Hacker News Reader

Comment by ziddoap | Hacker News Reader

>Isn't the automatic reaction of a Windows desktop/laptop user to lock their workstation

Having attempted to encourage this as a habit for my users for about a year, and not a single one doing it, I've had to come up with other solutions that takes it out of their hands. (It's not business-critical for us, however we try to encourage good security habits all around).

So no, I don't think it is an automatic reaction for the majority of people. Although, this is government - so I would have expected a bit more rigor. Perhaps working in a home environment contributed to relaxing of security habits.

Side note: Windows + L was a bit easier to remember than Ctrl+Alt+Del -> Enter -> Enter for the users who made good faith efforts at making it a habit

View on HN

So what you do is take a screenshot of whatever's open on their computer, close it, then set the screenshot as their desktop wallpaper. Also hide their icons for good measure. This should start a cycle of escalation and retaliation that eventually gets the whole office locking their PCs.

In the past, for me, this has caused needless friction and fostered an adversarial relationship between IT/security staff and everyone else.

We weighed our options and decided that it was a battle we would rather not waste our effort and risk staff animosity with. When a more serious security incident occurs, or when we decide to implement something else that may require staff effort, we believe that our staff will be more willing to work with us towards a solution.

Sometimes with security policy, a little give (proportional to risk analysis) can go a long way with non-technical staff. I'd rather work with staff to come up with processes that work for both the security staff and all other staff members than become so rigid in my security policy that I may inadvertently alienate the security staff - which has many risks itself.

It can be done in a bit less adversarial and nicer way than making them deal with an annoyance of "troubleshooting" their desktop. Which, I found, makes things much easier and more frictionless.

In my old office, we had this team "tradition" that was supposed to encourage people to lock their desktops. If they left their office for whatever reason and left their desktop unlocked, anyone from the team jumps up to the machine. Then they send an email to the rest of the team on behalf of the person who left their desktop unlocked, saying that they are bringing cookies to share with the team tomorrow.

It worked out well for quite a few years, with people being more mindful about locking their machines. And their "punishment" for not doing so was just sharing cookies with the rest of the team the day after and hearing a couple of jokes about the situation. Overall, very positive experience, no one got upset about anything, because their machines themselves weren't screwed with, their work productivity wasn't lost due to it, and everyone shared a moment and baked goods.

IIRC, the trick is practical jokes! Change desktop backgrounds, move icons around, leave goofy/giant text Word documents, etc.

That is so true. I struggled to develop the habit and then ended up on a team that did this (mainly send silly emails from the victim’s account). It’s over a decade later and I still hit the lock combo every time I get up.

...or invite the whole team for a beer via e-mail. :)

Or Slack everyone with "I'm a noob!"...

Muhaha.

I can think of other broadcast communications that would get people fired.

Uh, back in high school a schoolmate found a huuge genitalia as desktop background on their laptop since they left it unattended and unlocked.

I can tell you, that person never left that thing unlocked ever again.

I did the same cca. 2001 to a fellow female coworker. She had a big Excel document that day and was under pressure to finish it from her boss (well, our boss). She went to toilet and that's all it took me to set it, then maximize back her Excel document. She unaware worked for next hour and then when she finished she called the boss, which was across the room on his desktop, to verify it. The fun part came when I asked for something from her desktop and she had to minimize Excel. She went red in the face and the entire office burst in laughter for next 5 minutes, the boss included. After that day she learned WIN+L.

At my old job the tradition was to send an e-mail promising to bring pastries for the team the next day.

Some more:

Change their profile photo (github/slack/etc).

Flip their monitor orientation.

Swap to left-handed mouse buttons (or vice-versa).

Go on Amazon and add some "interesting" things to their wishlist/cart.

Go on Youtube and "like" a bunch of random videos.

I miss the good old days of Vista where there was a straight keyboard command to change monitor orientation. It was something like win+shift+arrow so everyone would prank each other with it until it was removed.

