Tommaso Innocenti
- PhD Student, Northeastern University
- innocenti.t[at]northeastern[dot]edu
I am a fourth-year PhD student advised by Engin Kirda, working as a member of the Secure Systems Lab (SecLab) at Northeastern University.
Previously, I studied in Politecnico di Milano, where I got my Bachelor's and Master's degrees in Computer Science Engineering. I also studied at Universidad Complutense de Madrid during this period under the Erasmus exchange program.
Interests. Web security and privacy
Previously, I studied in Politecnico di Milano, where I got my Bachelor's and Master's degrees in Computer Science Engineering. I also studied at Universidad Complutense de Madrid during this period under the Erasmus exchange program.
Interests. Web security and privacy
Publications
2024
- “Only as Strong as the Weakest Link”: On the Security of Brokered Single Sign-On on the Web IEEE Symposium on Security and Privacy ’25(A.R. 105/739= 14,3%).[Slide] [Code] [BibTex] Tommaso Innocenti, Louis Jannett, Christian Mainka, Vladislav Mladenov, Engin Kirda
2023
- OAuth 2.0 Redirect URI Validation Falls Short, Literally ACSAC'23(A.R. 104/497= 20,9%). [Slide pptx] [Code] [BibTex] Tommaso Innocenti, Matteo Golinelli, Ali Mirheidari, Kaan Onarlioglu, Bruno Crispo, Engin Kirda
2022
- FRAMESHIFTER: Security Implications of HTTP/2-to-HTTP/1 Conversion Anomalies, USENIX'22. (A.R. 256/1414= 18,1%) [BibTex] Bahruz Jabiyev, Steven Sprecher, Anthony Gavazzi,Tommaso Innocenti, Kaan Onarlioglu, Engin Kirda
2021
- You’ve Got (a Reset) Mail: A Security Analysis of Email-Based Password Reset Procedures, DIMVA2021(A.R. 19/66= 28,7%).[Slide] [BibTex] Tommaso Innocenti, Ali Mirheidari, Amin Kharraz, Bruno Crispo, Engin Kirda
2018
- Less is More (Secure) Deprecator : Automated Reduction of the Attack Surface in Modern Browsers, Master thesis. Tommaso Innocenti
Talks/Workshops
2023
- OWASP Italy Meetup March 2024 - Virtual OAuth 2.0 Redirect URI Validation Falls Short, Literally [Slide pptx]
- OWASP Boston Chapter December meetup - Boston OAuth 2.0 Redirect URI Validation Falls Short, Literally [Slide pptx]
- Annual Computer Security Applications Conference (ACSAC)'23 - Austin OAuth 2.0 Redirect URI Validation Falls Short, Literally [Slide pptx]
- OAuth Security Workshop (OSW)'23 - London OAuth 2.0 Redirect URI Validation Falls Short, Literally [Slide pptx]
2021
- Federal Trade Commission (FTC) invited talk - Virtual You’ve Got (a Reset) Mail: A Security Analysis of Email-Based Password Reset Procedures [Slide]
- Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA) '21- Virtual You’ve Got (a Reset) Mail: A Security Analysis of Email-Based Password Reset Procedures [Slide]