Evan Schuman's StorefrontBacktalk

Well, the NRF issued its final official tally Thursday (Jan. 14): an increase of 1.1 percent. For our team, which never did better than a C- in economics class, that ain't too shabby. For the record, we knew the figures would be released about now and were fully prepared to eat crow if we had to. Glad we got it a lot closer than the NRF did. Personally, we hate eating crow.Read more...

But as long as you're coming, we'd love to ask you to drop by some of the StorefrontBacktalk events and do what our readers do best: yell at us. The first shouting opportunity will be at the RetailROI event at the Marriott East Side (Lexington and 49th) on Saturday at 2:45 PM. This charity event (www.retailroi.org) is designed to raise money for global orphan care and adoption support. But to do that, we get geeky for awhile. Our panel is on retail security and it starts at 2:45 PM and features the CIO of the world's largest restaurant group: Delaney Bellinger from Yum Brands (Pizza Hut, KFC, Taco Bell and Long John Silver's, among others). Also on the panel are two of our esteemed columnists (Franchisee Columnist Todd Michaud and PCI Columnist Walt Conway) plus Mark Rasch, the former head of the U.S. Justice Department's high-tech crimes division.Read more...

The truth is that the influence of age, income and background are trivial—in terms of projecting how long that person will wait for a page to display—when compared with something much more personal: Why is that person trying to access that Web page right now? If they're in an airport trying to find an alternative to a snowed-in flight, they have little choice but to be patient. Or a 16-year-old trying to download a new hot song. And if it's a consumer merely browsing to kill time? Almost any delay will make that consumer flee.Read more...

A San Mateo, Ca., consumer was browsing Amazon.com and he saw a CD-ROM from the Discovery Channel called Cells. It only supported Mac and Win98 so it’s price was a mere $5 million more than $2.9 billion. Yes, this piece of educational software was selling for almost $3 billion, plus $3.99 for shipping. (Geez, how much does Amazon require now for Free Super Saver Shipping?) Just for the fun of it, the consumer—Brian Klug—purchased it. Not only did Amazon’s system process the item at the $3 billion charge, but it sent a clean confirmation note. Even the credit card’s limit didn’t trigger any “this doesn’t seem right” alarms. The screen captures of the purchase have been widely posted.

Posted price glitches can happen, even to as sophisticated a site as Amazon. But the fact that it went through a credit card process—the card wasn’t charged until the product arrived, but it was verified—and an E-mail confirmation suggests that this glitch is a bigger concern than it might appear.…

In tracking PCI issues within various major chains, we have seen that the differences in perception can be staggering. In an attempt to get a handle on where most companies stand, we’re putting out a small survey on usage and challenges.

As a thank you for retailers involved in PCI completing the survey, we are offering them a free autographed copy of Hacking Exposed: Network Security Secrets, which Amazon has labeled a best-seller.

[SURVEYS 2]

John Verdeschi, the senior business leader for fraud management at MasterCard Worldwide, said he had heard "no complaints" about the timing from retailers. "We didn't hear that as a specific issue," he said, adding that the PCI SCC's new training program was the only reason for the deadline change. Another element of the December 13 change is a little less cut-and-dry. Until about three to four months ago—Verdeschi described it as "August or September"—MasterCard had posted on its site a description of the rules for which PCI level (1, 2, 3 or 4) it would consider retailers. MasterCard described parity with any "competing payment brand," wording that it had used since 2005. But in "August or September," Verdeschi said, that wording was removed.Read more...

Kathleen Edmond, the chain's Chief Ethics Officer and an attorney, thinks it's not only realistic, it's indeed about survival and profit-retention. A common theme among Edmond's examples is that even a moment that seemingly serves the interests of both the buyer and the seller may be unethical and ill advised. "If you're going to use someone's lack of sophistication in a way to benefit you and they've not objected, that doesn't mean that it's the right thing to do," she said. "There were throngs of people signing up for mortgages that were not good for them." Was it ethical for banks to approve loans to consumers if the banks knew that it was unwise in those cases?Read more...

The first MasterCard change made this month was pushing the Dec. 31, 2010, deadline back six months, to June 30, 2011. But MasterCard has also made two other key PCI changes. It has redefined what Level a retailer is (Level 1, 2, 3 or 4) to, for the first time, mirror whatever level Visa has determined. The last of the changes is to allow Level 1 and Level 2 retailers to perform their own assessments—using the retailer's own salaried audit staff—as long as those audit staffers have passed PCI-approved training courses. "A bunch of Level 3 and Level 4 merchants just became Level 2s," said one QSA. "With this reciprocity gotcha, MasterCard giveth and MasterCard taketh away."Read more...

