一句话：通过138名开发者的对照实验发现，要求先写规范仅小幅提升密码存储安全性，开发者仍普遍不安全。
论文探究为安全敏感代码编写行为规范是否能促使开发者写出更安全的代码。作者招募138名开发者实现密码存储片段，其中一半在编码前被明确要求先写出代码行为规范，另一半直接编码。评估比较两组实现方案的安全性。结果显示，明确要求写规范对密码存储安全性仅有小幅正向影响；尽管开发者自称自信且了解相关方法，并能考虑一定威胁范围，仍经常采用不安全的密码存储方式。作者认为需要以开发者为中心、可用的指导机制，单纯列出“必须做什么”的清单效果不佳。
Does the act of writing a specification (how the code should behave) for a piece of security sensitive code lead to developers producing more secure code? We asked 138 developers to write a snippet of code to store a password: Half of them were asked to write down a specification of how the code should behave before writing the program, the other half were asked to write the code but without being prompted to write a specification first. We find that explicitly prompting developers to write a specification has a small positive effect on the security of password storage approaches implemented. However, developers often fail to store passwords securely, despite claiming to be confident and knowledgeable in their approaches, and despite considering an appropriate range of threats. We find a need for developer-centered usable mechanisms for telling developers how to store passwords: lists of what they must do are not working.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2102-09790,
title = {“Do this! Do that!, and Nothing will Happen” Do Specifications Lead to Securely Stored Passwords?},
author = {Joseph Hallett and Nikhil Patnaik and Benjamin Shreeve and Awais Rashid},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00053}
}