Online Safety and Privacy

Investigating methods to combat disinformation campaigns at all levels

Selected Publications

“I can say I’m John Travolta...but I’m not John Travolta.” Investigating the Impact of Changes to Social Media Verification Policies on User Perceptions of Verified Accounts.
Carson Powers, Nickolas Gravel, Christopher Pellegrini, Micah Sherr, Michelle L. Mazurek, and Daniel Votipka. SOUPS 2024.

An Investigation of US Universities’ Implementation of FERPA Student Directory Policies and Student Privacy Preferences.
Sarah Radway, Katherine Quintanilla, Cordelia Ludden, and Daniel Votipka. CHI 2024.

Does Being Verified Make You More Credible? The Effect of Account Verification on Tweet Credibility.
Tavish Vaidya, Daniel Votipka, Micah Sherr, Michelle L. Mazurek. CHI 2019.

Close Project

Medical System Security

Investigating security decisions by medical device manufacturers, hospital administrators, and medical professionals.

Selected Publications

“There are rabbit holes I want to go down that I’m not allowed to go down”: An Investigation of Security Expert Threat Modeling Practices for Medical Devices
Ronald Thompson, Madeline McLaughlin, Carson Powers, and Daniel Votipka. USENIX Security 2024.

Viewpoint on Improving Privacy and Security of Telehealth
Faiza Tazi, Josiah Dykstra, Prashanth Rajivan, Kapil Chalil Madathil, Jiovanne Hughart, James T. McElligott, Daniel Votipka, Sanchari Das. Communications of the ACM.

Close Project

Vulnerability Discovery for All

Taking a human-centric approach to better understand the vulnerability discovery community, create more usable tools, and reduce the barrier to entry.

Selected Publications

"I’m trying to learn…and I’m shooting myself in the foot": Beginners’ Struggles When Solving Binary Exploitation Exercises.
James A. Mattei, Christopher Pellegrini, Matthew Soto, Katherine Quintanilla, Marina Sanusi Bohuk, and Daniel Votipka. USENIX Security 2025.

An Investigation of Interaction and Information Needs for Protocol Reverse Engineering Automation.
Samantha Katcher*, James A. Mattei*, Jared Chandler, Daniel Votipka. CHI 2025.

Expert Insights into Advanced Persistent Threats: Analysis, Attribution, and Challenges.
Aakanksha Saha, James A. Mattei, Jorge Blasco, Lorenzo Cavallaro, Daniel Votipka, and Martina Lindorfer. USENIX Security 2025.

A Survey of Cybersecurity Professionals’ Perceptions and Experiences of Safety and Belonging in the Community.
Samantha Katcher, Liana Wang, Caroline Yang, Chloé Messdaghi, Michelle L. Mazurek, Marshini Chetty, Kelsey R. Fulton, and Daniel Votipka. SOUPS 2024.

Bug Hunters’ Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem.
Omer Akgul, Taha Eghtesad, Amit Elazari, Omprakash Gnawali, Jens Grossklags, Michelle Mazurek, Daniel Votipka, Aron Laszka. USENIX Security 2023.

Vulnerability Discovery for All: Experiences of Marginalization in Vulnerability Discovery.
Kelsey R. Fulton, Samantha Katcher, Kevin Song, Marshini Chetty, Michelle L. Mazurek, Chloe Messdaghi, Daniel Votipka. IEEE S&P 2023.

A Qualitative Evaluation of Reverse Engineering Tool Usability.
James Mattei, Madeline McLaughlin, Samantha Katcher, Daniel Votipka. ACSAC 2022.

An Investigation of Online Reverse Engineering Community Discussions in the Context of Ghidra.
Daniel Votipka, Mary Nicole Punzalan, Seth M. Rabin, Yla Tausczik, Michelle L. Mazurek. EuroS&P 2021.

HackEd: A Pedagogical Analysis of Online Vulnerability Discovery Exercises.
Daniel Votipka, Eric Zhang, Michelle L. Mazurek. IEEE S&P 2021.

An Observational Investigation of Reverse Engineers' Processes.
Daniel Votipka, Seth Rabin, Kristopher Micinski, Jeffrey S. Foster, and Michelle L. Mazurek. USENIX Sec 2020.

Hackers vs Testers: A Comparison of Software Vulnerability Discovery Processes.
Daniel Votipka, Rock Stevens, Elissa M. Redmiles, Jeremy Hu, Michelle L. Mazurek. IEEE S&P 2018.

Close Project

Network Defense

Taking a human-centric approach to better understand network defense, create more usable tools, and reduce the barrier to entry.

Selected Publications

Everybody's Got ML, Tell Me What Else You Have: Practitioners' Perception of ML-Based Security Tools and Explanations.
Jaron Mink, Hadjer Benkraouda, Limin Yang, Arridhana Ciptadi, Ali Ahmadzadeh, Daniel Votipka, Gang Wang. IEEE S&P 2023.

How Ready is Your Ready? Assessing the Usability of Incident Response Playbook Frameworks.
Rock Stevens, Daniel Votipka, Josiah Dykstra, Fernando Tomlinson, Erin Quartararo, Colin Ahern, Michelle L. Mazurek. CHI 2022.