I remember that. Part of the Intel Graphics driver kit. W10 is pretty good about including basic drivers so that is probably when it stopped working for you. The shortcut still works for anyone who's gone through the hassle of installing Intel's drivers.

I installed this app on my roommate's laptop in college one time when he left it unlocked and would run it every time he left it unlocked after that: https://www.macupdate.com/app/mac/26793/ipanic

It took several months for him to catch on; for a while I had him convinced that his hardware must have an issue where the laptop being left idle for too long caused it to mess up somehow.

   alias ls=echo "Segmentation Fault"

Hahaha.

    source ~/.bashrc

At my high school, it was to create a folder with an… incriminating name. Then, screenshot the desktop, delete the folder, and then set the background to the screenshot.

When the …mark… sits down, inevitably with several… "witnesses" behind them, who then point out in "astonishment" the folder on their desktop, they try (in vain) to highlight it to delete it.

(Not appropriate for the workplace, of course.)

Also, scotch tape is not transparent to optical mice? and blocks the sensor. Had that one pulled on me once, took a while to figure it out.

Windows had "Dynamic lock" for a while now, which would automatically lock PC when a Bluetooth device goes out of range (e.g. typically smartphone or smartwatch).

Can't it be required by a group policy?

Probably. IIRC, GPOs can include arbitrary registry keys and can have custom policies. I maybe dated in this area, though.

It also has a timed lock, which I have seen applied as a group policy.

> I've had to come up with other solutions that takes it out of their hands.

I guess this means setting the timer really low, so that it auto locks after a very short time?

>I guess this means setting the timer really low, so that it auto locks after a very short time?

The IT department at my former employer tried this out company-wide and it almost led to them getting attacked physically. When every simple distraction leads to you getting locked out of the desktop (phonecall, boss or coworker having a question) it builds frustration quickly. Pair this with frequently changing (company-mandated) complex passwords and permanent lockut after a few mistypes and you have a recipe for disaster: Even some of my technologically less-inclined co-workers researched how to bypass Windows security with hacking tools.

I think the problem there is the password policies more than the screen-locking policy. The locking policy is just shining a spotlight on the password policy issues.

On top of that, the IT department was unavailable on Fridays after 3 PM.

I've seen a usb hid mouse jiggler used in exactly this set of circumstances.

Haha.

I used to work at a nuclear energy services consultancy. I heard a story about how an energy think-tank had particular rooms with power-saving motion occupancy sensors for the lights. The problem was sitting still at a computer would result in the lights suddenly going off. An engineer solved this problem with a drinking bird toy with a warm bowl of water right at the level of the sensor.

https://en.wikipedia.org/wiki/Drinking_bird

It would happen at the wrong time, IMO.

People don't like having to type in their password each time they come back to the computer. Especially if their password is required to be fairly long and complex, which can become tedious to have to type in constantly during the day.

If you want users to adopt secure practices then you have to lower the amount of friction. Adding a fingerprint reader or some other kind of biometrick unlocking capability would probably help.

A better example: I think on macOS the system can be setup to automatically lock and unlock by wearing an Apple Watch.

The users aren't the ones that have to be trained, it's the flawed security practices that need to be fixed.

Look into Windows Hello for Business. It's very nice in the enterprise for all of this. Native facial recognition or fingerprint, and various other factors can be added.

Causes all sorts of hell with Remote Desktop, however. But it’s the right direction.

For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.

How so? In my experience you are prompted to use it, and you can click and use standard credentials if desired.

I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought.

Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)

I enabled Hello on my VM Windows 10 Enterprise and then was unable to connect via Remote Desktop from my Mac - so it didn't have single sign-on but it wouldn't fall back to anything I could use. So I disabled it and now it's happy.

Thanks. I'll test this in the morning. AFAIK it works for us, but I don't know for sure.

Which RDP client were you using? And did you disable the password provider (leaving just the WHfB factors)?

And you had full Windows Hello for Business? (This one: https://docs.microsoft.com/en-us/windows/security/identity-p...)

Or, were you using standard Hello? (The two are similarly named, but are quite different under the covers.)

Reply on news.ycombinator.com