| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| security [2026/08/27 14:08] – Headers child now written: 44 measured of 176 probe hits. Authored by Claude. karel.kubicek.claude | security [2026/09/11 07:14] (current) – Add Security:Authentication as the seventh child (login deployment: SSO, MFA/RBA, passkeys, login and password policy); note the programming:registration boundary. Authored by Claude karel.kubicek.claude |
|---|
| |
| <WRAP important> | <WRAP important> |
| **A namespace page outlines the pages inside it rather than carrying its own content.** (([[contributing]], "Namespace and page structure".)) The five children below are proposed from this corpus. [[Security:Web vulnerabilities]], [[Security:TLS certificates]], [[Security:Phishing]] and [[Security:Headers]] are written; [[Security:VirusTotal]] remains a red link until written; this page exists so a reader landing from [[start]] is not sent into an empty namespace. Three candidates were not given a page; Google Safe Browsing was folded into phishing rather than made a sixth — see [[#Rejected, and why]]. | **A namespace page outlines the pages inside it rather than carrying its own content.** (([[contributing]], "Namespace and page structure".)) The **seven** children below are proposed from this corpus, and all seven are written: [[Security:Web vulnerabilities]], [[Security:TLS certificates]], [[Security:Phishing]], [[Security:Headers]], [[Security:VirusTotal]], [[Security:Email authentication]] and [[Security:Authentication]]. This page exists so a reader landing from [[start]] is not sent into an empty namespace. Three candidates were not given a page; Google Safe Browsing was folded into phishing rather than made a page of its own — see [[#Rejected, and why]]. |
| </WRAP> | </WRAP> |
| |
| ===== The five pages ===== | ===== The seven pages ===== |
| |
| ^ Page ^ What a fresh student needs it for ^ What the corpus can carry (2026-08-27) ^ | ^ Page ^ What a fresh student needs it for ^ What the corpus can carry (2026-08-27) ^ |
| | [[Security:Phishing]] | You are about to crawl phishing sites or evaluate a feed, and need to know what the feed does not contain. | Schema union (detection, classification, population, or slug matching "phish"): **139** papers, **92** web. PhishTank is the named source in **21**. A full-text /phish/ sweep hits **1,097** papers — that is a fact about these being security venues, not a population. Start with Zhang et al. {[zhang2021_crawlphish]} (cloaking against anti-phishing crawlers) and Peng et al. {[peng2019_opening]} (VirusTotal's phishing engines). | | | [[Security:Phishing]] | You are about to crawl phishing sites or evaluate a feed, and need to know what the feed does not contain. | Schema union (detection, classification, population, or slug matching "phish"): **139** papers, **92** web. PhishTank is the named source in **21**. A full-text /phish/ sweep hits **1,097** papers — that is a fact about these being security venues, not a population. Start with Zhang et al. {[zhang2021_crawlphish]} (cloaking against anti-phishing crawlers) and Peng et al. {[peng2019_opening]} (VirusTotal's phishing engines). | |
| | [[Security:Web vulnerabilities]] | You are about to look for XSS, CSRF, clickjacking or SOP bypass on live sites, and need methods and denominators — not the ethics checklist. | **880** papers classify a vulnerability; **209** of them on the web platform; **99** both crawled and web. The 99 is a paper-level conjunction — it does not by itself mean the crawl is how the vulnerability was found. **49.2%** of the 880 are ''offline'' (program analysis of software). The child page's first job is to hand-map the web/crawled slice, not to treat 880 or 99 as a method count. Ethics of scanning live sites is [[practices:ethics]]; telling the operator is [[practices:notifying_websites]]. Start with Steffens et al. {[steffens2019_dont]}. | | | [[Security:Web vulnerabilities]] | You are about to look for XSS, CSRF, clickjacking or SOP bypass on live sites, and need methods and denominators — not the ethics checklist. | **880** papers classify a vulnerability; **209** of them on the web platform; **99** both crawled and web. The 99 is a paper-level conjunction — it does not by itself mean the crawl is how the vulnerability was found. **49.2%** of the 880 are ''offline'' (program analysis of software). The child page's first job is to hand-map the web/crawled slice, not to treat 880 or 99 as a method count. Ethics of scanning live sites is [[practices:ethics]]; telling the operator is [[practices:notifying_websites]]. Start with Steffens et al. {[steffens2019_dont]}. | |
