arXiv subjects

Nick Sullivan

Publications and source records attributed to Nick Sullivan.

5 recordsLinked to original sources

arXiv2025

Hydrogen Passivation Effects on Spatially Resolved Charge Trap Densities in Si(100)-SiO$_2$

As silicon-based devices continue to shrink to the nanoscale, traps at the Si-SiO$_2$ interface pose increasing challenges to device performance. These traps reduce channel carrier mobility and shift threshold voltages in integrated circuits, and introduce charge noise in quantum systems, reducing their coherence times. Knowledge of the precise location of such traps aids in understanding their influence on device performance. In this work, we demonstrate that frequency-modulated atomic force microscopy (fm-AFM) allows the detection of individual traps. We use this to study how sample preparation, specifically the introduction of a buried hydrogen termination layer, and post-processing annealing in forming gas (N$_2$+H$_2$), affects the density of donor-like traps in Si(100)-SiO$_2$ systems. We spatially map and quantify traps in both conventionally prepared ("pristine") silicon samples and those processed under ultra-high vacuum for hydrogen resist lithography (HRL). We confirm previous studies demonstrating hydrogen passivation of traps and find that hydrogen termination further reduces the donor-like trap density. We also observe a significant reduction in two-level donor-like traps in the hydrogen-terminated samples compared to pristine silicon samples. These findings suggest that HRL-prepared silicon may offer advantages for high-performance nanoscale and atomic-scale devices due to reduced trap densities.

cond-mat.mtrl-sci↗

arXiv2022

You get PADDING, everybody gets PADDING! You get privacy? Evaluating practical QUIC website fingerprinting protections for the masses

Website fingerprinting (WF) is a well-know threat to users' web privacy. New internet standards, such as QUIC, include padding to support defenses against WF. Previous work only analyzes the effectiveness of defenses when users are behind a VPN. Yet, this is not how most users browse the Internet. In this paper, we provide a comprehensive evaluation of QUIC-padding-based defenses against WF when users directly browse the web. We confirm previous claims that network-layer padding cannot provide good protection against powerful adversaries capable of observing all traffic traces. We further demonstrate that such padding is ineffective even against adversaries with constraints on traffic visibility and processing power. At the application layer, we show that defenses need to be deployed by both first and third parties, and that they can only thwart traffic analysis in limited situations. We identify challenges to deploy effective WF defenses and provide recommendations to address them.

cs.CR↗

arXiv2021

Might I Get Pwned: A Second Generation Compromised Credential Checking Service

Credential stuffing attacks use stolen passwords to log into victim accounts. To defend against these attacks, recently deployed compromised credential checking (C3) services provide APIs that help users and companies check whether a username, password pair is exposed. These services however only check if the exact password is leaked, and therefore do not mitigate credential tweaking attacks - attempts to compromise a user account with variants of a user's leaked passwords. Recent work has shown credential tweaking attacks can compromise accounts quite effectively even when the credential stuffing countermeasures are in place. We initiate work on C3 services that protect users from credential tweaking attacks. The core underlying challenge is how to identify passwords that are similar to their leaked passwords while preserving honest clients' privacy and also preventing malicious clients from extracting breach data from the service. We formalize the problem and explore ways to measure password similarity that balance efficacy, performance, and security. Based on this study, we design "Might I Get Pwned" (MIGP), a new kind of breach alerting service. Our simulations show that MIGP reduces the efficacy of state-of-the-art 1000-guess credential tweaking attacks by 94%. MIGP preserves user privacy and limits potential exposure of sensitive breach entries. We show that the protocol is fast, with response time close to existing C3 services. We worked with Cloudflare to deploy MIGP in practice.

cs.CR↗

arXiv2020

Oblivious DNS over HTTPS (ODoH): A Practical Privacy Enhancement to DNS

The Domain Name System (DNS) is the foundation of a human-usable Internet, responding to client queries for host-names with corresponding IP addresses and records. Traditional DNS is also unencrypted, and leaks user information to network operators. Recent efforts to secure DNS using DNS over TLS (DoT) and DNS over HTTPS (DoH) have been gaining traction, ostensibly protecting traffic and hiding content from on-lookers. However, one of the criticisms of DoT and DoH is brought to bear by the small number of large-scale deployments (e.g., Comcast, Google, Cloudflare): DNS resolvers can associate query contents with client identities in the form of IP addresses. Oblivious DNS over HTTPS(ODoH) safeguards against this problem. In this paper we ask what it would take to make ODoH practical? We describe ODoH, a practical DNS protocol aimed at resolving this issue by both protecting the client's content and identity. We implement and deploy the protocol, and perform measurements to show that ODoH has comparable performance to protocols like DoH and DoT which are gaining widespread adoption, while improving client privacy, making ODoH a practical privacy enhancing replacement for the usage of DNS.

cs.CR↗

arXiv2019

Protocols for Checking Compromised Credentials

To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches. Recently, some web services, such as HaveIBeenPwned (HIBP) and Google Password Checkup (GPC), have started providing APIs to check for breached passwords. We refer to such services as compromised credential checking (C3) services. We give the first formal description of C3 services, detailing different settings and operational requirements, and we give relevant threat models. One key security requirement is the secrecy of a user's passwords that are being checked. Current widely deployed C3 services have the user share a small prefix of a hash computed over the user's password. We provide a framework for empirically analyzing the leakage of such protocols, showing that in some contexts knowing the hash prefixes leads to a 12x increase in the efficacy of remote guessing attacks. We propose two new protocols that provide stronger protection for users' passwords, implement them, and show experimentally that they remain practical to deploy.

cs.CR↗