4 ms·

Try asking your regular bank how their fraud detection works, or your insurance company, or the secret service. Basically if you work in fraud detection (or br

by ig1 14y ago

Try asking your regular bank how their fraud detection works, or your insurance company, or the secret service. Basically if you work in fraud detection (or broadly any kind of crime detection) you keep your techniques secret because otherwise you're helping the criminals avoid you. Look at the source code for Reddit or Hacker News, notice how in the publicly released codebases they've both chosen specifically not to publish the code to do with vote-rigging detection. There's a strong argument for secrecy.

vadiml 14y ago
The security by obscurity approach usually give you only an ILLUSION of security
- koenigdavidmj 14y ago
  Yes...once they figure it out, you still need to change your spam filtering/fraud detection methods. But if they have the algorithms, then they can figure out how to bypass it offline, on their own hardware, and you'll never now that it is happening until it is too late.
- jasonlotito 14y ago
  Security has nothing to do with fraud. And in combating fraud, obscurity works. SSL is security, but it's meaningless if the site you just sent your CC data to is fraudulent. Then, you need to understand how open PayPal is to fraud. I can easily commit major crimes using PayPal, and security has nothing to do with it. This is the challenge they face. If you think it's an easy problem to solve, ask yourself: why is there no one else out there doing this same thing? Why are all the other supposed opponents limited in such drastic ways that PayPal is not? I'm not suggesting they are perfect, but your trite remark is meaningless and ignorant of the realities of the system.
teyc 14y ago
+1 Also don't want to help competing services. Another data point - spammers used to check their work against spam assassin, fine tuning them. Another data point - leaked password databases are a source of heuristics for generating word lists.

by ig1 14y ago

vadiml 14y ago

The security by obscurity approach usually give you only an ILLUSION of security

koenigdavidmj 14y ago
Yes...once they figure it out, you still need to change your spam filtering/fraud detection methods. But if they have the algorithms, then they can figure out how to bypass it offline, on their own hardware, and you'll never now that it is happening until it is too late.
jasonlotito 14y ago
Security has nothing to do with fraud. And in combating fraud, obscurity works. SSL is security, but it's meaningless if the site you just sent your CC data to is fraudulent. Then, you need to understand how open PayPal is to fraud. I can easily commit major crimes using PayPal, and security has nothing to do with it. This is the challenge they face. If you think it's an easy problem to solve, ask yourself: why is there no one else out there doing this same thing? Why are all the other supposed opponents limited in such drastic ways that PayPal is not? I'm not suggesting they are perfect, but your trite remark is meaningless and ignorant of the realities of the system.

teyc 14y ago

+1 Also don't want to help competing services. Another data point - spammers used to check their work against spam assassin, fine tuning them. Another data point - leaked password databases are a source of heuristics for generating word lists.