Elie Bursztein
Elie Bursztein
Born	1980 (age 43–44) France
Nationality	French
Citizenship	French
Education	École pour l'informatique et les techniques avancées (Engineering degree, 2004) Paris Diderot University (MS, 2005) École normale supérieure Paris-Saclay (PhD, 2008)
Known for	Password Checkup SHA-1 Collision
Scientific career
Fields	Artificial intelligence Computer Security Cryptography
Institutions	Stanford University Google DeepMind
Thesis	Anticipation games: Game theory applied to network security (2008)
Doctoral advisor	Jean Goubault-Larrecq
Website	elie.net

Elie Bursztein,^{[r 1]} born 1 June 1980 in France, is a French computer scientist and software engineer. He currently Google and DeepMind AI cybersecurity technical and research lead.

Education and early career

Bursztein obtained a computer engineering degree from EPITA in 2004, a master’s degree in computer science from Paris Diderot University/ENS in 2005, and a PhD in computer science from École normale supérieure Paris-Saclay in 2008 with a dissertation titled Anticipation games: Game theory applied to network security. His PhD advisor was Jean Goubault-Larrecq.

Before joining Google, Bursztein was a post-doctoral fellow at Stanford University's Security Laboratory, where he collaborated with Dan Boneh and John Mitchell on web security,^{[p 1][p 2]} game security,^{[p 3][p 4]} and applied cryptographic research.^{[p 5]} His work at Stanford University included the first cryptanalysis of the inner workings of Microsoft’s DPAPI (Data Protection Application Programming Interface),^{[p 6]} the first evaluation of the effectiveness of private browsing,^{[p 7][r 2]} and many advances to CAPTCHA security^{[p 8][p 9][p 10]} and usability.^{[p 11]}

Bursztein has discovered, reported, and helped fix hundreds of vulnerabilities, including securing Twitter’s frame-busting code,^{[r 3]} exploiting Microsoft's location service to track the position of mobile devices,^{[r 4]} and exploiting the lack of proper encryption in the Apple App Store to steal user passwords and install unwanted applications.^{[r 5]}

Career at Google

Bursztein joined Google in 2012 as a research scientist. He founded the Anti-Abuse Research Team in 2014 and became the lead of the Security and Anti-Abuse Research teams in 2017.^{[r 6]} In 2023, he became Google and DeepMind AI cybersecurity technical and research lead.

Bursztein's notable contributions at Google include:

• 2022 Creating the first post quantum resilient security keys.^{[p 12]}
• 2020 Developing a deep-learning engine that helps to block malicious documents targeting Gmail users.^{[p 13]}
• 2019 Developing a password-checking service^{[r 7]} that has allowed hundreds of millions of users^{[r 8]} to check whether their credentials have been stolen in a data breach while preserving their privacy.^{[p 14]}
• 2019 Developing a Keras tuner that became the default hypertuner for TensorFlow^{[r 9]} and TFX.^{[r 10]}
• 2018 Conducting the first large-scale study on the illegal online distribution of child sexual abuse material in partnership with NCMEC.^{[p 15]}
• 2017 Finding the 1st SHA-1 full collision.^{[p 16][r 11]}
• 2015 Deprecating security questions at Google after completing the first large in-the-wild study on the effectiveness of security questions,^{[p 17]} which showed that they were both insecure and had a very low recall rate.^{[r 12][r 13]}
• 2014 Redesigning Google CAPTCHA to make it easier for humans, resulting in a 6.7% improvement in the pass rate.^{[p 18][1]}
• 2013 Strengthening Google accounts protections against hijackers^{[p 19]} and fake accounts.^{[p 20]}

Awards and honors

Best academic papers awards

• 2023 ACNS best workshop paper award for Hybrid Post-Quantum Signatures in Hardware Security Keys^{[p 12]}
• 2021 USENIX Security distinguished paper award ^{[r 14]} for "Why wouldn't someone think of democracy as a target?": Security practices & challenges of people involved with U.S. political campaigns^{[p 21]}
• Bursztein 2019 USENIX Security distinguished paper award ^{[r 14]} for Protecting accounts from credential stuffing with password breach alerting^{[p 14]}
• 2019 CHI best paper award^{[r 15]} for “They don’t leave us alone anywhere we go”: Gender and digital abuse in South Asia^{[p 22]}
• 2017 Crypto best paper award^{[r 16]} for The first collision for full SHA-1^{[p 16]}
• 2015 WWW best student paper award^{[r 17]} for Secrets, lies, and account recovery: Lessons from the use of personal knowledge questions at Google^{[p 17][r 13]}
• 2015 S&P Distinguished Practical Paper award^{[r 18]} for Ad Injection at Scale: Assessing Deceptive Advertisement Modifications^{[p 23][r 19]}
• 2011 S&P best student paper award^{[r 20]} for OpenConflict: Preventing real time map hacks in online games^{[p 3]}
• 2008 WISPT best paper award for Probabilistic protocol identification for hard to classify protocol^{[p 24]}

Industry awards

• 2019 Recognized as one of the 100 most influential French people in cybersecurity^{[r 21]}
• 2017 BlackHat Pwnie award for the first practical SHA-1 collision^{[r 22]}
• 2015 IRTF Applied Networking Research Prize ^{[r 23]} for Neither snow nor rain nor MITM … An empirical analysis of email delivery security^{[p 25]}
• 2010 Top 10 Web Hacking Techniques for Attacking HTTPS with cache injection^{[r 24][p 26]}

Trivia

Bursztein is an accomplished magician and posted magic tricks weekly on Instagram during the 2019 pandemic.^{[r 25]}

In 2014, following his talk on hacking Hearthstone using machine learning,^{[p 27]} he decided not to make his prediction tool open source, because of the Hearthstone’s community disappointment and at Blizzard Entertainment’s request.^{[r 26]}

Selected publications