Live data from Hacker News

Passwords and Power Drills

google.github.io

11–20 of 32 posts

Re: Passwords and Power Drills

#11
Sorry for the offtopic comment, but it's bizarre to me that Google is hosting their book on Github with a github.io domain. Their previous two SRE books are hosted at https://sre.google on Google-owned IPs.[0]

What was that decision process? "We're Google, and we're literally writing a book about how good we are at hosting services. But hosting some static HTML files that are almost entirely text? That's a tough one. We'd better outsource that to one of our competitors."

[0] https://sre.google/books/

Re: Passwords and Power Drills

#12
post #8

> It took an additional hour for the team to realize that the green light on the smart card reader did not, in fact, indicate that the card had been inserted correctly. I'm not sure which is worse: bad UI/UX use of lights, or inadequately trained engineers who misunderstood the lights.

I'd go with bad UI/UX.

A lot of progress has been made by acknowledging that people are idiots and that the system has to work around that. Toyota, which went from one of the worst to one the most reliable automaker is known for formalizing idiot-proofing.

If the reader was able to read the card both way, there wouldn't have been a problem and no training required. The next best thing would be for the card to not fit upside down. Or have a clear message "try flipping the card". It is not something you should train people for, it should be obvious.

I also suspect the reader was in an unusual configuration, because everyone knows how to use smart cards and they probably did what they always do instinctively and it didn't work. On the thousands of times I did it, I don't remember having ever inserted my credit card the wrong way and don't remember anyone who did, it is just so instinctive. For an entire team to miss that, there must be something wrong with how the reader is set up.

Re: Passwords and Power Drills

#13
post #11

Sorry for the offtopic comment, but it's bizarre to me that Google is hosting their book on Github with a github.io domain. Their previous two SRE books are hosted at https://sre.google on Google-owned IPs.[0] What was that decision process? "We're Google, and we're literally writing a book about how good we are at hosting services. But hosting some static HTML files that are almost entirely text? That's a tough one.…

I think one is a portal for GitHub developers, while the other is a public polished site. I reminisced the early Google forthright attitude that made life so simple and human.

Re: Passwords and Power Drills

#14
post #9

Earlier quoted context omitted.

Sorry, but someone happening to have memory of the combination can also not be considered an adequate solution.

He clearly had the combination written down

The text says "Fortunately, another colleague in California had memorized the combination to the on-site safe". You might think that's unlikely and he probably wrote it down, but it's not "clear" from the text.

Re: Passwords and Power Drills

#16
post #12
post #8

> It took an additional hour for the team to realize that the green light on the smart card reader did not, in fact, indicate that the card had been inserted correctly. I'm not sure which is worse: bad UI/UX use of lights, or inadequately trained engineers who misunderstood the lights.

I'd go with bad UI/UX. A lot of progress has been made by acknowledging that people are idiots and that the system has to work around that. Toyota, which went from one of the worst to one the most reliable automaker is known for formalizing idiot-proofing. If the reader was able to read the card both way, there wouldn't have been a problem and no training required. The next best thing would be for the card to not fit…

Agree.

The fundamental lesson of at least half my information systems undergraduate courses was you adapt the system to observed user behavior, do not expect the user to adapt their behavior to the system.

Re: Passwords and Power Drills

#17
post #8

> It took an additional hour for the team to realize that the green light on the smart card reader did not, in fact, indicate that the card had been inserted correctly. I'm not sure which is worse: bad UI/UX use of lights, or inadequately trained engineers who misunderstood the lights.

If it's not obvious to multiple Google SREs and no instruction sticker was present, that's a bad UI.

Re: Passwords and Power Drills

#20
> restart required a hardware security module (HSM) smart card.

Out of curiosity, does anyone know why? My guess would be the PW DB would be encrypted with some token generated from this card.

I've had lots of "I have a secret and the server needs it" type problems but I've never been very happy with my solutions- smart cards seem like potentially an elegant solution.

Post reply on HN