PROF. DR. DOMINIK HERRMANN
University of Bamberg · WIAI Faculty

Chair of Privacy and Security in Information Systems

Security problems are design problems. Data protection fails due to lack of comprehensibility. We develop protection mechanisms that work – and teach the knowledge needed to make them effective.

Current Activities ↓ Research Teaching
dh.psi@uni-bamberg.de · Office hours Tue 3-4 pm · Room: WE5/05.064 · Dean of WIAI since October 2025 (chair operations continue normally)
Sketch of a workspace with laptop, coffee, and Defense-in-Depth poster
Quick Links
PSI Thesis Guide Exam Booklet System psi-exam inf.zone YouTube Channel uni-mal-anders.de

What We're Currently Working On

Call for Papers (until November 4, 2026)

BaKuLe Symposium 2027: Architectures of Teaching and Learning

On April 7–8, 2027, the University of Bamberg hosts an academic conference on teaching in higher education; we are part of the organising team. We invite abstracts of up to 500 words – as a short talk, lightning talk, workshop session, show & tell or poster. Selected contributions appear in a special issue of the open-access journal “die hochschullehre”. The call is in German.

→ To the call for papers
Teaching (October 2026)

Companion Videos for Getting Started in Security

19 short videos on the terminal, networks and software security, each with a companion page for reading, with exercises and questions to check yourself. Students skip what they already know. Free to reuse under CC BY-SA 4.0.

→ To the companion videos
Keynote (September 22, 2026)

All Green. Someone Clicks.

Keynote at the workshop “Hochschule 2036: resilient” at the GI Informatik Festival in Dresden (in German). Why universities absorb disruptions so well that they learn nothing from them – two examples from Bamberg, including an exam format that worked and was never repeated.

→ Read the abstract
Award (August 27, 2026)

Best Paper Award at ARES 2026

“Detecting Bot Detection” was named best paper of the conference in Linköping. The measurement study across 10,000 websites shows that bot detection systematically biases web measurement research – and that 83% of papers at top venues do not report the problem. It was one of three full papers we presented at ARES 2026. The other two examine explanation formats in a hospital setting and GDPR barriers in the Privacy Range.

→ About the Paper
Tool (October 18, 2026)

psi-slides 2.1: Documents, Margin Notes, Dark Mode

One Markdown file yields the projection, a presenter cockpit, a reading document and a handout. New in version 2.1: documents that are read and never projected, such as a syllabus; margin notes now sit in the margin of the reading versions; reading versions come in dark mode and with or without serifs; a talk starts with a single command.

→ Try It Out
Project (July 2026)

Study-Start Portal: Field Report Published

More than 200 pages covering over 100 degree programs, built in eleven weeks with AI and reviewed by humans – initiated by the Chief Information Office. The field report covers the process, the numbers and the pitfalls, technical and organizational.

→ Read the Field Report
Tool (February 2026)

AI Policy Generator v3 for Teaching

Customizable text blocks for AI policies in courses.

→ Try It Out
Anniversary (June 26, 2026)

25 Years of WIAI – The Recap

Our team at the open day: a World Cup prediction game against 15 AIs, the plotting campaign 'Dein Muster', and seven student projects in the project workshop.

→ Read the Recap

What We Work On and What We're Known For

Illustration

Our work focuses on securing information systems and protecting privacy. We analyze existing systems and develop protection mechanisms. We combine technical analyses with user studies and work interdisciplinarily with law, psychology, and ethnography.

Research Focus

  • Explanations of data protection concepts
  • Crawling of websites and apps
  • Mechanisms for communicating security and privacy awareness
  • Privacy-friendly and secure e-assessments

Teaching & Transfer

  • More than 40 e-assessments per year with real tools
  • Exam booklet system for continuous learning incentives
  • inf.zone: All lecture content publicly accessible
  • Tools for educators (e.g., AI Policy Generator, psi-exam)

Research with Impact

Our Notification Studies (USENIX Security 2021) showed how to effectively warn affected parties. For his work on privacy in DNS, Dominik Herrmann was awarded the GI Dissertation Prize 2014, among other honors.

Award-Winning Teaching with Passion

Teaching Award from the University of Siegen (2016). Hackathons, Study and Code Spaces, and lecture hall games instead of frontal instruction. PSI Thesis Guide (55 pages) for compelling theses.

Transfer to Practice

3.1 million website checks conducted with PrivacyScore. Vulnerability discovered in 170 online pharmacies. Secure passwords explained comprehensibly for children. Commitment to consumer protection as member of the board of Stiftung Warentest.

How We Work

Context-First Messaging
We write directly what it's about and what we need – no 'hello' messages waiting for a response. This saves time and enables focused work.
→ https://nohello.net/
Meetings with Purpose
No meeting without an agenda, no agenda without expected outcomes. At the end, there are clear decisions and responsibilities.
High Standards, Transparent Support
High standards in exams and research. We provide extensive support, transparent criteria and rubrics, sample solutions, and early feedback.
Design & Clarity Matter
Aesthetics and good design reduce errors. Readability, clear structure, and well-thought-out interfaces are quality features for us that are just as important as content and functionality.
Challenge Assumptions
We enjoy questioning established practices and testing alternatives. The 'status quo' is not an argument for us. We love to experiment.
Ship and Iterate
Small steps instead of hesitation. Early feedback helps more than late perfection. We build, evaluate, and improve.
Systems over Solutions
We strive to build reusable infrastructures instead of one-off individual solutions.
Security with Understanding
No checkbox measures, no 'Cargo Cult Security,' but easily understandable security mechanisms and Defense in Depth. We prioritize effectiveness over formal compliance.
Privacy by Design
When we build systems, we embrace data minimization, purpose limitation, and transparency from the start. We use privacy-friendly techniques, consistently delete old data, and inform comprehensibly.