Recognizing faces doesn't help much when somebody who got fired last week without security knowing comes back to sabotage the networking equipment.
I work at a place in the centre of a large city in the UK. Security is hot on badges. I especially know this as I smoke, so going downstairs every couple of hours needed a signing in/out session. To be fair it reduced my habit quite a bit.
Now i've got a proper badge - I can flash anything I like, including my drivers license, or my debit card. The mere act of coyly moving something on a lanyard to them is sufficient, especially now i've explained that i've got noise cancelling headphones so I sometimes cannot hear.
The best bit? There are government departments in the building on a floor below us.
Even better - I used to work at a company that used to be part of the security services in the UK but were spun-out. They still work with the doughnut down the road.
In heightened security times they do random checks of cars - mirrors underneath, etc. All I had to do was say "you checked me yesterday" and they'd not bother.
Social norms trump process every time.
My pass used to be checked every day for years, in an office of only 1k people, and a line-manager was the only person who could sign you in without it.
Have you seen our president's twitter account? Some bigwigs like to shit on the little people.
HN needs to become i18n compliant.
If the organization has people that actually care about security they would praise them for practicing good security.
definitely one of the more significant parts of the social engineering toolkit.
If you can't swipe to get in you sign in. period.
The problems occur in dysfunctional organisations where senior management expect to be exempt from their own rules. Expecting the rules to be bent for your own convenience gives your subordinates tacit permission to bend the rules. Someone who has bent the rules for their boss is far more likely to bend the rules for their buddy. If you're asking people to do inconvenient things, you have to lead by example.
Any business kinda deserves it if they don't de-authorize their card as soon as they're terminated.