Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

101–110 of 203 posts

Re: We installed a single turnstile to feel secure

#101

Post by angry_octet »

compass_copium wrote: post #86
firefoxd wrote: post #45

Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The tu…

I care a lot more about my life (or my car's catalytic converter, which was stolen off my car in my work parking lot before they inatalled a gate for the lot) than any of my work-related IT credentials. Health and safety threats are a much bigger deal to people than nebulous, difficult to exploit threats to IP.

Except the turnstiles and swipe cards do almost nothing against an active shooter situation.

But missing in this discussion is a risk and consequence analysis. If the risk is armed attackers, do something that targets that. For physical theft, target that. Likewise IT risks. The core problem is that risks were not being identified (systematically or in response to expert feedback) and prioritised.

Incidentally, the solution to car park access is ALPRs, and the solution to most of the physical security is solid core doors at the workgroup level with EACS swipe and surveillance cameras there, and at the front desk have face level 4k video surveillance. With an on duty guard to resolve issues with access.

Re: We installed a single turnstile to feel secure

#102

Post by XorNot »

formerly_proven wrote: post #31
Normal_gaussian wrote: post #4

There is nothing here that really tells us the turnstile was security theatre? Or the various key card swipes. There are many ways to skin a cat; and there are many ways to ensure authenticated / trusted access. If you have site wide security gates, it means you know everyone on site / on a given floor conforms to a given minimal security or trust level, so now you can conduct operations in that area with more freedo…

Card readers in elevators are theater though. You would need separate vestibules to actually secure entry via elevator. That’s why most buildings have those.

Are they? The goal isn't to draw a hard boundary it's to create layered defenses which increase the difficulty and reduce opportunity.

If instead of open access you need to tailgate on a limited set of employees, that increases difficulty considerably and makes the opportunity much less common.

Real security analysis works this way: you don't assume you can build a wall which is never breached.

Re: We installed a single turnstile to feel secure

#103

Post by bombcar »

XorNot wrote: post #90
bombcar wrote: post #78

Earlier quoted context omitted.

This is exactly it - most "security" isn't really built around actual threat models, nor is it ever verified. IT security is perhaps the weirdest in the world in that the security of your web server will be constantly probed, whilst your front door could go your entire lifetime and never be probed once. Where people actually care about physical security, they develop things that do actually work ; and often are so un…

Except a decent part of security is literally just deterrence. Will my front door stop someone robbing my house if they want to? No: I have sidelight windows you could just smash them and come through. But the one time a house I was in got robbed, it was because we left the front door open and went out. Which is odd if you think about it right? Statistically an open front door rather implies someone is home, not away…

The "I don't have to run faster than the bear; just faster than you".

Re: We installed a single turnstile to feel secure

#104

Post by StopDisinfo910 »

ThrowawayTestr wrote: post #89
fxtentacle wrote: post #73

Earlier quoted context omitted.

I once lived in Singapore for a while and we were all sure that nobody would steal anything anyway, so we just never bothered to lock the doors. (That was also very helpful if you wanted to stop for a quick coffee with a date in the middle of the night.) You could see the MacBooks from the street, but nothing ever went missing. I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.

>I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free. The extreme punishments for breaking the law might have something to do with it.

I don't think it explains everything.

I think social norms have a lot to do with it. It's like the actual social costs of being the one who broke the social trust is so high it dissuades people.

It worked for me on a lower level. Everyone cut queues and will grab an empty seat if it looks available at a packed restaurant here so I do it too but I never did that when I lived in Singapore because I knew that's not how things work there and people would genuinely be mad at me for doing it.

It's like a self-fulfilling, self-improving environment. Same with Japan and cleanliness.

State provided housing for most and a booming economy with low unemployment must help too.

Re: We installed a single turnstile to feel secure

#105

Post by glitchcrab »

margalabargala wrote: post #94
latexr wrote: post #85

Earlier quoted context omitted.

> Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. You titled the piece after the turnstiles and spent the overwhelming majority of the post talking about them (and surrounding physical features). The Jira ticket felt secondary, and when it was introduced in the middle of the post I was genuinely confused, thinking why the heck the card system was cont…

The part about Jira is important because it highlights that while the company claims to take security seriously, they in fact do not take it seriously. The incompetence of the turnstiles makes it a good focus for the story while the juxtaposition of the turnstiles with Jira exposes the company's hypocrisy.

I believe like that was the intent, but the (very few) mentions of Jira feel like a bit of a non sequitur; they don't belong.

Re: We installed a single turnstile to feel secure

#106

Post by XorNot »

TYPE_FASTER wrote: post #60
Izkata wrote: post #54

Earlier quoted context omitted.

And then there's full-body turnstiles. Ugly, but good luck bypassing that.

Put on a UPS/FedEx uniform, put somebody in a box, and drop them off at receiving.

So they can die from dehydration while we spend 3 days trying to figure out who ordered the weird coffin sized box no ones coming to claim?

Re: We installed a single turnstile to feel secure

#107

Post by jiggawatts »

“If the security is not in your face, then it’s not sufficiently theatre!”

That’s a quote I tell security people in jest when they suggest yet another door literally or figuratively slamming in someone’s face to let them know that there is a security procedure in place.

Seriously though, “security” is an overloaded word used for two unrelated business goals:

1. Having security.

2. Appearing to have security.

The latter is strongly preferred by management that just wants someone else or something else to blame.

To reiterate: this isn’t an error! It’s done on purpose.

Re: We installed a single turnstile to feel secure

#108

Post by jiggawatts »

fxtentacle wrote: post #73
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

I once lived in Singapore for a while and we were all sure that nobody would steal anything anyway, so we just never bothered to lock the doors. (That was also very helpful if you wanted to stop for a quick coffee with a date in the middle of the night.) You could see the MacBooks from the street, but nothing ever went missing. I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.

I used to accumulate a pile of change on my desk from buying coffees.

Never got touched across about a hundred different offices around Australia (I’m a consultant).

Except once: the pile was replaced by a $50 note and a hand written apology saying the guilty party needed change for the parking lot machine. I had less than $30 there in coins so… profit!

Re: We installed a single turnstile to feel secure

#109

Post by wredcoll »

ThrowawayTestr wrote: post #89
fxtentacle wrote: post #73

Earlier quoted context omitted.

I once lived in Singapore for a while and we were all sure that nobody would steal anything anyway, so we just never bothered to lock the doors. (That was also very helpful if you wanted to stop for a quick coffee with a date in the middle of the night.) You could see the MacBooks from the street, but nothing ever went missing. I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.

>I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free. The extreme punishments for breaking the law might have something to do with it.

> The extreme punishments for breaking the law might have something to do with it.

Historically speaking, this is almost never true. People constantly think the solution is crueler punishments and we have hundreds of years of records of what happens.

Re: We installed a single turnstile to feel secure

#110

Post by mikepurvis »

hamdingers wrote: post #70
mikepurvis wrote: post #61

Earlier quoted context omitted.

What year was that? I was at a startup from 2010 onward and I'm pretty sure we had physical keys until about twelve people and after that it was straight to badges. There was never a time where you could just walk in.

Late 2010s. We actually did have badges but the doors were only locked outside work hours, so nobody carried them. The thief had to walk past a security desk in the lobby, take the elevator up to our floor, walk past a front desk to the kitchen, then open a door to get to the office area. Probably sounded like enough layers for whoever was in charge of security at the time, but both desks were frequently unoccupied d…

Interesting. I feel like most places still make you badge into the doors during business hours, and even specifically encourage not permitting tailgating, sometimes tied to a purported safety concern around being able to know who is in the building in an emergency... though honestly at most shops I bet no one has any idea how to get a report like "everyone who has badged in in since 6am this morning".
Post reply on HN