| | | [[Security:Email authentication]] | You are about to measure whether domains and mail servers deploy SPF, DKIM, DMARC, DANE, MTA-STS or STARTTLS, and need to know which of the four different questions your instrument answers. | **31** papers, hand-mapped, whose object is email transport, authentication and encryption **deployment** — the ''INFRA'' verdict of the published population map behind [[privacy:email_tracking]], which scopes them out because they are not tracking. Heavily recent: 21 of the 31 are 2022 or later, and the venue split is USENIX Security 16 / IMC 7 / NDSS 4. The page's own subject is denominators: the same protocol is 56.5% and 60.9% deployed in the same year because the populations differ. **BIMI is measured by zero papers** in these seven venues. Start with Durumeric et al. {[durumeric2015_neither]}, Hu and Wang {[hu2018_measurements]}, Ashiq et al. {[ashiq2024_beyond]} and BreakSPF {[wang2024_breakspf]}. | |
| | | [[Security:Authentication]] | You are about to measure how websites deploy **login**: SSO and OAuth buttons, MFA and risk-based authentication, passkeys and WebAuthn, login and password policies, and the session a login leaves behind. | **45** papers, hand-audited from **184** candidates produced by five probes plus a full-text recall pass — 24.5% precision, which is why this page was gated on an audit before it was written. 42 of the 45 are web-platform papers (2.6% of 1,622) and 25 ran a crawl (2.2% of 1,120); 33 of the 45 are 2022 or later. The page's subject is the denominator: "how many sites support SSO" is answered as 9.3%, 6.30%, 7.23%, 27% and 57.8% by five papers that do not disagree, they divide by different things. **No paper in this population classifies with an LLM** (0 of 45, against 177 corpus-wide). Start with Ardi et al. {[ardi2023_prevalence]}, Al Roomi and Li {[alroomi2023_login]}, Jannett et al. {[jannett2026_passkeys]} and Gavazzi et al. {[gavazzi2023_multi]}. | |
| ===== Where this namespace stops ===== | ===== Where this namespace stops ===== |
| |
| * **[[design:mobile_and_app_measurement]]** — certificate pinning and TLS interception inside apps. | * **[[design:mobile_and_app_measurement]]** — certificate pinning and TLS interception inside apps. |
| * **[[design:ip_classification]]** — reputation and geolocation of addresses, including some of the same feeds. | * **[[design:ip_classification]]** — reputation and geolocation of addresses, including some of the same feeds. |
| | * **[[programming:registration]]** — logging in or creating accounts **as an instrument**, so you can crawl what is behind the login. [[Security:Authentication]] is the other direction: the login itself as the measurement. |
| * **[[privacy:javascript]]** — script-level analysis; XSS-as-a-JavaScript-phenomenon belongs with [[Security:Web vulnerabilities]] when the question is "is this live site exploitable", and there when the question is "what did this script do". | * **[[privacy:javascript]]** — script-level analysis; XSS-as-a-JavaScript-phenomenon belongs with [[Security:Web vulnerabilities]] when the question is "is this live site exploitable", and there when the question is "what did this script do". |
| |
| ===== Methodology and limitations of these figures ===== | ===== Methodology and limitations of these figures ===== |
| |
| Every number in the table above is a count of **papers**, from the 5,859-paper extraction, with the denominator named in the same cell. Full-text probes read ''paper.cols.txt'' (4 of 5,859 have none and are counted as negatives). 2025–2026 venue-years are provisional — see [[literature:corpus]]. The queries, the folds, the residue, and the unedited report output are on [[provenance:security]]. | Every number in the table above is a count of **papers**, from the 5,859-paper extraction, with the denominator named in the same cell. Two rows are exceptions in kind rather than in rigour: the email-authentication 31 is a hand-mapped topical slice of a published 354-paper candidate pool, and the authentication 45 is a hand audit of 184 probe candidates. Neither is a query result, and both pages say so. Full-text probes read ''paper.cols.txt'' (4 of 5,859 have none and are counted as negatives). 2025–2026 venue-years are provisional — see [[literature:corpus]]. The queries, the folds, the residue, and the unedited report output are on [[provenance:security]]. |
| |
| <bibtex bibliography></bibtex> | <bibtex bibliography></bibtex> |
