic'],
  [/^prolific$|^(amazon )?mechanical turk$/i, 'participant panel'],
];
const toolPapers = new Map(); const toolRaw = new Map();
for (const p of pop) {
  const seen = new Set();
  for (const t of p.tools) {
    const name = (t.name ?? '').trim();
    if (!name) continue;
    toolRaw.set(name, (toolRaw.get(name) ?? 0) + 1);
    const rule = TOOLFOLD.find(([re]) => re.test(name));
    const key = rule ? rule[1] : null;
    if (key && !seen.has(key)) { seen.add(key); toolPapers.set(key, (toolPapers.get(key) ?? 0) + 1); }
  }
}
console.log(`folded names, counted by paper, of ${pop.length} population papers:`);
[...toolPapers.entries()].sort((a, b) => b[1] - a[1]).forEach(([k, n]) => console.log(`  ${k.padEnd(38)} ${String(n).padStart(2)}  ${pct(n, pop.length)}`));
const residue = [...toolRaw.entries()].filter(([n]) => !TOOLFOLD.some(([re]) => re.test(n))).sort((a, b) => b[1] - a[1]);
console.log(`\nRESIDUE — ${residue.length} distinct tool strings the fold does not map (${residue.reduce((a, b) => a + b[1], 0)} mentions):`);
console.log(residue.map(([n, c]) => `${n} (${c})`).join('; '));
 
h('4. Where the population drew its sites from — population[].sourceList, folded');
const LISTFOLD = [
  [/tranco/i, 'Tranco'], [/crux|chrome ux|chrome user experience/i, 'CrUX'], [/alexa/i, 'Alexa'],
  [/majestic/i, 'Majestic'], [/quantcast/i, 'Quantcast'], [/umbrella|cisco/i, 'Cisco Umbrella'],
  // /2fa/i alone also matches "UCB anonymized 2FA log events" and "UIUC 2FA-related support
  // tickets", which put an operator-telemetry paper in the directory bucket. Caught by the
  // figures review on 2026-09-11; the tight form is the one TOOLFOLD already used.
  [/2fa\.?\s?directory/i, '2fa.directory'], [/similarweb/i, 'Similarweb'], [/http ?archive/i, 'HTTP Archive'],
  [/fortune/i, 'Fortune 1000'], [/custom|not-stated|seed list/i, 'custom / not stated'],
  [/prolific|mechanical turk|participant/i, 'participant panel'],
];
const listPapers = new Map(); const listRaw = new Map();
for (const p of pop) {
  const seen = new Set();
  for (const s of p.population) {
    const v = (s.sourceList ?? '').trim();
    if (!v) continue;
    listRaw.set(v, (listRaw.get(v) ?? 0) + 1);
    const rule = LISTFOLD.find(([re]) => re.test(v));
    if (rule && !seen.has(rule[1])) { seen.add(rule[1]); listPapers.set(rule[1], (listPapers.get(rule[1]) ?? 0) + 1); }
  }
}
[...listPapers.entries()].sort((a, b) => b[1] - a[1]).forEach(([k, n]) => console.log(`  ${k.padEnd(24)} ${String(n).padStart(2)} papers  ${pct(n, pop.length)}`));
const lres = [...listRaw.entries()].filter(([n]) => !LISTFOLD.some(([re]) => re.test(n))).sort((a, b) => b[1] - a[1]);
console.log(`\nRESIDUE — ${lres.length} distinct source-list strings unmapped:`);
console.log(lres.map(([n, c]) => `${n} (${c})`).join('; '));
console.log('\nranking list by era (papers naming each, first/last year in this population):');
for (const k of ['Alexa', 'Tranco', 'CrUX', 'Majestic', 'Quantcast', 'Cisco Umbrella']) {
  const ps = pop.filter((p) => p.population.some((s) => LISTFOLD.find(([re]) => re.test(s.sourceList ?? ''))?.[1] === k));
  if (!ps.length) { console.log(`  ${k.padEnd(16)} 0`); continue; }
  console.log(`  ${k.padEnd(16)} ${String(ps.length).padStart(2)} papers  ${Math.min(...ps.map((p) => p.year))}-${Math.max(...ps.map((p) => p.year))}`);
}
 
h('5. How big were the site populations — population[].n for website/domain units');
const sizes = [];
for (const p of pop) for (const s of p.population) {
  if (!s.n) continue;
  if (!['websites', 'domains', 'web-pages'].includes(s.unit)) continue;
  sizes.push([s.n, p.year, p.slug]);
}
sizes.sort((a, b) => b[0] - a[0]);
console.log(`${sizes.length} site-unit population entries across ${new Set(sizes.map((s) => s[2])).size} papers`);
console.log('largest ten:');
sizes.slice(0, 10).forEach(([n, y, s]) => console.log(`  ${String(n).padStart(9)}  ${y}  ${s.slice(0, 60)}`));
const med = sizes.map((s) => s[0]).sort((a, b) => a - b)[Math.floor(sizes.length / 2)];
console.log(`median site-unit n: ${med}`);
console.log(`entries under 500 sites: ${sizes.filter((s) => s[0] < 500).length} of ${sizes.length}`);
 
