<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04562671</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-24T19:07:23+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Know their Customers: An Empirical Study of Online Account Enumeration Attacks</title>
            <author role="aut">
              <persName>
                <forename type="first">Maël</forename>
                <surname>Maceiras</surname>
              </persName>
              <idno type="halauthorid">3141090-0</idno>
              <affiliation ref="#struct-97916"/>
              <affiliation ref="#struct-486576"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Kavous</forename>
                <surname>Salehzadeh Niksirat</surname>
              </persName>
              <email type="md5">be6c473036b4a41e6dc09014d01f6551</email>
              <email type="domain">unil.ch</email>
              <idno type="idhal" notation="numeric">1086812</idno>
              <idno type="halauthorid" notation="string">2116218-1086812</idno>
              <affiliation ref="#struct-97916"/>
              <affiliation ref="#struct-302851"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Gaël</forename>
                <surname>Bernard</surname>
              </persName>
              <email type="md5">6fb8588dedcf1254823a5ece87db1b3e</email>
              <email type="domain">epfl.ch</email>
              <idno type="idhal" notation="numeric">1219766</idno>
              <idno type="halauthorid" notation="string">2706148-1219766</idno>
              <affiliation ref="#struct-302851"/>
              <affiliation ref="#struct-97916"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Benoît</forename>
                <surname>Garbinato</surname>
              </persName>
              <idno type="halauthorid">724564-0</idno>
              <affiliation ref="#struct-97916"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mauro</forename>
                <surname>Cherubini</surname>
              </persName>
              <email type="md5">58cf093a3291caddba47b37976096213</email>
              <email type="domain">unil.ch</email>
              <idno type="idhal" notation="numeric">1035536</idno>
              <idno type="halauthorid" notation="string">244867-1035536</idno>
              <affiliation ref="#struct-97916"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mathias</forename>
                <surname>Humbert</surname>
              </persName>
              <email type="md5">ec578f8bf9cfba9b73cd7ec4f6666f2c</email>
              <email type="domain">unil.ch</email>
              <idno type="idhal" notation="numeric">1115511</idno>
              <idno type="halauthorid" notation="string">912501-1115511</idno>
              <affiliation ref="#struct-97916"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Kévin</forename>
                <surname>Huguenin</surname>
              </persName>
              <email type="md5">5a48112777a3d2e5f4072fe757f108b1</email>
              <email type="domain">eleve.bretagne.ens-cachan.fr</email>
              <ptr type="url" target="https://people.unil.ch/kevinhuguenin"/>
              <idno type="idhal" notation="string">kevinhuguenin</idno>
              <idno type="idhal" notation="numeric">205</idno>
              <idno type="halauthorid" notation="string">32235-205</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-7147-1828</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.com/citations?user=ELQ9ms8AAAAJ&amp;hl=fr</idno>
              <idno type="IDREF">https://www.idref.fr/148708196</idno>
              <affiliation ref="#struct-97916"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Kévin</forename>
                <surname>Huguenin</surname>
              </persName>
              <email type="md5">e3d0d05e0b89b2be88f1c3d5a933a4f7</email>
              <email type="domain">unil.ch</email>
            </editor>
            <funder>Hasler Foundation (#22018)</funder>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2024-05-12 17:47:38</date>
              <date type="whenModified">2024-06-17 15:51:08</date>
              <date type="whenReleased">2024-05-15 16:00:58</date>
              <date type="whenProduced">2024-06</date>
              <date type="whenEndEmbargoed">2024-05-12</date>
              <ref type="file" target="https://hal.science/hal-04562671v1/document">
                <date notBefore="2024-05-12"/>
              </ref>
              <ref type="file" subtype="publisherPaid" n="1" target="https://hal.science/hal-04562671v1/file/Maceiras2024TWeb.pdf" id="file-4572807-3969477">
                <date notBefore="2024-05-12"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="136811">
                <persName>
                  <forename>Kévin</forename>
                  <surname>Huguenin</surname>
                </persName>
                <email type="md5">e3d0d05e0b89b2be88f1c3d5a933a4f7</email>
                <email type="domain">unil.ch</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04562671</idno>
            <idno type="halUri">https://hal.science/hal-04562671</idno>
            <idno type="halBibtex">maceiras:hal-04562671</idno>
            <idno type="halRefHtml">&lt;i&gt;ACM Transactions on the Web&lt;/i&gt;, 2024, 18 (3), pp.37:1-37:36. &lt;a target="_blank" href="https://dx.doi.org/10.1145/3664201"&gt;&amp;#x27E8;10.1145/3664201&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">ACM Transactions on the Web, 2024, 18 (3), pp.37:1-37:36. &amp;#x27E8;10.1145/3664201&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-4572807-3969477"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt/>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Know their Customers: An Empirical Study of Online Account Enumeration Attacks</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Maël</forename>
                    <surname>Maceiras</surname>
                  </persName>
                  <idno type="halauthorid">3141090-0</idno>
                  <affiliation ref="#struct-97916"/>
                  <affiliation ref="#struct-486576"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Kavous</forename>
                    <surname>Salehzadeh Niksirat</surname>
                  </persName>
                  <email type="md5">be6c473036b4a41e6dc09014d01f6551</email>
                  <email type="domain">unil.ch</email>
                  <idno type="idhal" notation="numeric">1086812</idno>
                  <idno type="halauthorid" notation="string">2116218-1086812</idno>
                  <affiliation ref="#struct-97916"/>
                  <affiliation ref="#struct-302851"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Gaël</forename>
                    <surname>Bernard</surname>
