Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I agree that they should always try to give you a reason. But that's not as easy as it sounds.

Put yourself in the position of somebody who is trying to commit massive fraud. E.g., by purporting to sell a bunch of stuff on-line. Every bit of information you have about how PayPal combats fraud is helpful. Every time PayPal gives somebody a reason, it helps fraudsters avoid that particular wall or trap, letting them probe the defenses elsewhere.

It's a hard problem. PayPal solved it the wrong way, but they'll never get to full transparency.



>it helps fraudsters avoid that particular wall or trap, letting them probe the defenses elsewhere.

Couldn't you say make the same argument of proprietary vs open source software?


Yes. Does that make it untrue?


Not at all, but wouldn't the benefits outweigh the risks? Security by obscurity really isn't security at all.


Security by obscurity is very, very effective in the short to medium term, especially you're paying attention to people hacking around it and are continuously evolving your defenses.

Also, they've intentionally chosen a domain where full security isn't possible, mostly due to circumstances outside their control. Remember, they captured a huge new market mainly through the sophistication of their anti-fraud systems. So security through obscurity has to remain a major tool for them.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: