The walk signs in Crystal City, VA are just repeating “Change Password” | Hacker News Reader

The walk signs in Crystal City, VA are just repeating “Change Password”

twitter.com

196 pointsShank93 comments

This[1] reply on Twitter explains and includes a link and quote from the manufacturer’s manual for these signs, indicating the message will play if they have not been set up properly (i.e., default out-of-the-box password still in place unchanged). This seems like the equivalent of the old blinking “12:00” on a VCR clock.

[1] https://twitter.com/hyperplanes/status/1503275823360585735

I was completely mystified by this post, watched the video multiple times to try to figure out what point they were making. Didn't realize I needed to turn on the sound.

I lived in Crystal City for several years (in the high rise right above the Buffalo Wild Wings on 23rd and Crystal Drive).

This is actually a pretty big deal, and far more so than in other urban areas.

Why?

Because Crystal City has a far higher percentage of blind/visually impaired workers than other urban areas. It's the home of numerous Federal contractors and also government agencies with offices dedicated to employing visually impaired professionals. The vast majority of my walks to my office included at the very least 1, if not 3 or 4, encounters with blind pedestrians. Several lived in my building, including my weed hookup back then, who was legally blind although he had SOME peripheral vision. (In 2014 Virginia, weed was most definitely NOT legal, lol)

Imagine a future where the city allows companies to book ad slots in these.

Pfft next on your slippery slope you'll be making silly predictions about adverts in ridiculous places like the Start menu on Windows computers.

Pfft. Start Menu ads are for losers. You should advertise with File Explorer [1] to get to more people.

[1] : https://www.bleepingcomputer.com/news/microsoft/microsoft-is...

Don't tell Xiaomi or other vendors that ship a device with OS

Oh god, it is one thing to have it in Windows on a PC, but imagine having it on a device with a locked bootloader.

Obviously you should never pay for a device where they won't support you, the owner, unlocking the bootloader, but obviously people do. I'm not sure if Xiaomi are one of the manufacturers that do not support it.

UEFI Ads. Next big thing! Offer a replacement computer just when yours is being a bit annoying …

Why do you think they won’t let us fill the menu with pins?

Windows users can't be trusted with more than a few sharp items at a time?

Hence the rounded corners.

Meanwhile some cities introduce stricter rules for ads in public places. The billboards and logos are either taken down or have to stick to a toned down color palette and cannot exceed certain dimensions. I’m a big fan of this trend. Maybe it will expand and maybe we’ll see fewer ads in public spaces everywhere.

Freestanding billboards are banned in Singapore. This is one of those things where you don't realize how nice it is until you go to a neighboring country and your eyes start bleeding on the drive from the airport.

It's not hard for me to imagine. The closest gas station to my house has ads on all the gas pumps.

The worst part is that the sound from all the pumps are slightly out of sync from each other. Which I assume will happen with these things as well.

"While waiting for the walk sign, please enjoy this message from our sponsors!"

“Amazon Prime members receive 50% shorter wait times! Please press with your registered palm”

Come to think of it, no different than some gas stations already.

I've already made it a point to stop using those gas stations. As soon as it starts I stop fueling and let the station get charged the credit card fee on 45 cents worth of gas. Advertisements playing at the fuel pump make me want to smash the screen.

Yes, I know I can mute them but I don't care. I hate it.

Having to actively mute is still participating and interacting, which is actually way better from their point than ignoring.

You are entirely correct and rational for hating this.

I applaud the sentiment, but I think you are spitting in the wind. The cost to you in time and expense to go to a new station is surely more than the cost you are inflicting on the gas station. It is a battle you can fight, but not one that you can win alone.

Which is why he posted here,to get others to do the same.

Damn shame if a bit of the gasoline "accidentally" got on the screen. Solvents and plastic generally don't mix.

> Yes, I know I can mute them

Most places I’ve seen them, they cannot be muted.

Try all of the buttons. One of them will mute. Usually it's the bottom right one but not always.

The talking Sh_ll stations around here all seem to use the peninitial button on the right side. I carry a paint pen in my vehicle and write "<-- MUTE" any time I encounter one and there is no possible argument that could make me feel bad about it lol https://www.amazon.com/dp/B01E7EG3NM

I wonder what happens if hypothetically, someone were to push something really sharp into the speaker or the screen, or silicone caulk into the speaker to act as a hardware mute feature.