Weak security at RockYou.com, a social networking application development site, allowed unauthorized access to more than 32 million user log-in credentials stored in an unencrypted database, according to the site’s chief technology officer. The SQL injection flaw allowed access to those credentials, and because “the user names and passwords are by default the same as the user’s Webmail account—such as Hotmail, Yahoo or Gmail—this is a major lapse in security,” said Amichai Shulman, the chief technology officer at Imperva, a data security vendor that detected the problem and alerted RockYou officials, but not before the data theft had happened.

RockYou publicly acknowledged the breach Wednesday (Dec. 15), warning users to change their log-in credentials for other “online destinations” if they are the same as those used for RockYou.com. In a Venturebeat.com story on the incident, RockYou CTO Jia Shen said the problem involved RockYou’s legacy widget applications, a part of the site now closed, and he admitted the passwords had been retained unencrypted. Gartner Security Analyst Avivah Litan said retailers should view the case as a warning about the potential pitfalls of the single ID movement. “This just proves the theory that if you use an aggregator and have single sign-on to multiple sites, all it takes is a break-in to compromise your access to everything else,” Litan said. “Everybody should take a pause on these single-user schemes.”…

It boggles his mind that millions of dollars are spent each year to “secure” database lookup (authorization) and database write (settlement) transactions. Tokenization and encryption should have been required years ago. Although not all techies agree that this approach is best, I think we all agree that it is much better than nothing. But too many companies--my firm included--are going to have to spend too much money to implement such daydream adventures, so we keep living with a broken system. Unfortunately, this broken system has left franchisors with no “good” options.Read more...

Kroger nearly scraped the bottom of the barrel during the comparison, landing in the eighth place from the bottom of Sitemorse's list with a yawn-inspiring average response time of almost 1.5 seconds. How bad is that speed. "The general view of Sitemorse is that anything more than 250 milliseconds—a quarter of a second—is failing," a Sitemorse statement said.Read more...

Gonzalez agreed to plead guilty to his role in attacks on Heartland, Hannaford and 7-Eleven in a document signed at 10:14 AM New York time on Dec. 2.Read more...

It’s been almost two years since Sears become the first U.S. retailer to embrace 2D barcodes, a move that launched a tidal wave of, well, pretty much nothing. This week, Google said it was trying to breathe life into these barcodes by mailing 200,000 2D barcode stickers to small businesses throughout the country. Such a move could allow these mom-and-pops to offer in-depth marketing information to anyone at the click of a smartphone.

The Google initiative, first reported by Techcrunch, is proactive and therefore feels much more powerful than Microsoft’s efforts to market its “Tag” code idea. And Google is sweetening the potential adoption-rate odds by giving away 40,000 Quickmark 2D barcode reader apps for the iPhone. Just like contactless, which is also suffering from a heart-pounding string of apathy, 2D needs three things to happen in parallel if it is to succeed: A huge number of places that are showcasing 2D barcodes; a very strong percentage of consumers carrying phones that can easily read 2D barcodes; and plenty of publicized incentives to get those consumers to use the 2D barcodes from those retailers. The phones are well on their way, and Google’s initiative seems like a good faith effort to jumpstart the other two points.…

Still, the Shopper app, published by ReachEverywhere, suffers a variety of odd restrictions, such as limiting the recall data to two food-oriented agencies—the U.S. Food and Drug Administration (FDA) and the U.S.. Department of Agriculture (USDA)—while excluding recall-friendly agencies that would impact far more products, such as the U.S. Consumer Product Safety Commission (CPSC). It also only flags recall problems when the purchase is being made. So a customer who buys a product that gets recalled an hour after the purchase is completed will, by design, not be notified. Read more...

Problems at the Walgreens site began at 1:09 P.M. (New York time), according to site monitoring company AlertBot. The site remained either offline or slow to respond until about 2:16 P.M. But even after it came back to life, the site suffered sporadic similar issues throughout the afternoon.Read more...

Buying items on Tesco.com, the E-Commerce site of the $84 billion, U.K.-based supermarket chain, is a bit like being a virtual marionette operator. When a Web shopper places an order, Tesco employees actually grab shopping carts and pluck items from shelves as they stroll up and down aisles in Tesco stores. Most of those online order fulfillment missions are currently conducted in busy, public Tesco markets also occupied by meandering shoppers. But Tesco is so pleased with its use of customer-free “dot-com store” installations–facilities nearly identical to its regular markets, except that are for use only by Tesco.com order-fillers–the chain plans to erect a large network of them, according to the Daily Telegraph of London.