The Battle for New York: A Case Study of Applied Digital Threat Modeling at the Enterprise Level.
Rock Stevens, Daniel Votipka, Elissa M. Redmiles, Colin Ahern, Patrick Sweeney, Michelle L. Mazurek. USENIX Sec 2018.

Close Project

Database Privacy

Investigating the intersection of security, privacy, and performance, to build fast, accurate database systems that support privacy-preserving analytics with provable security guarantees.

Selected Publications

Longshot: Indexing Growing Databases Using MPC and Differential Privacy.
Yanping Zhang, Johes Bater, Kartik Nayak, Ashwin Machanavajjhala. VLDB Endowment 2023.

VaultDB: A Real-World Pilot of Secure Multi-Party Computation within a Clinical Research Network.
Jennie Rogers, Elizabeth Adetoro, Johes Bater, Talia Canter, Dong Fu, Andrew Hamilton, Amro Hassan, Ashley Martinez, Erick Michalski, Vesna Mitrovic, Fred Rachman, Raj Shah, Matt Sterling, Kyra VanDoren, Theresa L. Walunas, Xia Wang, Abel Kho. arXiv 2022.

IncShrink: Architecting Efficient Outsourced Databases using Incremental MPC and Differential Privacy.
Chenghong Wang, Johes Bater, Kartik Nayak, Ashwin Machanavajjhala. SIGMOD 2022.

Visualizing Privacy-Utility Trade-Offs in Differentially Private Data Releases.
Priyanka Nanayakkara, Johes Bater, Xi He, Jessica Hullman, Jennie Rogers. PETS 2022.

DP-Sync: Hiding Update Patterns in Secure Outsourced Databases with Differential Privacy.
Chenghong Wang, Johes Bater, Kartik Nayak, Ashwin Machanavajjhala. SIGMOD 2021.

SAQE: Practical Privacy-Preserving Approximate Query Processing for Data Federations.
Johes Bater, Yongjoo Park, Xi He, Xiao Wang, Jennie Rogers. PVLDB 2020.

Shrinkwrap: Efficient SQL Query Processing in Differentially Private Data Federations.
Johes Bater, Xi He, William Ehrich, Ashwin Machanavajjhala, Jennie Rogers. PVLDB 2018.

SMCQL: Secure Querying for Federated Databases.
Johes Bater, Gregory Elliott, Craig Eggen, Satyender Goel, Abel Kho, Jennie Rogers. PVLDB 2017.

Close Project

Study Participants

We cannot do our research without the help of practitioners volunteering to participate. Below, we provide links to ongoing research, which will provide further information and directions for how to participate. If you have any questions about our work, please feel free to email us at dvotipka@cs.tufts.edu. We are always happy to work with you and make every research experience a positive one.

Current Research

Close Project

Get your PhD

We are always looking for new PhD students, and if you are applying to grad school and interested in usable security and privacy, please consider Tufts! Please email Dan Votipka, Johes Bater, or Megumi Ando with any inquiries, but be mindful, we may not follow up with everyone. Obvious form emails sent enmass will not receive a response, so please be sure to write a personal email that notes some background about yourself and what kinds of projects related to our lab's work that you're interested in researching. Do not attach a CV or resume: just let us know who you are and why you want to join the lab.

Undergraduate Research

Secure Development

Understanding how and why developers introduce vulnerabilities.

Selected Publications

'Threat modeling is very formal, it’s very technical, and also very hard to do correctly': Investigating Threat Modeling Practices in Open-Source Software Projects.
Harjot Kaur*, Carson Powers*, Ronald E. Thompson, Sascha Fahl, and Daniel Votipka. USENIX Security 2025.

Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns.
Jan H Klemmer, Stefan Albert Horstmann, Nikhil Patnaik, Cordelia Ludden, Cordell Burton Jr., Carson Powers, Fabio Massacci, Akond Rahman, Daniel Votipka, Heather Richter Lipford, Awais Rashid, Alena Naiakshina, Sascha Fahl. CCS 2022.

Understanding the how and the why: Exploring secure development practices through a course competition.
Kelsey R. Fulon, Daniel Votipka, Desiree Abrokwa, James Parker, Michelle L. Mazurek, Michael Hicks. CCS 2022.

Where to Recruit for Security Development Studies from: Comparing Six Software Developer Samples.
Harjot Kaur, Sabrina Amft, Daniel Votipka, Yasemin Acar, Sascha Fahl. USENIX Sec 2022.

Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study.
Kelsey R. Fulton, Anna Chan, Daniel Votipka, Michael Hicks, Michelle L. Mazurek. SOUPS 2021.

Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It.
Daniel Votipka, Kelsey R. Fulton, James Parker, Matthew Hou, Michelle L. Mazurek, Michael Hicks. USENIX Sec 2020.

Building and Validating a Scale for Secure Software Development Self-Efficacy.
Daniel Votipka, Desiree Abrokwa, Michelle L. Mazurek. CHI 2020.

Toward a Field Study on the Impact of Hacking Competitions on Secure Development.
Daniel Votipka, Hongyi Hu, Bryan Eastes, Michelle L. Mazurek. WSIW 2018.

Close Project