Florentin Putz, M.Sc.

Deployable and Usable Security / Acoustic Communication / Researcher

Contact Information

Pankratiusstraße 2
D-64289 Darmstadt
S2|20 203
fputz@seemoo.tu-darmstadt.de
+49 6151 16-25475
+49 6151 16-25471

Biography

Florentin Putz is a researcher at the Secure Mobile Networking Lab. His research focuses on deployable and usable security for smartphones and the Internet of Things. He currently explores innovative physical layers for device pairing based on acoustic communication. He received his B.Sc. (2016) and M.Sc. (2019) degrees from Technical University of Darmstadt, Germany. During his master's studies, he was a visiting graduate student at the University of British Columbia, Canada. He is recipient of the Best Student Award (for the best master's degree at the electrical engineering department), the Datenlotsen Award (for an outstanding master's thesis), the KuVS Award 2020 (for the best master's thesis in communications and distributed systems in Germany, awarded by the GI/ITG section "Fachgruppe Kommunikation und Verteilte Systeme"), and the CHI 2023 Best Paper Award.

Research Interests

Strong Authentication, Trust Establishment
Usable Security
Device Bootstrapping, Provisioning, Pairing
Acoustic Communication

Teaching

Coordination and teaching assistant of course Physical Layer Security in Wireless Systems
Selected seminar topics in (Advanced) Seminar on Networking, Security, Mobility, and Wireless Communications
Selected lab topics in Secure Mobile Networking Lab/Project

Offered Theses Topics

Type

Year

No results match your search criteria.

2023 In progress

Power Characterization of Acoustic Communication and Other Wireless Ad-Hoc Communication Technologies for Smartphones and the Internet of Things

Supervisor: Florentin Putz

...

2023 In progress

Measuring Acoustic Communication Schemes

Supervisor: Florentin Putz

...

2023 Available now

Acoustic Communication: Ubiquitous ad-hoc communication?

Supervisor: Florentin Putz

I offer challenging topics on all aspects of the acoustic physical layer, which allows smartphones to use their integrated audio hardware for aerial communication, similar to wireless radio communication. The main use case is short-range communication, e.g., for pairing.The advantage: We can implement custom physical layers without expensive SDRs. Contact me if you have any research ideas on this topic. Strong experience with signal processing is required.

2022 Completed

Enterprise Authentication Systems

Supervisor: Florentin Putz

Enterprise Authentication Systems

2022 Completed

Smartphone Pairing Schemes

Supervisor: Florentin Putz

...

2022 Completed

Impact of Multi-Path Effects on Acoustic Keylogging Systems

Supervisor: Matthias Gazzari Florentin Putz

...

2022 Completed

Implementation and Evaluation of Short-Range Aerial Acoustic Communication Systems for Smartphones

Supervisor: Florentin Putz

...

2022 Completed

Channel Characterization for Aerial Acoustic Communication Systems

Supervisor: Florentin Putz

...

2021 Completed

FIDO2 Platform Authenticators

Supervisor: Florentin Putz

...

2021 Completed

Evaluation of Acoustic Communication Schemes

Supervisor: Florentin Putz

...

2021 Completed

Evaluation of Ultra-Wideband for Secure Device Pairing

Supervisor: Alexander Heinrich Florentin Putz

Evaluation of Ultra-Wideband for Secure Device Pairing

2021 Completed

Analyzing the Deployment of Device-Specific Android Security Features

Supervisor: Florentin Putz

Analyzing the Deployment of Device-Specific Android Security Features

2021 Completed

Investigating the Pitfalls of FIDO2 Usability in Practice

Supervisor: Florentin Putz

Publications

Type

Year

Show awards only

No results match your search criteria.

