Hacker News Reader

Comment by laurent92 | Hacker News Reader

Worst scenario: The intern is malevolent. Counter: Credentials should be given progressively as trust is built (and as lessons are learnt), and an intern can’t have access to production.

I have an employee who I thought I could give more responsibilities, but he keeps not locking his computer when he walks away. He has very limited access to everything and it would impede his career if he didn’t also have the same attitude about other issues. (My question is, how do I make him diligent — It’s real potential wasted).

View on HN

At a company I used to work for, if someone left their computer unlocked, we'd send the donut emoji into the #everyone channel on slack from their computer, and they'd have to buy donuts for the office

This too but with croissants. It even became a verb. To croissant someone or be croissant-ed!

Edit: Also singing over the top praises of employees using the victim's account. "MonkeyButton is truly the best coworker I have ever had "

All this fun has gone away now with Covid and remote working.

You're french right ?

For us, it’s teapots. Inspired by the info set who noted his cube mate couldn’t learn to lock his screen and started sending, from his open laptop, “I’m a little teapot...” first to just him and then the wider org when he failed to adjust his behavior.

Oh! Story time!

We had a similar thing at one gamedev place that I worked at where and email would go out to the team if you left your computer unlocked(I forget the exact phrase but it was fairly silly).

We had shared offices and one of the programmers had the office right next to the kitchen. One day we all heard the senior programmer shout "WHAT THE FUCK!" and all ran over to see what had happened.

It turns out one of our engineers had walked into the kitchen and left his computer unlocked. The senior developer seeing this had opened up outlook, started a new message and began typing in the subject. What he didn't know is the developer had hand-rolled a keylogger with a match pattern for the message that everyone would send and dispatched Windows+L via key injection to the main window loop.

The trap was sprung and the machine locked right in front of him as he typed the last letter unable to send the email.

There was all sorts of other shenanigans at that place(like a fake "April 2nd" firing, they got the person who did that back with an annoy-a-tron over a 6 month period) but that was one of the more memorable ones.

I strongly recommend just sitting him or her down and explaining why this is a problem (you've articulated it well here). Either they get more diligent (great) they can't get more diligent (not great) or they refuse to be more diligent (really not great).

I think that there's sometimes a tendency to overthink management topics - there's no need to overthink this one.

Why is locking your computer at work a security concern? It's certainly another layer in the onion but a rather weak one and certainly not one worth losing someone over. If it's so big an issue, get him a smart watch that works with their OS of choice and enforce a bluetooth device locking policy.

Physical access is considered game over, no?

Right. There are some intense security environments where they also deal in airgaps and the like, but this is insane behavior at a regular job.

I agree, I’m sure it helps but seems like if a malicious coworker wants access they can trivially steal your password with a keylogger or just watching you type it in. May prevent spontaneous acts I guess but feels like if those are really a risk you’ve hired the wrong people.

It's actually a legitimate concern, and it goes far beyond coworkers embarrassing you in slack.

For example, posted yesterday: https://tailscale.com/blog/rotate-ssh-keys/ (https://news.ycombinator.com/item?id=26249380)

> One company had an employee they fired for bad behaviour. A few months later all their production servers got wiped out. ... A month later, it happened again! Everything gone.

> What happened was that the rogue employee, months before they were fired, had waited until everyone went to lunch, walked around from one PC to the next, and collected the ssh private keys from any of them that weren’t locked. ... Then, a while after getting fired, he used a co-worker’s ssh key to login and destroy everything.

Of course, screen locking would not prevent a determined, disgruntled (or desperate) employee from pulling off something like this, but it would stop the casual collection of secrets while everyone is at lunch. Add full disk encryption to PCs and you have a reasonable chance at defending.

Oh, and if you're doing anything with credit cards, PCI DSS requires you to enforce a workstation locking policy. Failing to do so opens you up to massive liability in the event of a breach.

This isn't a solution you can implement yourself since it sounds like you're in a position of power over the employee and it would be harassment. But having a culture where leaving computers unlocked and unattended is an open invitation to getting embarrassing YouTube videos opened on full screen by your peers works wonders for getting people to lock their computers.

I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work.

> I wish I had an answer for the second part; it's hard to see someone with talent be the one to get laid off after months of asking them to be more diligent in their work.

Oof, this hits close to home. I don't have an answer either.

How on earth is it harrassment to tell a subordinate that he needs to improve his security habits?

The harassment would be the doing embarrassing things with the unlocked computer. A manager or team lead shouldn't be picking on their employees like that. It's something more OK for a peer to do. Ironically, it's the interns who I've seen get into it the most and make it a game. They really got a kick out catching the full timers.

You were replying to laurent92, who didn't say anything like that (picking on employees or embarrassing them); that was this other comment, which was replying to laurent92:

https://news.ycombinator.com/item?id=26286183

Well I've heard of one office that had an established rule that any unlocked laptop could be used to promise the rest of the team free cake on behalf of the person that forgot to lock their laptop.

If nothing else at least it promotes awareness (and cake!).

2-factor authentication allows you to bias yourself towards suspecting malevolence.

It's reasonably believable that they leaked their password because. Interns.

And the second factor?

Have you explained this to him?

Further, have you really listened to his explanation of why he isn't bothered about locking his computer?

It might be that in your organisation this is a cargo-cult security practice that he's not bothered by because he knows it's not an effective practice.

Or it could be that he knows he doesn't have enough permissions to do any damage, so he doesn't bother locking his computer. Trusting him with a little responsibility might change that.

It's too bad you are on here disparaging a current employee.

Reply on news.ycombinator.com