Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

131–140 of 203 posts

Re: We installed a single turnstile to feel secure

#131

Post by handoflixue »

angry_octet wrote: post #101
compass_copium wrote: post #86

Earlier quoted context omitted.

I care a lot more about my life (or my car's catalytic converter, which was stolen off my car in my work parking lot before they inatalled a gate for the lot) than any of my work-related IT credentials. Health and safety threats are a much bigger deal to people than nebulous, difficult to exploit threats to IP.

Except the turnstiles and swipe cards do almost nothing against an active shooter situation. But missing in this discussion is a risk and consequence analysis. If the risk is armed attackers, do something that targets that. For physical theft, target that. Likewise IT risks. The core problem is that risks were not being identified (systematically or in response to expert feedback) and prioritised. Incidentally, the s…

> The core problem is that risks were not being identified (systematically or in response to expert feedback) and prioritised.

Or the person who wrote the article just wasn't involved in that loop, or otherwise disagreed on what threat models mattered.

Re: We installed a single turnstile to feel secure

#133

Post by acchow »

Gigachad wrote: post #122
some_random wrote: post #116

Earlier quoted context omitted.

It's not actually the extreme punishments, it's the consistent small punishments. It's that you'll actually, seriously get a ticket for littering, even if it's a relatively small ticket. The "Fine City" enforces it's vision in a ubiquitous way, so people just don't break the rules.

This seems like the most effective solution. Imagine if you knew that if you littered, there is a 100% chance you would get a $10 fine immediately. Almost no one would litter ever again, even though the fine is much smaller than the fine is in most countries. Problem is it just takes a lot of resources to police, more than the fine revenue. But with CCTV and computer vision it's getting increasingly cheap.

> But with CCTV and computer vision it's getting increasingly cheap.

The barrier in the US isn't cost. It's a right to privacy and a culture of distrust of government.

Re: We installed a single turnstile to feel secure

#134

Post by rmunn »

brirec wrote: post #128
some_random wrote: post #116

Earlier quoted context omitted.

It's not actually the extreme punishments, it's the consistent small punishments. It's that you'll actually, seriously get a ticket for littering, even if it's a relatively small ticket. The "Fine City" enforces it's vision in a ubiquitous way, so people just don't break the rules.

The failings of the broken windows theory[1] would strongly disagree. [1]: https://en.wikipedia.org/wiki/Broken_windows_theory?wprov=sf...

So what are the failings? A quick skim through the Wikipedia article found plenty of criticism, but all the evidence I could find in my quick skim was in support of the theory. It's very likely I missed something in my skim; could you point to a specific section of the article where the evidence against the theory is presented?

Re: We installed a single turnstile to feel secure

#135

Post by rmunn »

akoboldfrying wrote: post #119
cortesoft wrote: post #117

Earlier quoted context omitted.

A lot of crimes are also committed by people who genuinely don't think about the consequences when they are acting. It doesn't matter how bad or how certain the consequence is, because they aren't thinking about it at all.

But apparently there are far fewer such people in Singapore. How would you explain this? I think the explanation is that growing up in an environment where even small infringements are consistently punished makes people think about the consequences more.

This is exactly right. People who get away with some rule-breaking, whether it's large or small, once will start to think maybe they can get away with it a second time. Get away with it a dozen times and you start to think you can get away with it every time, leading to the "people who genuinely don't think about the consequences when they are acting" that cortesoft mentioned. That sort of behavior isn't just a facet of personality, it's trained (or it might be more accurate to say, it wasn't trained out of them — all children act on impulse, it's the nature of children, but if their parents consistently punish them for sneaking cookies out of the cookie jar and they never get away with it, they eventually learn not to do it in the first place and to think about the consequences before they act).

So when a lot of people grow up in an environment where small rulebreakings are consistently caught and punished (the former is more important, can't punish what isn't detected), they learn from an early age that rulebreaking carries consequences nearly every time, and you end up with far fewer people willing to break the rules.

Re: We installed a single turnstile to feel secure

#136

Post by firefoxd »

Dylan16807 wrote: post #121
margalabargala wrote: post #94

Earlier quoted context omitted.

The part about Jira is important because it highlights that while the company claims to take security seriously, they in fact do not take it seriously. The incompetence of the turnstiles makes it a good focus for the story while the juxtaposition of the turnstiles with Jira exposes the company's hypocrisy.

What's the threat model for cookie theft? That if someone gets access to your company hard drive, but not enough access to install a keylogger, then instead of invalidating a session you also have to invalidate the password too? It's an issue but I wouldn't call it a particularly big issue. I don't think it's very damning for how much the company cares about security. And it sounds like the turnstiles did work for ac…

A threat model is you can steal the creds of any high clearance officer in the organization. If they reuse the password on the network, you now have unfettered access.

SSO is much more common these days, but that it wasn't the case back then.

Re: We installed a single turnstile to feel secure

#137

Post by [deleted] »

acchow wrote: post #133
Gigachad wrote: post #122

Earlier quoted context omitted.

This seems like the most effective solution. Imagine if you knew that if you littered, there is a 100% chance you would get a $10 fine immediately. Almost no one would litter ever again, even though the fine is much smaller than the fine is in most countries. Problem is it just takes a lot of resources to police, more than the fine revenue. But with CCTV and computer vision it's getting increasingly cheap.

> But with CCTV and computer vision it's getting increasingly cheap. The barrier in the US isn't cost. It's a right to privacy and a culture of distrust of government.

[deleted]

Re: We installed a single turnstile to feel secure

#138

Post by albert_e »

I feel both cases involved documentation, approval, months of lead time -- only the OP didnt have to deal with paperwork themselves in the physical securtiy domain.

In every sphere there are attempts at security that either achieve a practical balance of fit versus downsides.

The failure of access cards is probably analogous to a well intentioned sofware authentication system that was implemented without simulating or testing for the scale of deployment, and had to be rolled back when it failed in production.

Re: We installed a single turnstile to feel secure

#139

Post by cozzyd »

hinkley wrote: post #118
bombcar wrote: post #103

Earlier quoted context omitted.

The "I don't have to run faster than the bear; just faster than you".

PSA: If your buddy starts running from a brown bear, stand very, very still. They like to chase things and they're way faster than you are.

Also carry bear spray. Use it on your buddy.

Re: We installed a single turnstile to feel secure

#140

Post by cozzyd »

jp57 wrote: post #81

Am I the only one who finds this post weird because this is a solved problem? I've worked for 18 years at companies where everyone had to badge into every building. There have never been lines of people waiting to get in. Once I worked in a 12-story building. Of course, the badging wasn't in the elevators: the elevator lobbies on each floor had doors with badge readers. The feel of the piece is that the entire effort…

Yes, I sometimes work in the Hancock building in Chicago. The turnstiles are never congested.
Post reply on HN