It said Tesco now has two so-called “dark stores” up and running, one in Surrey and another in Kent, and plans to open a third, next year, in Middlesex. Laura Wade-Gery, Tesco.com CEO was reported as saying the company intends to open one new online order fulfillment store yearly “for the foreseeable future” and expects the employee-only structures will be handling 15 percent of online order fulfillment by 2014. Tesco currently processes 475,000 online orders weekly and operates a 2,000-van fleet for home deliveries, said the Telegraph.…

A J.C. Penney representative on Wednesday (Dec. 2) night blamed the glitch on high traffic. "Due to the overwhelming customer response to our Cyber Monday deals, the checkout portion of the site slowed down Monday night into early Tuesday morning and, in some cases, customers were unable to complete their orders," said J.C. Penney spokesperson Tim Lyons. "To make up for any inconvenience this caused our customers, we extended the Cyber Monday pricing and ‘free shipping on $25 or more’ offer through Tuesday night."Read more...

The case involves four Louisiana restaurant groups—doing business as Crawfish Town USA, Don's Seafood and Steakhouse, Picante’s Mexican Restaurant, Mel’s Diner Part II and Sammy’s Grill—suing their POS vendor, Radiant Systems (which owns the Aloha POS systems used by these chains), along with systems integrator Computer World (not to be confused with the publication Computerworld). But when you drill into the details of the lawsuit, it gets more interesting. One of the key accusations against Computer World is that it used vendor default passwords for systems with many of these restaurants, for easier remote administration. The lawsuit correctly points out that PCI bans retailers from using such vendor default passwords. But that's the key. It's the retailers that are not permitted to use these defaults. Was integrator Computer World, in this scenario, acting as an agent of the POS manufacturer—as a reseller—or as an agent of the retailer--as an integrator?Read more...

It's for that reason the word trickling out of Google saying page load speed will likely become a criteria in how sites rank is noteworthy. Google Software Engineer Matt Cutts spoke at PubCon last month and said that a speed-influenced ranking won't happen in time for this holiday season, but it's seriously being considered for early next year. "We're starting to think more and more about 'Should speed be a factor in Google's rankings?'" Cutts said. "Historically, we haven't used it in our search rankings, but a lot of people within Google think that the Web should be fast. It should be a good experience, so it’s sort of fair to say 'If you're a faster site, maybe you should get a little bit of a bonus.'"Read more...

Making these figures all the more interesting is that they happened on the much ballyhooed Black Friday and not the National Retail Federation-created Cyber Monday, which is supposed to be the grand day of E-Commerce. Not that it ever was the highest E-Commerce day, but it has typically made a bit of online noise. This year, though, beyond a handful of small tech glitches, Cyber Monday was hardly noticeable. I think About Retail put it best when it opened its story with this lovely poem: Twas the night before Cyber Monday and all through the 'net, hardly a new special was posted - did the e-tailers forget.Read more...

But there's a way to fix this. Historically, many franchisees have not been allowed to launch their own Web sites, have a Twitter feed or do a blog about their stores. Michaud used to believe that it was extremely dangerous to let franchisees have their own voice on the Internet. Today, he embraces it. It's not only good for business, but it's the first step in IT becoming a coach, an instructor. In short, becoming someone other departments see as a partner and not as mere interference.Read more...

Dotcom-Monitor noticed a glitch at Bloomingdales' site during the day. At one point, Bloomingdales.com displayed a message that said something to the effect of 'Please Stay With Us,' while the homepage took a long time to load, said Brad Canham, vice president of business development at Dotcom-Monitor. "Their standard response time is less than a half-second, but they did have one thing happen there," he said.Read more...

The secret to the most successful mobile sites is pure simplicity, the lesson that Google's homepage tried teaching the industry. For example, I often find that Amazon's mobile app beats—with many seconds to spare—my much higher powered desktop riding over the same broadband connection looking at Amazon's Web site, so the idea that it would come out on top is not surprising. Making this accomplishment even more impressive, according to Gomez, is that—in general—chains' mobile site page load averages are more than "50 percent slower than the average response times" of those same chains' traditional Web sites.Read more...

It’s one of the oldest pieces of security guidance: The biggest threats are always from a company’s employees, not from intruders. But popular perception has never supported this truth because outside intrusions are comparatively highly publicized while internal threats are generally dealt with secretly, with a termination and an offer to avoid prosecution if the thief remains silent.

But T-Mobile this month reminded us of how serious an internal threat can be. In what U.K. authorities are dubbing one of the biggest data breaches in that country’s history, a resourceful (although ethically challenged) T-Mobile employee is accused of taking millions of pieces of customer data and selling it to company rivals. This situation is the subject of StorefrontBacktalk’s security column this week on the new McAfee security blog.…