1,020 reputation
615
bio website nohat.net
location San Jose, CA
age 34
visits member for 4 years, 3 months
seen Nov 19 at 6:54

Full disclosure: I have a degree in linguistics, and so I am partial to descriptivist approaches to questions of usage. For me, assertions of correctness or incorrectness that are not reflective of actual usage are highly questionable.

I am a native speaker of American English.


Sep
10
awarded  Yearling
Feb
1
awarded  Popular Question
Sep
10
awarded  Yearling
Dec
11
awarded  Pundit
Nov
20
awarded  Nice Answer
Sep
10
awarded  Yearling
Aug
21
comment What does the suffix after software engineer/developer job titles mean? (e.g. Software Developer III)
Those BLS descriptions for computer programmers and systems analysts appear to have been written in the 1970s and not updated since, as they seem to presume that the only use of computers is for corporate data processing.
Aug
3
comment Storing plaintext passwords for detecting fraud
@Ramhound, calling everyone idiots sure is a really compelling argument. "Ramhound from programmers.stackexchange.com says we're all idiots for considering this, so I guess we should go back to the drawing board." That'll really convince management.
Aug
3
comment Storing plaintext passwords for detecting fraud
Just to be clear, I'm not suggesting there are no consequences for password breaches. I'm just suggesting that the received software engineering "religion" that password breaches are catastrophic, death-penalty type situations for a company is, perhaps, an exaggeration of reality. It seems doing a careful balance of the risk/reward for doing what was proposed seems like a smarter business strategy than just dismissing it out of hand for being computer security heresy.
Aug
3
comment Storing plaintext passwords for detecting fraud
@Ramhound there are many ways to detect fraudsters, but password matching has determined to be correlative and thus valuable as part of a comprehensive fraud scoring system. We can detect fraud without it, but we can detect more fraud with it, saving the company more money.
Aug
3
comment Storing plaintext passwords for detecting fraud
@Ramhound, I am interested in answers to my question, but suggestions to change the unchangeable in the scenario aren't very helpful.
Aug
3
comment Storing plaintext passwords for detecting fraud
@James Dunno why anyone thinks my employer is a "small retailer". But, for example, LinkedIn just reported exceeding their revenue expectations for the quarter after having a worst-case scenario password security breach.
Aug
2
comment Storing plaintext passwords for detecting fraud
@Jordan It wasn't my idea. It was presented by a fraud detection consultancy we hired as a high-value signal for a fraud detection system. I warned that it was a bad and insecure idea, but fraud is a major concern right now and my concerns may be overruled. Given that scenario, I was asking how I could best maintain security.
Aug
2
comment Storing plaintext passwords for detecting fraud
@SoboLAN what consequences? LinkedIn reports today that they exceeded revenue forecasts in the same quarter they had their catastrophic password security breach: reuters.com/article/2012/08/02/…
Aug
2
revised Storing plaintext passwords for detecting fraud
clarify the specific question I am asking at the bottom
Aug
2
comment Storing plaintext passwords for detecting fraud
I'm just suggesting that the calculus of risk in this scenario is more complicated than this answer implies.
Aug
2
comment Storing plaintext passwords for detecting fraud
@EricKing if management has decided they're going to do this, I can either be the one to do it, or quit. If my professional responsibility extends to the customers, then don't I have a moral imperative to be the one to implement this, as safely as is possible, given the constraints? If I quit in protest, someone who cares even less about security than me will implement it, putting those customers at greater risk.
Aug
2
comment Storing plaintext passwords for detecting fraud
@Giorgio nothing, password matching is just a signal in a complex fraud scoring system. However, part of the fraud response is mitigating signals to users that we even think their use is fraudulent. Detected fraudulent use just results in vague and generic error messages.
Aug
2
comment Storing plaintext passwords for detecting fraud
@Giorgio we have found that fraudulent purchasers create a new account for each purchase but often use the same password.
Aug
2
comment Storing plaintext passwords for detecting fraud
Even in the case of worst-case scenario password security breaches (LinkedIn, eHarmony, Last.fm) it's not clear that there have been substantial revenue impacts.