Emily Stark Email and Phone Number

- Manage a senior, highly distributed team of 16 software engineers and TPMs securing the web platform and transport. Scope includes Chrome's TLS stack and certificate verifier, BoringSSL (Google's TLS/cryptography library), Certificate Transparency, postquantum TLS/PKI, web platform security, and passkeys/WebAuthn.- Launched and lead the Chrome Root Program, which vets, set policy for, and monitors the CAs that are trusted to issue website certificates trusted by Chrome and other Google products.- Oversaw a series of product and engineering projects to make HTTPS the default protocol in the browser, e.g. eradicating mixed content, introducing HTTPS-First Mode as a user opt-in to require HTTPS, defaulting navigations to HTTPS, and phasing out the oft-misunderstood padlock icon.- Lead a consulting team of usable security experts providing design reviews for most user-facing Chrome features.- Contribute to Chrome Security generally (design- and code-level security reviews for new features, triaging externally-reported vulnerabilities) and academic community (program committee service, organizing workshops).- Experience growing and managing TLs and managers, interviewing/hiring for specialized roles, and building a team.

I lead a team that is responsible for providing Chrome with trustworthy, understandable encrypted and authenticated communications. We work on HTTPS certificate verification, the Web PKI, ecosystem improvements like Certificate Transparency, the TLS stack, and connection security UX (such as site identity in the address bar and certificate warnings)I also co-lead a cross-functional virtual team of usable security experts who provide consulting and security reviews across Chrome. Formerly, I led Chrome's usable security subteam.

Led development of Meteor developer accounts, an OAuth2 identity provider used across Meteor ecosystem, and projects to enhance framework security. Audited parts of Meteor core framework, internal infrastructure, and prominent third­-party packages to find and fix vulnerabilities. - Developed package for easily setting Content Security Policy and other security mechanisms. - Replaced PRNGs with CSPRNGs. - Added support for login token revocation and expiration. - Added support for hashing and encrypting login tokens, OAuth secrets, and other sensitive information in database. - Added context-­sensitive XSS filter for ‘javascript:’ URLs in client­-side rendering engine.Worked on a zero­downtime, auto­updating deployment system for internal applications.Gave talks on Meteor and Meteor’s security model at industry conferences and local meet-ups.

Research interests: web application security, applied cryptography, computer systems security.

Designed and built an HTML5 and Javascript library for performing cryptographic operations that isolates keys from application code.

Designed and built a system for spam monitoring in C++ and SQL Server.

Front- and back-end work on the beta of Kiln, a version control and code review product.