Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

41–50 of 203 posts

Re: We installed a single turnstile to feel secure

#41

Post by hinkley »

avidiax wrote: post #32
nine_k wrote: post #29

Earlier quoted context omitted.

If forced partition of a building were the primary goal, that goal could be achieved without badges. Or, at least, without having to badge into every door. Just have locks on every door that are normally disengaged, but which can be locked remotely and promptly. (While at it, I once worked on an access control system. It was aeons ago; the system ran under OS/2. We installed it on a factory. It worked well, until we…

This actually exposes how this type of system is just security theater usually. A shooter can get a badge. Most partitions aren't bulletproof (and probably don't have security film), and a shooter doesn't fear getting a cut on some tempered glass. The thing that would be effective is 24/7 security monitoring with a building lockdown and reinforced entrances/partitions. Of course, the victims whose badges were disable…

Shooters tend to be mentally ill people who have been pushed too far by a system, trying to burn that system down.

Killing a boss with a keycard that opens everything might not just be possible but also preferable. Fuck you Tom, you made me work through memaw’s funeral

Re: We installed a single turnstile to feel secure

#42

Post by hinkley »

yannyu wrote: post #36
jez wrote: post #15

As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in…

If an active shooter is the anticipated threat, how does a turnstile effectively stop that? Many of these turnstiles are specifically meant to allow people through in emergencies, and aren't strong enough to withstand bullets or even a sturdy kick. The elevator restrictions would be a better chokepoint, but as the article noted they didn't turn those back on.

Many turnstiles can be jumped over. In this case it’s more about preventing theft and espionage.

I knew someone years and years ago who worked as an assistant to lawyers. The firm had a second office in the state capital, turns out someone was walking in and stealing laptops. I think they had done it three times the last I had heard.

Lawyer laptops going missing is a problem. I don’t know how they ended up fixing that.

Re: We installed a single turnstile to feel secure

#43

Post by mdavid626 »

I feel the same way. Once I worked with junior developer, who was really eager to develop stuff. He was tasked to create a development environment, where we can tests features. Nothing fancy, just some scripts and simple containers.

He used copies of the production database, but forgot to set the admin password. The machine in ec2, public on the internet.

It was fixed few weeks later. But the connection still doesn’t use SSL, sends passwords plain text.

Yeah, he doesn’t really like criticism about his work…

I always think about the phrase:

“Security is our highest priority”

Sure.

Re: We installed a single turnstile to feel secure

#44

Post by [deleted] »

SiempreViernes wrote: post #28
CydeWeys wrote: post #27

I'm not really sure what the point of this article is. Yes, obviously, you need to implement systems that are secure and performant so that you don't get a backed-up line of people waiting an hour just to get into the office in the morning. But that's a notably flawed rollout; millions of employees go into badge-in-required offices every day without issue. And it's kind of hard to imagine running a large office while…

Yeah, it got very strong "hello, I'm from the internet and this meatspace thing you are doing is wrong " vibes.

[deleted]

Re: We installed a single turnstile to feel secure

#45

Post by firefoxd »

Author here. I posted this on Sunday for a light read, but I guess it got traction today.

Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The turnstiles are not useless, they give an active record of who is in the building, and stop unauthorized people. But they also give so much comfort that we neglect the other types of threats.

Re: We installed a single turnstile to feel secure

#46

Post by OutOfHere »

If you as an employer are not doing physical engineering or working with large or unsafe physical objects, you don't need an office, period. For computer work alone, you don't need an office at all. If you fix the "office theater", the physical security problems disappear.

Re: We installed a single turnstile to feel secure

#47

Post by mystifyingpoi »

PunchyHamster wrote: post #40
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

How the fuck nobody notices some randoms coming to steal snacks in the first place ?

I work at a company of ~200 people and I already don't recognize everyone. Seeing an unknown face, I just assume they are from some distant team that I never had to interact with, say hi and move on.

Re: We installed a single turnstile to feel secure

#48

Post by mystifyingpoi »

kuhaku22 wrote: post #38
Normal_gaussian wrote: post #4

There is nothing here that really tells us the turnstile was security theatre? Or the various key card swipes. There are many ways to skin a cat; and there are many ways to ensure authenticated / trusted access. If you have site wide security gates, it means you know everyone on site / on a given floor conforms to a given minimal security or trust level, so now you can conduct operations in that area with more freedo…

> Obviously the implementation was botched in this case The long wait times could easily have been fixed by staggering employee start times. You could even optimize it per building/floor. Sadly, a lot of bureaucrats lack the imagination to do simple stuff like this. (Anyone with a desperate need to have 9 am meetings would just have to suck it up)

> staggering employee start times

Immediately reminds me of Severance.

Re: We installed a single turnstile to feel secure

#49

Post by SAI_Peregrinus »

xvedejas wrote: post #21
chihuahua wrote: post #20

Amazon is pretty serious about physical access security. Even back in 2002, you had to scan your badge while a security guard watches, to check if you are the same person as the badge picture. The same guard also checked if your dog was registered (I think my dog got a badge with his picture, although I think that was just for fun, and not functional) And no easy ability to enter through side doors - you couldn't ope…

> they locked all the side doors And this didn't get them in trouble with the fire marshal?

Instead of locking they could alarm when opened. Slap a big "Emergency exit only, alarm will sound" sticker on it & link it into the pull alarm system. Treat opening the door without an emergency the same as pulling a fire alarm without an emergency.

Re: We installed a single turnstile to feel secure

#50

Post by ARandomerDude »

Whenever I see this in practice I always think a determined killer would clearly know not to attack the “secure” building. Rather, attack the densely-packed line of people waiting to swipe their badges.

Unnervingly, this usually occurs to me when I’m waiting patiently in the densely packed line of fellow targets.

Post reply on HN