h('6. Where this population goes quiet — sentinels, each with its own denominator');
const field = (label, subset, get) => {
  const vals = new Map();
  for (const p of subset) { const v = get(p); vals.set(v ?? 'null', (vals.get(v ?? 'null') ?? 0) + 1); }
  const stated = subset.filter((p) => !isSentinel(get(p))).length;
  console.log(`\n${label}  (population ${subset.length}; stated ${stated} = ${pct(stated, subset.length)})`);
  [...vals.entries()].sort((a, b) => b[1] - a[1]).forEach(([v, n]) => console.log(`    ${String(v).padEnd(26)} ${String(n).padStart(2)}`));
};
const popCrawl = pop.filter((p) => p.crawlConfig !== null);
console.log(`papers with a crawlConfig object: ${popCrawl.length} of ${pop.length}`);
field('crawlConfig.authentication', popCrawl, (p) => p.crawlConfig.authentication);
field('crawlConfig.statefulness', popCrawl, (p) => p.crawlConfig.statefulness);
field('crawlConfig.consentAction', popCrawl, (p) => p.crawlConfig.consentAction);
field('crawlConfig.interactionDepth', popCrawl, (p) => p.crawlConfig.interactionDepth);
field('ethics.reviewOutcome', pop.filter((p) => p.ethics !== null), (p) => p.ethics.reviewOutcome);
field('ethics.notifiedAffectedParties', pop.filter((p) => p.ethics !== null), (p) => p.ethics.notifiedAffectedParties);
field('artifacts.availability', pop.filter((p) => p.artifacts !== null), (p) => p.artifacts.availability);
console.log('\nbase rates for the same fields, so a share can be read against something:');
const base = (label, get, famFilter) => {
  const mk = (set) => { const st = set.filter((p) => !isSentinel(get(p))).length; return `${st}/${set.length} = ${pct(st, set.length)}`; };
  const popSet = pop.filter(famFilter), webSet = web.filter(famFilter), allSet = rows.filter(famFilter);
  console.log(`  ${label.padEnd(34)} population ${mk(popSet).padEnd(22)} web papers ${mk(webSet).padEnd(24)} corpus ${mk(allSet)}`);
};
base('crawlConfig.authentication', (p) => p.crawlConfig?.authentication, (p) => p.crawlConfig !== null);
base('crawlConfig.statefulness', (p) => p.crawlConfig?.statefulness, (p) => p.crawlConfig !== null);
base('ethics.reviewOutcome', (p) => p.ethics?.reviewOutcome, (p) => p.ethics !== null);
base('ethics.notifiedAffectedParties', (p) => p.ethics?.notifiedAffectedParties, (p) => p.ethics !== null);
base('artifacts.availability', (p) => p.artifacts?.availability, (p) => p.artifacts !== null);
 
h('6a. Absence claims, printed rather than asserted');
// The page claims almost nobody reuses a measurement framework. An absence claim that rests on
// one spelling of one tool is not a finding, so both the narrow and the widened check are
// printed: OpenWPM alone, and OpenWPM plus the other collectors a web-measurement paper might
// pick up. The widened one returns a paper the narrow one misses, and the page names it.
const OFFSHELF = /openwpm|tracker ?radar ?collector|webxray|puppeteer-?cluster|crawl4ai/i;
for (const [label, re] of [['OpenWPM', /openwpm/i], ['any off-the-shelf framework (OpenWPM, Tracker Radar Collector, webXray, crawl4ai)', OFFSHELF]]) {
  const inTools = pop.filter((p) => p.tools.some((t) => re.test(t.name ?? '')));
  const inOther = pop.filter((p) => (p.otherToolsMentioned ?? []).some((t) => re.test((t && (t.name ?? t)) ?? '')));
  console.log(`  ${label}: tools[] ${inTools.length} papers${inTools.length ? ' (' + inTools.map((p) => p.slug.slice(0, 30)).join(', ') + ')' : ''}; otherToolsMentioned[] ${inOther.length} papers${inOther.length ? ' (' + inOther.map((p) => p.slug.slice(0, 30)).join(', ') + ')' : ''}`);
}
 
