Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We installed a single turnstile to feel secure

idiallo.com

Post reply on HN
Print view View original

81–90 of 203 posts

Re: We installed a single turnstile to feel secure

#81

Post by jp57 »

Am I the only one who finds this post weird because this is a solved problem? I've worked for 18 years at companies where everyone had to badge into every building. There have never been lines of people waiting to get in. Once I worked in a 12-story building. Of course, the badging wasn't in the elevators: the elevator lobbies on each floor had doors with badge readers.

The feel of the piece is that the entire effort was misguided, when the real story seems to be, "My company was somehow unable to implement something that every other company does easily."

Re: We installed a single turnstile to feel secure

#82

Post by tetha »

avidiax wrote: post #32
nine_k wrote: post #29

Earlier quoted context omitted.

If forced partition of a building were the primary goal, that goal could be achieved without badges. Or, at least, without having to badge into every door. Just have locks on every door that are normally disengaged, but which can be locked remotely and promptly. (While at it, I once worked on an access control system. It was aeons ago; the system ran under OS/2. We installed it on a factory. It worked well, until we…

This actually exposes how this type of system is just security theater usually. A shooter can get a badge. Most partitions aren't bulletproof (and probably don't have security film), and a shooter doesn't fear getting a cut on some tempered glass. The thing that would be effective is 24/7 security monitoring with a building lockdown and reinforced entrances/partitions. Of course, the victims whose badges were disable…

One uncomfortable, but wise truth is: Actual security is bound to the number of minutes until people with big guns arrive. A lot of other measures just exist to bridge time and limit damages until that happens.

We learned this during a funny situation when a customer sent us the wrong question set for vendors. We were asked to clarify our plans for example for an armed intrusion by an armed, hostile force to seize protected assets from us. After some discussion, we answered the equivalent of "Uh Sir. This is a software company. We would surrender and try to call the cops".

During some laughter from the customer they told us, the only part missing from that answer was the durability rating of our safes and secure storages for assets, of which we had none, because they just had to last until cops or reinforcements arrived. That was a silly day.

Re: We installed a single turnstile to feel secure

#83

Post by fc417fc802 »

hinkley wrote: post #42
yannyu wrote: post #36

Earlier quoted context omitted.

If an active shooter is the anticipated threat, how does a turnstile effectively stop that? Many of these turnstiles are specifically meant to allow people through in emergencies, and aren't strong enough to withstand bullets or even a sturdy kick. The elevator restrictions would be a better chokepoint, but as the article noted they didn't turn those back on.

Many turnstiles can be jumped over. In this case it’s more about preventing theft and espionage. I knew someone years and years ago who worked as an assistant to lawyers. The firm had a second office in the state capital, turns out someone was walking in and stealing laptops. I think they had done it three times the last I had heard. Lawyer laptops going missing is a problem. I don’t know how they ended up fixing tha…

> Lawyer laptops going missing is a problem.

It shouldn't be. If there was a particular profession that I would expect to properly secure their devices lawyers would be near the top of the list.

Re: We installed a single turnstile to feel secure

#84

Post by mikey_p »

Macha wrote: post #34
jez wrote: post #15

As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in…

I doubt these card readers would prevent someone leaving the part of their building they’re in, as that’s a lesson written in charred corpses and was a foundational aspect of health and safety becoming a thing: https://en.wikipedia.org/wiki/Triangle_Shirtwaist_Factory_fi... In theory it might prevent access to other buildings, but equally often the card readers are around doors of mostly standard glass or near intern…

Or the Victoria Hall disaster (183 dead), or Cocoanut Grove (492 dead), or The Station Nightclub (100 dead), or The Beverly Hills Supper Club (165 dead), or.....

Also in what world is a badge reader going to contain an armed gunman unless the walls, floors, doors, and windows are also bulletproof??

(Triangle shirtwaist fire resulted in 146 dead)

Re: We installed a single turnstile to feel secure

#85

Post by latexr »

firefoxd wrote: post #45

Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The tu…

> Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there.

You titled the piece after the turnstiles and spent the overwhelming majority of the post talking about them (and surrounding physical features). The Jira ticket felt secondary, and when it was introduced in the middle of the post I was genuinely confused, thinking why the heck the card system was contacting Jira.

People reading your writing are going to focus on whatever you did when you wrote it. The turnstiles read like the important part.

Re: We installed a single turnstile to feel secure

#86

Post by compass_copium »

firefoxd wrote: post #45

Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The tu…

I care a lot more about my life (or my car's catalytic converter, which was stolen off my car in my work parking lot before they inatalled a gate for the lot) than any of my work-related IT credentials. Health and safety threats are a much bigger deal to people than nebulous, difficult to exploit threats to IP.

Re: We installed a single turnstile to feel secure

#87

Post by [deleted] »

fxtentacle wrote: post #73
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

I once lived in Singapore for a while and we were all sure that nobody would steal anything anyway, so we just never bothered to lock the doors. (That was also very helpful if you wanted to stop for a quick coffee with a date in the middle of the night.) You could see the MacBooks from the street, but nothing ever went missing. I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.

[deleted]

Re: We installed a single turnstile to feel secure

#88

Post by nkrisc »

PunchyHamster wrote: post #40
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

How the fuck nobody notices some randoms coming to steal snacks in the first place ?

I worked somewhere with a few hundred employees across 3 floors. If someone wearing business casual walked onto our floor I would have no idea if they worked for us or not.

Re: We installed a single turnstile to feel secure

#89

Post by ThrowawayTestr »

fxtentacle wrote: post #73
hamdingers wrote: post #9

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was…

I once lived in Singapore for a while and we were all sure that nobody would steal anything anyway, so we just never bothered to lock the doors. (That was also very helpful if you wanted to stop for a quick coffee with a date in the middle of the night.) You could see the MacBooks from the street, but nothing ever went missing. I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.

>I don’t know what exactly it was, but Singapore felt incredibly safe and crime-free.

The extreme punishments for breaking the law might have something to do with it.

Re: We installed a single turnstile to feel secure

#90

Post by XorNot »

bombcar wrote: post #78
hinkley wrote: post #39

Earlier quoted context omitted.

No, the model there is something bad happened, we must do something. This is something, so we will do it. I’m not saying that to diminish the value of the actual solution, but what the people want is literally something to make them feel better about a situation that is mostly out of their control. Someone showed up to their workplace with a fucking gun. And now they have to go there every day, and hope it doesn’t ha…

This is exactly it - most "security" isn't really built around actual threat models, nor is it ever verified. IT security is perhaps the weirdest in the world in that the security of your web server will be constantly probed, whilst your front door could go your entire lifetime and never be probed once. Where people actually care about physical security, they develop things that do actually work ; and often are so un…

Except a decent part of security is literally just deterrence.

Will my front door stop someone robbing my house if they want to? No: I have sidelight windows you could just smash them and come through.

But the one time a house I was in got robbed, it was because we left the front door open and went out.

Which is odd if you think about it right? Statistically an open front door rather implies someone is home, not away so it's a terrible targeting priority - but our house was targeted and not say, our neighbors who also wouldn't have been home that day.

People are quick to claim security theater, talk about threat models, but equally ignore them anyway.

Post reply on HN