Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

11–20 of 203 posts

Re: We installed a single turnstile to feel secure

#11

Post by CoffeeOnWrite »

ableal wrote: post #6
CoffeeOnWrite wrote: post #2

Allegations of security theater should start with discussing the threat model. This is just somebody complaining about a crappy key card system.

To be fair, he was pointing out that the invisible "credentials in cookies" issue was much harder to get fixed: The turnstiles were visible. They were expensive. They disrupted everyone's day and made headlines in company-wide emails. Management could point to them and say that we're taking security seriously. Meanwhile, thousands of employees had their Jira credentials stored in cookies. A vulnerability that could e…

Again, not security theater. Signs of general dysfunction yes. Embarrassing. Fun to tease about for sure.

Aside: the more times I re-read the article the more annoyed I am with the self-righteous tone. It feels like the author is mimicking the style of legendary Usenet posts, but the story just isn’t that interesting and the writing not that witty, it falls flat.

Re: We installed a single turnstile to feel secure

#12

Post by mcbits »

CoffeeOnWrite wrote: post #11
ableal wrote: post #6

Earlier quoted context omitted.

To be fair, he was pointing out that the invisible "credentials in cookies" issue was much harder to get fixed: The turnstiles were visible. They were expensive. They disrupted everyone's day and made headlines in company-wide emails. Management could point to them and say that we're taking security seriously. Meanwhile, thousands of employees had their Jira credentials stored in cookies. A vulnerability that could e…

Again, not security theater. Signs of general dysfunction yes. Embarrassing. Fun to tease about for sure. Aside: the more times I re-read the article the more annoyed I am with the self-righteous tone. It feels like the author is mimicking the style of legendary Usenet posts, but the story just isn’t that interesting and the writing not that witty, it falls flat.

The writing is clearly AI-generated or at least AI-assisted, so I think it's safe to assume it's also a work of fiction.

Re: We installed a single turnstile to feel secure

#13

Post by Liftyee »

Lift (elevator) sidenote: there are fancy well designed ones where the turnstile communicates what floor you need to go to to the lift, and a "destination dispatch" system assigns/batches groups of passengers with similar/same destinations to the same lift car to improve efficiency.

Re: We installed a single turnstile to feel secure

#14

Post by robomartin »

Interesting. I have worked in ITAR environments with serious security and have never experienced 30 minute lines at the door. In fact, I can't remember lines at all. Hard to understand what happened here.

Was it really a single turnstile for a building with over 10 floors? That's kind of silly, isn't it? Mass transit operations have this figured out. Most recently for me, taking the monorail in Las Vegas for the CES show. No problems for the most part. It would be interesting to know what this company actually installed.

Re: We installed a single turnstile to feel secure

#15

Post by jez »

As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about.

It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in while law enforcement arrives,” less than preventing someone from coat tailing their way into the building at all.

[1] https://news.ycombinator.com/item?id=16748529

Re: We installed a single turnstile to feel secure

#16

Post by nine_k »

This text is another reminder about the fact that as organizations grow, they become more and more dysfunctional. They function despite that, because the economies of scale are apparently still larger than the loss of functionality due to the increased size.

Humans' most important achievement is the ability to create structures larger than the Dunbar number. But this is not achieved for free.

(And this is another reason why I strive to work at startups more than at huge corporations.)

Re: We installed a single turnstile to feel secure

#17

Post by mikeryan »

Normal_gaussian wrote: post #4

There is nothing here that really tells us the turnstile was security theatre? Or the various key card swipes. There are many ways to skin a cat; and there are many ways to ensure authenticated / trusted access. If you have site wide security gates, it means you know everyone on site / on a given floor conforms to a given minimal security or trust level, so now you can conduct operations in that area with more freedo…

It also doesn’t describe any of the why the additional security measures were put in place. It sounds arbitrary, but could be an insurance or regulatory requirement that the acquiring company needed to meet. Similar for the login issue, it’s suboptimal but what constraints caused that solution to be put in place? And why wasn’t it fixed?

Sans context there’s not a lot to complain about here.

Re: We installed a single turnstile to feel secure

#18

Post by summermusic »

CoffeeOnWrite wrote: post #11
ableal wrote: post #6

Earlier quoted context omitted.

To be fair, he was pointing out that the invisible "credentials in cookies" issue was much harder to get fixed: The turnstiles were visible. They were expensive. They disrupted everyone's day and made headlines in company-wide emails. Management could point to them and say that we're taking security seriously. Meanwhile, thousands of employees had their Jira credentials stored in cookies. A vulnerability that could e…

Again, not security theater. Signs of general dysfunction yes. Embarrassing. Fun to tease about for sure. Aside: the more times I re-read the article the more annoyed I am with the self-righteous tone. It feels like the author is mimicking the style of legendary Usenet posts, but the story just isn’t that interesting and the writing not that witty, it falls flat.

If it isn't outright fake it's at least embellished. It even has the "and then everyone clapped" line!

Re: We installed a single turnstile to feel secure

#19

Post by Scubabear68 »

Many years ago I was doing due diligence on a point of sale hardware company, I had to head up to an acquisition they had done. People bitched and moaned about the level of physical security added, and when I asked them why they were so upset, they told me to go to the loading dock in the back.

The loading dock was kept completely open "because it's hot and we don't have A/C back here!".

Re: We installed a single turnstile to feel secure

#20

Post by chihuahua »

Amazon is pretty serious about physical access security. Even back in 2002, you had to scan your badge while a security guard watches, to check if you are the same person as the badge picture.

The same guard also checked if your dog was registered (I think my dog got a badge with his picture, although I think that was just for fun, and not functional)

And no easy ability to enter through side doors - you couldn't open a side door with your badge. At the time, you could still lurk outside a side door until someone else opens the door to exit. Eventually (11 years later) they locked all the side doors because they noticed people doing this sort of thing.

More recently, I think you have to scan your badge to leave so they can even track how long you're in the building, and know when you're supposed to work on site but you were there only long enough to have a coffee and then went home to continue working from home. This last part is second-hand knowledge since I haven't work there in a long time.

Post reply on HN