h('7. Hand coding and validation inside this population');
const ann = pop.filter((p) => p.humanAnnotation.length > 0);
console.log(`papers with a humanAnnotation tuple: ${ann.length} of ${pop.length} (${pct(ann.length, pop.length)})`);
const annBaseWeb = web.filter((p) => p.humanAnnotation.length > 0).length;
console.log(`  base rate: ${annBaseWeb} of ${web.length} web papers = ${pct(annBaseWeb, web.length)}`);
const withCount = ann.filter((p) => p.humanAnnotation.some((a) => !isSentinel(a.annotatorCount)));
const withMetric = ann.filter((p) => p.humanAnnotation.some((a) => !isSentinel(a.agreementMetric)));
console.log(`  state an annotator count: ${withCount.length} of ${ann.length} = ${pct(withCount.length, ann.length)}`);
console.log(`  state an agreement metric: ${withMetric.length} of ${ann.length} = ${pct(withMetric.length, ann.length)}`);
const cls = pop.filter((p) => p.classification.length > 0);
console.log(`papers with a classification tuple: ${cls.length} of ${pop.length}`);
const vmap = new Map();
for (const p of cls) for (const v of new Set(p.classification.map((c) => c.validation))) vmap.set(v ?? 'null', (vmap.get(v ?? 'null') ?? 0) + 1);
[...vmap.entries()].sort((a, b) => b[1] - a[1]).forEach(([v, n]) => console.log(`    classification.validation ${String(v).padEnd(22)} ${n}`));
const mmap = new Map();
for (const p of cls) for (const v of new Set(p.classification.map((c) => c.method))) mmap.set(v ?? 'null', (mmap.get(v ?? 'null') ?? 0) + 1);
[...mmap.entries()].sort((a, b) => b[1] - a[1]).forEach(([v, n]) => console.log(`    classification.method     ${String(v).padEnd(22)} ${n}`));
 
h('8. Is anyone here using an LLM? (currency check)');
const llmPop = pop.filter((p) => p.classification.some((c) => c.method === 'llm'));
const llmAll = rows.filter((p) => p.classification.some((c) => c.method === 'llm'));
console.log(`classification.method == llm: ${llmPop.length} of the ${pop.length} population papers; ${llmAll.length} corpus-wide`);
const llmYr = new Map();
for (const p of llmAll) llmYr.set(p.year, (llmYr.get(p.year) ?? 0) + 1);
console.log('corpus-wide llm classification by year: ' + [...llmYr.entries()].sort().map(([y, n]) => `${y}:${n}`).join(' '));
if (llmPop.length) for (const p of llmPop) console.log(`  ${p.year} ${p.venue} ${p.title}`);
 
h('9. Artifact links released by this population');
const art = pop.filter((p) => p.artifacts && p.artifacts.availability && !isSentinel(p.artifacts.availability));
console.log(`papers stating an availability value: ${art.length} of ${pop.length}`);
for (const p of pop) {
  const a = p.artifacts;
  if (!a) continue;
  if (!a.links || !a.links.length) continue;
  const code = a.links.filter((l) => ['code-repository', 'dataset', 'artifact-archive'].includes(l.kind));
  const shown = (code.length ? code : a.links).slice(0, 2).map((l) => `${l.kind}:${l.url}`).join(' ');
  console.log(`  ${p.year} ${p.venue.padEnd(8)} ${(a.availability ?? '-').padEnd(26)} ${shown}`);
}
 
// ---------------------------------------------------------------------------
// --wikitable: the page's own "all 45 papers" table, generated rather than typed.
// Columns: year, venue, citekey+title, subgroup, and the largest site-unit n the paper
// DECLARES in population[] — which is the drawn frame, not necessarily the set analysed, and
// for a few papers (a phishing corpus, a breach dataset, a password leak) not even the frame
// for the deployment part of the study. The page says so in the row above the table rather
// than quietly presenting these as measured populations. Paste into the page as-is.
// ---------------------------------------------------------------------------
if (process.argv.includes('--wikitable')) {
  const SUBLABEL = { SSO: 'SSO', MFA: 'MFA/RBA', PASSKEY: 'passkey', LOGINSURF: 'login surface', POSTLOGIN: 'post-login', OPERATOR: 'operator' };
  console.log('\n===== --wikitable =====');
  console.log("^ Year ^ Venue ^ Paper ^ Measures ^ Largest n in ''population[]'' ^");
  const VENUE = { USENIX: 'USENIX Sec', 'IEEE-SP': 'IEEE S&P', PETS: 'PoPETs', WWW: 'TheWebConf', CCS: 'CCS', IMC: 'IMC', NDSS: 'NDSS' };
  for (const x of IN.slice().sort((a, b) => a.p.year - b.p.year || a.p.venue.localeCompare(b.p.venue))) {
    const p = x.p;
    const site = p.population.filter((s) => s.n && ['websites', 'domains', 'web-pages'].includes(s.unit)).sort((a, b) => b.n - a.n)[0];
    const other = p.population.filter((s) => s.n).sort((a, b) => b.n - a.n)[0];
    const popCell = site
      ? `${site.n.toLocaleString('en-US')} ${site.unit} (${site.sourceList})`
      : other ? `${other.n.toLocaleString('en-US')} ${other.unit} (${other.sourceList})` : 'no n stated';
    const title = (p.title ?? '').replace(/\.$/, '').replace(/\|/g, '-');
    console.log(`| ${p.year} | ${VENUE[p.venue] ?? p.venue} | //${title}// {[${x.citekey}]} | ${SUBLABEL[x.verdict[1]]} | ${popCell} |`);
  }
}