Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

61–70 of 203 posts

Re: We installed a single turnstile to feel secure

#61

Post by mikepurvis »

hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

What year was that? I was at a startup from 2010 onward and I'm pretty sure we had physical keys until about twelve people and after that it was straight to badges. There was never a time where you could just walk in.

Re: We installed a single turnstile to feel secure

#62

Post by Rapzid »

leephillips wrote: post #58
Rapzid wrote: post #57

Earlier quoted context omitted.

Turnstiles aren't theater and Redis doesn't make password storage secure so the entire thing seems a little el-el-emish.. But what about that sentence does that not make sense? They are describing tailgating..

It doesn’t make sense as a whole. But, for example, what was he suspicious of?

"I'd slip in suspiciously" means the "slipping in" was suspicious.

Re: We installed a single turnstile to feel secure

#63

Post by MrJobbo »

jez wrote: post #15

As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in…

Hand out weapons to the workers?

Re: We installed a single turnstile to feel secure

#64

Post by leephillips »

Rapzid wrote: post #62
leephillips wrote: post #58

Earlier quoted context omitted.

It doesn’t make sense as a whole. But, for example, what was he suspicious of?

"I'd slip in suspiciously" means the "slipping in" was suspicious.

You sure? I wasn’t.

“John regarded Mary suspiciously”

“Sharon suspected her husband of cheating. She looked through his emails suspiciously.”

Re: We installed a single turnstile to feel secure

#65

Post by dheera »

chihuahua wrote: post #20

Amazon is pretty serious about physical access security. Even back in 2002, you had to scan your badge while a security guard watches, to check if you are the same person as the badge picture. The same guard also checked if your dog was registered (I think my dog got a badge with his picture, although I think that was just for fun, and not functional) And no easy ability to enter through side doors - you couldn't ope…

I won't miss the days I had to take a full day of meetings from my car in the Amazon parking lot because there weren't enough meeting rooms onsite, but the badge swipes at the main entrance in-between meetings were needed to not be labeled as an "inconsistent badger".

It was laughable how much effort and money Amazon invested into badge tracking and enforcement instead of directing funds at making the office a nice place that people would want to spend time in and an efficient place to get work done.

Re: We installed a single turnstile to feel secure

#66

Post by hamdingers »

PunchyHamster wrote: post #40
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

How the fuck nobody notices some randoms coming to steal snacks in the first place ?

~400 person company spread across a few floors, but only one kitchen. It wasn't weird for people you didn't recognize to come off the elevator and get snacks to take back to their floor.

Re: We installed a single turnstile to feel secure

#67

Post by alexchamberlain »

I'm not going to comment on the security implications of either situation, but is there a companion piece by the facilities team complaining about the amount of paperwork required to install turnstiles only for a software engineer to come along and lock them out of Jira on a whim?

Re: We installed a single turnstile to feel secure

#68

Post by ryanjshaw »

Could have been worse. Anybody remember that story where the keycard readers would randomly work and eventually it was discovered the log file had grown huge and was being appended by reading the whole thing into memory over the network, appending the line, and writing the whole thing back out again, thus creating what the random pattern because I guess it would sometimes time out?

Re: We installed a single turnstile to feel secure

#69

Post by horeszko »

firefoxd wrote: post #45

Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The tu…

Perhaps part of the problem is that an active shooter is easy to visualize and understand whereas unsecured credentials stored in cookies are an abstract and difficult to visualize problem for management.

Furthermore, turnstiles are easy to promote and take credit for. Secure web authentication would have to be explained to and understood by the boss's boss before credit for it could be claimed.

I suspect it's these aspects of organizational reality that results in security theater.

Re: We installed a single turnstile to feel secure

#70

Post by hamdingers »

mikepurvis wrote: post #61
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

What year was that? I was at a startup from 2010 onward and I'm pretty sure we had physical keys until about twelve people and after that it was straight to badges. There was never a time where you could just walk in.

Late 2010s. We actually did have badges but the doors were only locked outside work hours, so nobody carried them.

The thief had to walk past a security desk in the lobby, take the elevator up to our floor, walk past a front desk to the kitchen, then open a door to get to the office area. Probably sounded like enough layers for whoever was in charge of security at the time, but both desks were frequently unoccupied during lunch.

I know we had cameras too, but I never got updates on the investigation. I suspect it was an employee at one of the other companies in our building.

Post reply on HN