Hacker News Reader

Comment by black6 | Hacker News Reader

There is a OPSEC fairy at work who will rotate your desktop 90 or 180 degrees or some other benign reminder that you failed to secure your workstation before leaving your desk.

View on HN

We would send a mail from their pc to the whole team with a text along the lines of "Hey together, I will buy croissants for everyone tomorrow."

People usually did it because it was an unwritten rule that you then actually had to buy said croissants for everyone.

see, now that's more like it -- croissant supply pranks I can get behind; meddling (however slight) with tools, not so much.

Well, we had both extremes, just to disclose that.

The mild version was promising croissants with another mail account, but I also once came back to see that my wallpaper had been changed to a still from a gay porn movie. I think my visible confusion and slight shock was quite entertaining.

Of course the second prank can only be done with co-workers you know well, otherwise you could probably end up having to talk to HR.

For anyone who reads this and think it's funny, it is, but do this in the wrong workplace and you'll be the unemployed OPSEC fairy.

If someone is in OPSEC they generally have a broad license to actually, you know, do their job.

The "OPSEC fairy" as referenced in previous post is typically a random coworker, so no, they generally not have a broad license do tinker with your workstation.

An actual OPSEC person would not go and change your desktop's background, or send an email for free donuts to all your coworkers. An actual OPSEC person would just write you up for a security violation.

People did something similar to this at my previous job and I always thought it was security theatre. For one thing, there are card swipe in. Second, engineering was upstairs in a restricted area. So you're concerned about a tailgater who opportunistically puts malware on your laptop when you're 100 feet away for a couple minutes without anyone noticing? Or you're concerned about a colleague who's an insider threat... Who is already an insider threat? It's not like there was anything on my laptop which was more sensitive than any other engineer there anyway. It was classic busywork.

It's often easier to build a norm for everyone than just the people it really needs to apply to. Managers, salespeople, corp dev, customer representatives all might have sensitive information on their machines. Information that even other employees aren't supposed to see. Rather than trying to enumerate who those people are and teach them, you might assume everyone will eventually have sensitive information, and encourage the mild prank.

Secure from what? Do you have random people walking around your office?

I've worked in offices big enough that the people who worked upstairs looked were total strangers to me. Social engineering into a building is often not that hard.

Reply on news.ycombinator.com