Information Systems and Applied Computer Sciences

Privacy and Security in Information Systems Group

Prof. Dr. Dominik Herrmann

The focus of our work is the protection of information systems and the protection of privacy with technical mechanisms. To this end, we analyze and evaluate existing systems and develop protective mechanisms. We cooperate with working groups in the fields of machine learning (inference attacks, online tracking), law (data protection, law enforcement) and ethics (value-oriented system design).

Recent and Upcoming Events

11 Juni

Video der Antrittsvorlesung.  Am 11.06.18 fand die Antrittsvorlesung von Prof. Dr. Dominik Herrmann statt: „Denn Sie wissen nicht, was sie tun – ein Plädoyer für wehrhaften Datenschutz durch Technik“. Zusammenfassung und Video-Aufzeichnung (nur aus dem Netz der Uni Bamberg abrufbar).

24 Mai

Sicherheitslücke in Versandapotheken.  Bei Arbeiten an PrivacyScore haben wir eine Session-Hijacking-Lücke in zahlreichen Online-Apotheken aufgedeckt. Die Ursache waren nachlässig konfigurierte Webserver ("/server-status/" abrufbar). Unbeteiligten wäre es dadurch möglich gewesen, Kundendaten auszuspähen, darunter ihre Bestellhistorie und teilweise sogar Zahlungsdaten.   Bericht bei

27 April

Talk on Data Crimes.  We presented a survey on data crimes at the 10th Conference on the Future of Adversarial and Inquisitorial Systems at University of Basel (slides).

19 April

PET-CON 2018.1 in Berlin.  This workshop is for students who work on Privacy Enhancing Technologies. With 25 participants this was the largest PET-CON so far. The next one will take place in Hamburg in October 2018 (website).

Project in the Spotlight: PrivacyScore

One of our ongoing projects is (in public beta since June 2017). PrivacyScore is an automated website scanner that allows anyone to investigate websites for privacy and security issues. Users can submit URLs of individual websites or scan a list of related websites to learn how they compare against each other.

On the one hand public benchmarks improve transparency for citizens, on the other the benchmarks can be of use for data protection agencies that want to or have to audit content providers in their jurisdiction. In the long run we want to find out whether public "blaming and shaming" and/or transparent comparisons of sites within its peer group create additional incentives that increase the willingness of site operators to implement additional security/privacy measures.

We are hiring!

We have several open positions for student assistants ("SHKs") and research assistants ("Wissenschaftliche Mitarbeiter") at the moment.

  1. Student assistant (40 hours/month): web design an social media management for activities of the PSI group
  2. Postdoc or PhD student (TV-L E13 contract): Developing a MOOC within the H2020 project CANVAS
  3. Research and teaching assistant (TV-L E13 contract, prerequisite: advanced knowledge of information security and privacy)

Please contact Dominik Herrmann if you want to apply or if you want to obtain more details about one of the positions.