<!--[if !supportLists]-->Cormac HerleyV·       <!--[endif]-->D. Florencio, C. Herley and P.C. van Oorschot, "An Administrator's Guide to Internet Password Research", Proc. Usenix LISA, 2014

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio, C. Herley and P.C. van Oorschot, "Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts", Proc. Usenix Security, 2014

<!--[if !supportLists]-->·        <!--[endif]-->S. Komanduri, R. Shay, L. Cranor, C. Herley and S. Schechter, "Telepathwords: preventing weak passwords by reading users' minds", Proc. Usenix Security 2014

<!--[if !supportLists]-->·       <!--[endif]-->S. Egelman, A. Sotirakopoulos, I. Muslukhov, K. Beznosov and C. Herley, "Does My Password Go up to Eleven? The Impact of Password Meters on Password Selection" Proc. ACM CHI 2013

<!--[if !supportLists]-->·       <!--[endif]-->J. Bonneau, C. Herley, P.C. van Oorschot and F. Stajano, “The quest to replace passwords: a framework for comparative evaluation of web authentication schemes,” IEEE Symposium on Security and Privacy 2012.

• C. Herley, "Small World: Collisions among attackers in a finite population", WEIS 2013
• C. Herley,  "Why do Nigerian Scammers say they are from Nigeria?", Proc. WEIS 2012
• D. Florencio and C. Herley, "Where Do All the Attacks Go?" Proc. WEIS 2011
• D. Florencio and C. Herley, "Sex, Lies and Cyber-crime Surveys," Proc. WEIS 2011
• Z. Mao, D. Florencio and C. Herley, "Painless Migration to Two-factor Authentication," Proc. WIFS 2011.
• D. Florencio and C. Herley, Phishing and Money Mules, Proc. WIFS, 2010
• C. Herley, "The Plight of the Targeted Attacker in a World of Scale,"  Proc. WEIS 2010  

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio and C. Herley, "Where Do Security Policies Come From?" Symp. On Usable Privacy and Security, 2010.

<!--[if !supportLists]-->·       <!--[endif]-->S. Schechter, C. Herley and M. Mitzenmacher, "Popularity is Everything: a new approach to protecting passwords from statistical-guessing attacks," Proc. HotSEC 2010

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio and C. Herley, "Where Do Security Policies Come From?", SOUPS 2010 [Best paper award at SOUPS]

<!--[if !supportLists]-->·       <!--[endif]-->C. Herley, P.C. van Oorschot and A.S. Patrick, "Passwords: If We're So Smart Why Are We Still Using Them?" Financial Crypto 2009

• C. Herley and D. Florencio, “Nobody Sells Gold for the Price of Silver: Dishonesty, Uncertainty and the Underground Economy,” Proc. WEIS 2009, London

<!--[if !supportLists]-->·       <!--[endif]-->C. Herley, "So Long, and No Thanks for the Externalities: the Rational Rejection of Security Advice by Users," New Security Paradigms Workshop 2009, Oxford.

• C. Herley and D. Florencio, “A Profitless Endeavor: Phishing as a Tragedy of the Commons,” NSPW 2008, Lake Tahoe, CA
• D. Florencio and C. Herley, “One-time Password Access to Any Server Without Changing the Server," ISC 2008, Taipei
• B. Coskun and C. Herley, "Can Something-You-Know be Saved?" ISC 2008, Taipei
• C. Herley and D. Florencio, “Protecting Financial Institutions from Brute-Force Attacks,” SEC 2008, Milan
• D. Florencio, C. Herley and B. Coskun,“Do Strong Web Passwords Accomplish Anything?," Usenix HotSEC '07, Boston.

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio and C. Herley, “A Large Scale Study of Web Password Habits,” WWW 2007, Banff.

<!--[if !supportLists]-->·       <!--[endif]-->Bharambe, C. Herley and V. Padmanabhan,“Analyzing and Improving a BitTorrent Network's Performance Mechanisms,” Proc. IEEE InfoCom 2006.

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio and C. Herley,“KLASSP: Entering Passwords on a Spyware Infected Machine Using a Shared-Secret Proxy,” Proc. ACSAC 2006.

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio and C. Herley, “Password Rescue: A New Approach to Phishing Prevention,” Usenix HotSEC ’06, Vancouver

<!--[if !supportLists]-->·       <!--[endif]-->C. Herley and D. Florencio, “How to Login from an Internet Cafe Without Worrying about Keyloggers,” Symp. On Usable Privacy and Security ‘06

<!--[if !supportLists]-->·       <!--[endif]-->D. Florencio and C. Herley,“Analysis and Improvement of Anti-Phishing Schemes,” Proc. SEC 2006.