Code Reviewing as Methodology for Online Security Studies with Developers - A Case
summary
Online study asks freelancers to review Java password-storage snippets instead of writing code, with 44 freelancers from Fiverr split into prompted vs unprompted groups; snippets use plaintext, base64, MD5 (all insecure). Median completion time is 83 minutes. Only 13/44 explicitly flag the password-storage problem, prompting significantly increases security mentions, and almost half are willing to release insecure code; authors propose a hybrid review+fix task to balance realism and cost.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:33Security Developer Studies
- 2:00Fiverr freelance developers (n=44)
- 3:07Regarding the password storage issue....
- 3:33Password related issues
related talks
05mReplication: On the Ecological Validity of Online Security Developer Studies
09mLet’s Hash: Helping Developers with Password Security
13mWrite, Read, or Fix? Exploring Alternative Methods for Secure Development Studies
28mStandard Classification: How To Review Code For Vulnerabilities
55mIs this okay!? How to review code for security issues
01h 02mCode Review For Security
58mThreat Modeling Developer Behaviour: The Psychology of Bad Code
40mKEYNOTE: Delivering software that is secure & usable - who’s job is it?