Hacker News Reader

Comment by maccard | Hacker News Reader

> In pre-COVID-19 days, IT handling that kind of request would have required it to come in face-to-face. But since everyone's working from home, that's intractable.

In pre covid times it wasn't uncommon for people in my office (which didn't have a dedicated onsite IT person) to ping IT on slack for the person sitting next to them to ask for a PW reset.

Face to face doesn't solve anything. If there's a 2000 person company and you can get into the building, chances are you could walk up to the IT desk and say "hey my name is John Doe I'm an engineer here and I locked myself out of X, can I get a reset?" And you'd be given it without any verification

View on HN

The one time I locked myself out hard at work and had to go "in person" for a password reset, I had to show ID even when the person who was resetting my password knew me by sight. And this was well over a decade ago.

And in all but the smallest companies I've worked for, you needed a card swipe at the door (or an escort) to pass from public to internal areas.

This is just really, really basic physical security stuff.

That might be true at some companies, but has not been my experience at 3 different companies.

> And in all but the smallest companies I've worked for, you needed a card swipe at the door (or an escort) to pass from public to internal areas.

And once you're past the barrier of those internal areas, you're unlikely to be questioned in all but the most strictly controlled places.

In my case, everyone is supposed to be visibly wearing their company ID, on a necklace/lanyard or something like that. However even if challenged without one, "oh sorry, I left my ID at my desk" is likely to work. However everyone but brand-new employees is a least vaguely familiar to everyone else, so I'm not sure how easily a complete stranger would be able to move around.

Previous company I worked at had a policy that you needed to include a photo of yourself with the current date written with any PW reset request, but of course that doesn't work as well at a 2000 person company as at a 100 person startup where IT knows everyone's face.

Plus that's still vulnerable to googling photos of the employee you're impersonating and photoshopping a piece of paper with the date.

If you’re over 2000 employees, there’s little excuse for not requiring a badge scan to queue for all IT desk interactions. That scan should display name and photo to both desk workers and on a ‘now helping’ screen others can see.

It’s not foolproof, but it’s incredibly difficult to prevent tailgating because people don’t want to start an incident by incorrectly challenging a coworker. I’ve heard of it somehow happening even with card turnstiles, double door scans and required photo confirm by lobby security.

If you walk up to the IT desk, they should check your identity. (At least for security-sensitive things like password resets or locked accounts.)

Most employees have a photo badge, so they could scan that and look up your records in the HR database. If you've lost your badge, they could ask your name and look that up in the HR database, which hopefully has a photo on file.

Most 2,000 person office buildings have security guards and doors/gates/turnstiles that won’t let just anyone waltz in.

Right, but once you get past that area nobody will question it. In the same way that someone who works for your company on slack pings you, you assume they work for your company.

In the companies that I am familiar with the internal space has doors and every single door opens only with a badge

I think more than 50% of people would let you tailgate their badge

A lot of people in this thread are acting like it’s super hard to get through or in. You can “social engineer” your way in.

I did it accidentally once at a big hedge fund sort of company. I thought I was being escorted by my friend’s friend. But it was actually just some one familiar with them/their names not fully understanding what I was saying letting me thru the ~3? Times a badge scan was required. I wasn’t paying attention. Only when my friend got scared he would get in trouble did I realize what had happened.

Risk profiles and scale for Slack attacks vs in person soc eng are way different.

Reply on news.ycombinator.com