Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

141–150 of 203 posts

Re: We installed a single turnstile to feel secure

#141

Post by closeparen »

The corporate security theater that kills me is insisting that everyone tap their badge on the reader next to an already-open door. Even in the presence of a guard, this merely ensures that everyone passing through the open door has some object, plausibly badge-shaped, to hold near the reader. Essentially any NFC card will make it beep. Only a valid credential will actuate the lock, but the door is already open, and the click is too subtle for its absence to alarm anyone.

There is a device you can deploy if you're serious about ensuring that every single individual in a moving crowd has a valid credential... a turnstile! Assuming you've calculated the appropriate number of them for the expected traffic flow.

Re: We installed a single turnstile to feel secure

#142

Post by Dylan16807 »

firefoxd wrote: post #136
Dylan16807 wrote: post #121

Earlier quoted context omitted.

What's the threat model for cookie theft? That if someone gets access to your company hard drive, but not enough access to install a keylogger, then instead of invalidating a session you also have to invalidate the password too? It's an issue but I wouldn't call it a particularly big issue. I don't think it's very damning for how much the company cares about security. And it sounds like the turnstiles did work for ac…

A threat model is you can steal the creds of any high clearance officer in the organization. If they reuse the password on the network, you now have unfettered access. SSO is much more common these days, but that it wasn't the case back then.

Steal the creds by doing what, though? Most attacks could get their password even if it wasn't in the cookie.

And password managers have been plenty well known for a long time.

Re: We installed a single turnstile to feel secure

#143

Post by crazygringo »

> I waited in line for at least 30 minutes just to make it to the lobby... Scanning was already slow, you had to wait to be approved. But once you passed the turnstile, there was another line for the elevators.

I'm baffled. I've worked in multiple buildings with turnstiles. There's never been a line. They take about a second to scan. Is this just some horrible broken implementation?

I get why they're used. They protect randos from walking in and stealing stuff. It's not about "feeling" secure. When you have someone make off with 10 laptops, it's actual security. And that's before you start worrying about more serious threats that come from plugging in USB keys...

Re: We installed a single turnstile to feel secure

#144

Post by firefoxd »

Dylan16807 wrote: post #142
firefoxd wrote: post #136

Earlier quoted context omitted.

A threat model is you can steal the creds of any high clearance officer in the organization. If they reuse the password on the network, you now have unfettered access. SSO is much more common these days, but that it wasn't the case back then.

Steal the creds by doing what, though? Most attacks could get their password even if it wasn't in the cookie. And password managers have been plenty well known for a long time.

How do you get the password if it's not in the cookie? When it's in the cookies, any 3rd party script can swipe it.

Re: We installed a single turnstile to feel secure

#145

Post by tolerance »

acchow wrote: post #133
Gigachad wrote: post #122

Earlier quoted context omitted.

This seems like the most effective solution. Imagine if you knew that if you littered, there is a 100% chance you would get a $10 fine immediately. Almost no one would litter ever again, even though the fine is much smaller than the fine is in most countries. Problem is it just takes a lot of resources to police, more than the fine revenue. But with CCTV and computer vision it's getting increasingly cheap.

> But with CCTV and computer vision it's getting increasingly cheap. The barrier in the US isn't cost. It's a right to privacy and a culture of distrust of government.

I think that barrier may be weakening. I reckon that the people most concerned about crime are willing to sacrifice their privacy and defer to their government to prevent crime.

Re: We installed a single turnstile to feel secure

#146

Post by atulatul »

PunchyHamster wrote: post #40
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

How the fuck nobody notices some randoms coming to steal snacks in the first place ?

Another aspect besides not recognizing everyone from your company is like this- even if someone knows for sure that a person from a different company is helping themselves to snacks, people are may avoid pointing it out. People may prefer to avoid conflicts or make someone else look bad. They are more likely to act if they see someone stealing from their desk, home, etc. That's kind of their domain.

Also, a few other things may also be there- people won't make noise if someone steals snack packets, but they may make noise if someone steals laptops.

Also, if one person steals it may get pointed out more than if a lot of people steal- where stealing is culture, etc.

Re: We installed a single turnstile to feel secure

#147

Post by wtallis »

XorNot wrote: post #102
formerly_proven wrote: post #31

Earlier quoted context omitted.

Card readers in elevators are theater though. You would need separate vestibules to actually secure entry via elevator. That’s why most buildings have those.

Are they? The goal isn't to draw a hard boundary it's to create layered defenses which increase the difficulty and reduce opportunity. If instead of open access you need to tailgate on a limited set of employees, that increases difficulty considerably and makes the opportunity much less common. Real security analysis works this way: you don't assume you can build a wall which is never breached.

I'm not sure the problem with card readers is that it's security theater, so much as it's a really inconvenient place to put the security check so the added security is not at all worthwhile. Putting the card readers on each floor so that you need to swipe immediately after exiting the elevator separates the security check from all the ordinary functions of an elevator, and splits up that security checking across a large number of floors instead of a smaller number of elevators. Everyone still needs to go through the same number of layers of security checks, but those checks aren't being imposed directly on top of what's already a bottleneck.

So the lesson that should be familiar to software developers is: retrofitting security (in the elevator) instead of planning for it from the start (with space for access controls between the elevator and the offices) will tend to make the security more painful than it could have been.

Re: We installed a single turnstile to feel secure

#148

Post by yellottyellott »

tolerance wrote: post #145
acchow wrote: post #133

Earlier quoted context omitted.

> But with CCTV and computer vision it's getting increasingly cheap. The barrier in the US isn't cost. It's a right to privacy and a culture of distrust of government.

I think that barrier may be weakening. I reckon that the people most concerned about crime are willing to sacrifice their privacy and defer to their government to prevent crime.

Some people, sure.

But I think the shenanigans of ICE are making people more aware of the importance of privacy. Look at the backlash Ring (lost dog superbowl ad) and Discord (age verification) and Nest (Guthrie case) received just this year.

Re: We installed a single turnstile to feel secure

#149

Post by UltraSane »

Epic the EMR company in Verona Wisconsin is pretty unique in that during work hours The entrances to all office buildings do not require RFID cards. The Epic campus is enormous with almost 14,000 people with relatively high turnover so a random non-employee isn't likely to be noticed. I even kept my ID card in my wallet and was never reprimanded. The RFID readers were all at perfect rear pocket height.
Post reply on HN