                  </persName>
                  <email type="md5">6fb8588dedcf1254823a5ece87db1b3e</email>
                  <email type="domain">epfl.ch</email>
                  <idno type="idhal" notation="numeric">1219766</idno>
                  <idno type="halauthorid" notation="string">2706148-1219766</idno>
                  <affiliation ref="#struct-302851"/>
                  <affiliation ref="#struct-97916"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Benoît</forename>
                    <surname>Garbinato</surname>
                  </persName>
                  <idno type="halauthorid">724564-0</idno>
                  <affiliation ref="#struct-97916"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mauro</forename>
                    <surname>Cherubini</surname>
                  </persName>
                  <email type="md5">58cf093a3291caddba47b37976096213</email>
                  <email type="domain">unil.ch</email>
                  <idno type="idhal" notation="numeric">1035536</idno>
                  <idno type="halauthorid" notation="string">244867-1035536</idno>
                  <affiliation ref="#struct-97916"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mathias</forename>
                    <surname>Humbert</surname>
                  </persName>
                  <email type="md5">ec578f8bf9cfba9b73cd7ec4f6666f2c</email>
                  <email type="domain">unil.ch</email>
                  <idno type="idhal" notation="numeric">1115511</idno>
                  <idno type="halauthorid" notation="string">912501-1115511</idno>
                  <affiliation ref="#struct-97916"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Kévin</forename>
                    <surname>Huguenin</surname>
                  </persName>
                  <email type="md5">5a48112777a3d2e5f4072fe757f108b1</email>
                  <email type="domain">eleve.bretagne.ens-cachan.fr</email>
                  <ptr type="url" target="https://people.unil.ch/kevinhuguenin"/>
                  <idno type="idhal" notation="string">kevinhuguenin</idno>
                  <idno type="idhal" notation="numeric">205</idno>
                  <idno type="halauthorid" notation="string">32235-205</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-7147-1828</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.com/citations?user=ELQ9ms8AAAAJ&amp;hl=fr</idno>
                  <idno type="IDREF">https://www.idref.fr/148708196</idno>
                  <affiliation ref="#struct-97916"/>
                </author>
              </analytic>
              <monogr>
                <idno type="halJournalId" status="VALID">74999</idno>
                <idno type="issn">1559-1131</idno>
                <title level="j">ACM Transactions on the Web</title>
                <imprint>
                  <publisher>http://tweb.acm.org/</publisher>
                  <biblScope unit="volume">18</biblScope>
                  <biblScope unit="issue">3</biblScope>
                  <biblScope unit="pp">37:1-37:36</biblScope>
                  <date type="datePub">2024-06</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1145/3664201</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Usable security and privacy</term>
                <term xml:lang="en">Web privacy</term>
                <term xml:lang="en">Account enumeration attacks</term>
                <term xml:lang="en">Online accounts</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-wb">Computer Science [cs]/Web</classCode>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halDomain" n="info.info-hc">Computer Science [cs]/Human-Computer Interaction [cs.HC]</classCode>
              <classCode scheme="halTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halOldTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halTreeTypology" n="ART">Journal articles</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Internet users possess accounts on dozens of online services where they are often identified by one of their e-mail addresses. They often use the same address on multiple services and for communicating with their contacts. In this paper, we investigate attacks that enable an adversary (e.g., company, friend) to determine (stealthily or not) whether an individual, identified by their e-mail address, has an account on certain services (i.e., an account enumeration attack). Such attacks on account privacy have serious implications as information about one’s accounts can be used to (1) profile them and (2) improve the effectiveness of phishing. We take a multifaceted approach and study these attacks through a combination of experiments (63 services), surveys (318 respondents), and focus groups (13 participants). We demonstrate the high vulnerability of popular services (93.7%) and the concerns of users about their account privacy, as well as their increased susceptibility to phishing e-mails that impersonate services on which they have an account. We also provide findings on the challenges in implementing countermeasures for service providers and on users’ ideas for enhancing their account privacy. Finally, our interaction with national data protection authorities led to the inclusion of recommendations in their developers’ guide.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-97916" status="VALID">
          <idno type="IdRef">027525031</idno>
          <idno type="ROR">https://ror.org/019whta54</idno>
          <orgName>Université de Lausanne = University of Lausanne</orgName>
          <orgName type="acronym">UNIL</orgName>
          <date type="start">1537-01-01</date>
          <desc>
            <address>
              <addrLine>CH-1015 Lausanne</addrLine>
              <country key="CH"/>
            </address>
            <ref type="url">http://www.hec.unil.ch/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-486576" status="VALID">
          <orgName>PricewaterhouseCoopers</orgName>
          <orgName type="acronym">PwC</orgName>
          <desc>
            <address>
              <addrLine>MultinationaleSiège social : London</addrLine>
              <country key="GB"/>
            </address>
            <ref type="url">http://www.pwc.com</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-302851" status="VALID">
          <idno type="IdRef">029644631</idno>
          <idno type="ROR">https://ror.org/02s376052</idno>
          <orgName>Ecole Polytechnique Fédérale de Lausanne</orgName>
          <orgName type="acronym">EPFL</orgName>
          <desc>
            <address>
              <addrLine>CH-1015 Lausanne, Switzerland</addrLine>
              <country key="CH"/>
            </address>
            <ref type="url">https://www.epfl.ch</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>