2023 ACM 2023 CHI Conference on Human Factors in Computing Systems Conference

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Leon Würsching Florentin Putz Steffen Haesler Matthias Hollick

BibTeX DOI: 10.1145/3544548.3580993

Abstract

Modern smartphones support FIDO2 passwordless authentication using either external security keys or internal biometric authentication, but it is unclear whether users appreciate and accept these new forms of web authentication for their own accounts. We present the first lab study (N=87) comparing platform and roaming authentication on smartphones, determining the practical strengths and weaknesses of FIDO2 as perceived by users in a mobile scenario. Most participants were willing to adopt passwordless authentication during our in-person user study, but closer analysis shows that participants prioritize usability, security, and availability differently depending on the account type. We identify remaining adoption barriers that prevent FIDO2 from succeeding password authentication, such as missing support for contemporary usage patterns, including account delegation and usage on multiple clients.

2023 WiSec '23: 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

DEMO: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

Markus Scheck Florentin Putz Frank Hessel Hermann Leinweber Jonatan Crystall Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00024180

Abstract

Smart speakers are highly privacy-sensitive devices: They are located in our homes and provide an Internet-enabled microphone, making them a prime target for attackers. The pairing between a client device and the speaker must be protected to prohibit adversaries from accessing the device. Most commercial protocols are vulnerable to nearby adversaries as they do not probe for human presence at the speaker or proximity between both devices. In addition to security, the protocol must provide a user-friendly way for initial bootstrapping of the speaker. We design an open pairing protocol for the establishment of a shared secret between both devices using acoustic messaging to guarantee proximity, and release our implementation for the smart speaker as well as Android and Linux clients as open-source software on GitHub.

2021 2021 Conference on Computer Supported Cooperative Work and Social Computing Conference

Connected Self-Organized Citizens in Crises: An Interdisciplinary Resilience Concept for Neighborhoods

Steffen Haesler Ragnar Mogk Florentin Putz Kevin Logan Nadja Thiessen Katharina Kleinschnitger Lars Baumgärtner Jan-Philipp Stroscher Christian Reuter Michèle Knodt Matthias Hollick

PDF BibTeX DOI: 10.1145/3462204.3481749

2021 4th International Workshop on Emerging Technologies for Authorization and Authentication Conference

Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions

Florentin Putz Steffen Schön Matthias Hollick

PDF BibTeX DOI: 10.1007/978-3-030-93747-8_2

Abstract

The FIDO2 standards for strong authentication on the Internet define an extension interface, which allows them to flexibly adapt to future use cases. The domain of establishing new FIDO2 extensions, however, is currently limited to web browser developers and members of the FIDO alliance. We show how researchers and developers can design and implement their own extensions for using FIDO2 as a well-established and secure foundation to demonstrate innovative authentication concepts or to support custom deployments. Our open-source implementation targets the full FIDO2 stack, such as the Chromium web browser and hardware tokens, to enable tailor-made authentication based on the power of the existing FIDO2 ecosystem. To give an overview of existing extensions, we survey all published FIDO2 extensions by manually inspecting the source code of major web browsers and authenticators. Their current design, however, hinders the implementation of custom extensions, and they only support a limited number of extensions out of the box. We discuss weaknesses of current implementations and identify the lack of extension pass-through as a major limitation in current FIDO2 clients.

2020 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

Acoustic Integrity Codes: Secure Device Pairing Using Short-Range Acoustic Communication

Florentin Putz Flor Álvarez Jiska Classen

PDF BibTeX DOI: 10.1145/3395351.3399420

Abstract

Secure Device Pairing (SDP) relies on an out-of-band channel to authenticate devices. This requires a common hardware interface, which limits the use of existing SDP systems. We propose to use short-range acoustic communication for the initial pairing. Audio hardware is commonly available on existing off-the-shelf devices and can be accessed from user space without requiring firmware or hardware modifications. We improve upon previous approaches by designing Acoustic Integrity Codes (AICs): a modulation scheme that provides message authentication on the acoustic physical layer. We analyze their security and demonstrate that we can defend against signal cancellation attacks by designing signals with low autocorrelation. Our system can detect overshadowing attacks using a ternary decision function with a threshold. In our evaluation of this SDP scheme’s security and robustness, we achieve a bit error ratio below 0.1% for a net bit rate of 100 bps with a signal-to-noise ratio (SNR) of 14 dB. Using our open-source proof-of-concept implementation on Android smartphones, we demonstrate pairing between different smartphone models.