SecWeb 2021

Designing Security for the Web


April 21, 2021: We can now confirm our second keynote speaker: Nataliia Bielova from INRIA's PRIVATICS team.

February 25, 2021: We are happy to announce of first keynote speaker: Christoph Kerschbaumer from Mozilla!

February 25, 2021: This year, SecWeb will feature a mentoring program for junior members of the community to be exposed to the reviewing process. If you are a student working on Web security or are the supervisor of students working on Web Security, please reach out via email to us (chairs(at)secweb(dot)work) to indicate interest.

February 22, 2021: We'll have a second edition of SecWeb, again co-located with EuroS&P!. We are also releasing a preliminary CfP today.

SecWeb Reviewing Mentoring

Reviewing is hard, constructive reviewing even more so. For SecWeb, we therefore will have a mentoring program for junior members of the community. We will invite a limited number of students in the area of Web security into the PC and each junior member will have a mentor which whom to discuss their reviews. In this way, junior community members are exposed to the reviewing and discussion process, while also benefiting from the experience and insights of more senior reviewers. If you or your students are interested in this, write an email to chairs(at)secweb(dot)work by March 15 to indicate your (or your students') interest.

What is SecWeb?

Back in the days, the Web was not designed with security or privacy in mind. Many key mechanisms we rely on today for critical functionality were arguably not designed for security (such as cookies for authentication purposes) and numerous mechanisms have been piecemeal retrofitted to the Web to add security to it. In this workshop, we want to move away from augmenting the Web with Security and rather design Security for the Web.

Aim & Scope

The Web has become the key access point to a plethora of security-sensitive services, which we use on a daily basis, yet it was not designed with security in mind. Over the years, this has led to many security mechanisms which were piecemeal retrofit to not cause breakage to existing web applications. The goal of the SecWeb workshop is therefore twofold: we want to collect ideas on how the Web could be extended with novel security mechanisms, better access interfaces (browsers) and disciplined programming abstractions, so as to natively support secure web application development. Moreover, we also invite in particular contributions which aim to redesign parts of the ecosystem, so as not to be stuck on a patchwork of security on the Web, but rather have security built-in by design.

Besides traditional Web security papers, SecWeb particularly welcomes position papers which propose provocative thoughts on how (parts of) the current web platform could be heavily re-envisioned for security. Such proposals often do not fit major computer security conferences, because their real-world deployment might be complicated, yet they have value for the web security community, since they advance the understanding of relevant web security problems, their root causes and the design space of possible solutions. Ideally, we expect well-thought proposals accepted at SecWeb to be excellent starting points for discussion with browser vendors (which we explicitly envision as participants) and/or major players of the Web market, who have the commitment and the resources to convert academic proposals into reality.

Program 2021

Given the unclear situation around Covid-19 and the ability of participants to attend in person, there is not yet a fixed day for the workshop.

Logistics & Dates

SecWeb 2021 is co-located with IEEE EuroS&P 2021 planned to happen in Vienna, Austria September 7-11, 2021.

Important Dates

  • Paper submissions due: May 28, 2021 (23:59 CET)
  • Notification to authors: July 2, 2021
  • Camera-ready deadline for accepted papers: July 16, 2021

Call for Papers

All papers discussing Web security and Web privacy aspects are solicited for submission. SecWeb particularly welcomes position papers which propose provocative thoughts on how (parts of) the current Web platform could be heavily re-envisioned for security. This explicitly includes proposals that would break today’s Web to improve its security tomorrow.

Topics of interest include, but are not limited to, the following:

  • Browser security
  • Formal methods for Web security
  • Language-based Web security
  • Security policies for the Web
  • Usable Web security
  • Web application firewalls
  • Web attacks and defenses
  • Web authentication and authorization
  • Web protocol security
  • Web security architectures
  • Web tracking and online advertisement

Reviewing and Publication Process

SecWeb solicits both full and short papers. All papers must be written in English and must not exceed 10 pages (full) and 6 pages (short) in A4 format using the IEEE conference proceeding template (excluding bibliography and well-marked appendixes). Submissions must be in PDF format and should print easily on simple default configurations. Submissions are anonymous, so information that might identify the authors must be excluded. It is the authors' responsibility to ensure that their anonymity is preserved when citing their own work. Failures to adhere to these requirements can be grounds for rejection.

The proceedings will be published by the IEEE after the workshop and will be made available in IEEE Xplore. During submission, authors can choose to have their paper excluded from the proceedings. At least one author of each accepted paper must register to the workshop for presentation.

All submissions considered for inclusion in the proceedings must contain an original contribution. That is, these papers must not substantially overlap papers that have been published or that are simultaneously submitted to a journal, conference or workshop. In particular, simultaneous submission of the same work is not allowed. This requirement is relaxed for submissions which will not be included in the proceedings: in particular, we also invite papers that are currently under submission or planned to be submitted before the SecWeb notification.

Program Committee

  • Stefano Calzavara (Università Ca' Foscari Venezia) -- Chair
  • Ben Stock (CISPA Helmholtz Center for Information Security) -- Chair
  • Adam Oest (Paypal)
  • Alexandros Kapravelos (NC State)
  • Alvaro Feal (IMDEA, Mentee)
  • Aurore Fass (CISPA Helmholtz Center for Information Security)
  • Babak Amin Azad (Stony Brook, Mentee)
  • Devdatta Akhawe (Figma)
  • Emily Stark (Google)
  • Frederik Braun (Mozilla)
  • Gertjan Franken (KU Leuven, Mentee)
  • Gunes Acar (KU Leuven)
  • Hugo Jonker (Open University)
  • John Wilander (Apple)
  • Katharina Krombholz (CISPA Helmholtz Center for Information Security)
  • Kostas Solomos (UIC, Mentee)
  • Lorenzo Veronese (TU Wien, Mentee)
  • Luca Compagna (SAP)
  • Marco Squarcina (TU Wien)
  • Marius Musch (TU Braunschweig, Mentee)
  • Merve Sahin (SAP)
  • Muhammad Ikram (Macquarie University)
  • Nick Nikiforakis (Stony Brook)
  • Pierre Laperdrix (INRIA)
  • Sebastian Lekies (Google)
  • Sebastian Roth (CISPA Helmholtz Center for Information Security, Mentee)
  • Sooel Son (KAIST)
  • Tamara Rezk (INRIA)
  • Tom Van Goethem (KU Leuven)
  • Veelasha Moonsamy (Ruhr University Bochum)
  • Victor Le Pochat (KU Leuven, Mentee)
  • William Robertson (Northeastern)
  • Yana Dimova (KU Leuven, Mentee)
  • Yinzhi Cao (Johns Hopkins)
  • Zhenkai Liang (NUS)