I would pay an extra $0.05/gal if it forced the next person using the pump to listen to marketing from the political party of my preference. $0.10 if it couldn't be muted.

Yes, I too wish to live in a society in which the rich can leverage their wealth to force others to listen to their propaganda.

Okay, I'm stumped. /Why/?

Probably because I'm a tiny minority in my effectivly one party state and annoying people who vote the other way is about the best I can realistically accomplish.

I feel the same way, only not about politics, but aesthetics. I would gladly pay extra at the pump to force people to listen to snatches of noise music, like the Boredoms or Merzbow; or mini documentaries extolling the virtues of Dadaism or Brutalism.

You are asking why people pay for advertising?

How much does the ad-free version cost?

"Didn't you have ads in the 20th century?"

https://www.youtube.com/watch?v=XPGgTy5YJ-g

Ironically that video is behind a tracking-for-ads 'cookie wall'. (I assume most people don't make google not track them and thus don't notice this wall at all anymore.)

I mean I can totally see this as a great way to make money while also making the world worse, but only a little worse. And maybe somebody would like to know that there is a McDonalds on the other side of the street they're going to cross right now? I mean maybe I would actually be providing a useful service for some people, and only be making the world a little worse for most while I was getting rich, rich, rich!

Yet another reason to avoid touching the button and just crossing during the appropriate traffic phase.

In some cases if you don't press the button the light will never change, like a small side street intersecting a major road.

Not to mention that blind people exist

And people that are mobility impaired, such that they cannot get across the street in a shorter amount of time or be agile enough to dodge vehicles that behave unexpectedly. But that's not really relevant to the vast majority of people being goaded into using walk buttons. Many times, it's just a disservice to yourself and a disservice to vehicles.

And yes, ideally we'd use our collective political will to stop further dystopian developments like advertising at traffic lights for everyone. But when that fails (which would be likely given how saturated our society is with advertising), it's still important we exercise our individual ability to reject it, even if not everybody can.

That's far too easy to imagine.

I’m trying to decide whether that’s more dystopian than password-protecting street crossings.

Can we instead imagine a world where everyone who ever seriously considers such an idea is rounded up and put in a rehabilitation facility far away from the general population for the good of human society?

You mean the Bay Area? ;-)

I assume some grey-hat realized the crosswalk computer used a default password and decided the only way the city was likely to fix the problem was this.

https://neil.fraser.name/news/2019/Polara%20Operations%20Man...

"The EPBS will compare the system security code with the code entered on the E-Configurator. If the code matches, you will have an opportunity to change the code. Press NO to continue on without any change. Press YES if you want to change to a new security code at this time. Entering a new code uses the same technique just described, using the Left/Right and Down keys. It is necessary to use a security code different from the default AAAA. Failure to change the code will cause a periodic message to play – “CHANGE PASSWORD”."

they just didn't RTFM and that password is still set to AAAA

So when the device is deployed insecurely, it broadcasts itself to the public to invite a takeover? Why wouldn't it just decline to operate at all until the password is set?

I took it as that was what it was doing. It refuses to do crosswalky things until you set the password (likely a power failure or something caused it to lose it’s config).

The troll thing to do is set a password if you find one of them in the wild.

> just decline to operate at all until the password is set?

This truly is the right way to handle PSK auth. The "UX" for it isn't as nice as some people would like though.

Completely unacceptable. See my other post in this thread talking about the high concentration of blind/visually impaired pedestrians in Crystal City. This is far more dangerous than if done in other places. I doubt the knucklehead grey-hat realized that.

Amazing to think that this speaker, which has never and will never say literally anything other than "BEEP" and "WALK", in fact reaches out across the internet every day to fetch that message.

What a world we have built.

Cross signals in the city often say the names of streets and other words

If you're ever in the flatiron district of NYC, I adore the signals at 23rd street. "The walk sign is on across 23rd street," is a simple message, but the gentleman who recorded it sounds like they remembered at the last minute and pulled whoever from the install team wanted to do it (as opposed to some voice actor or something). The gravelly queens accent makes you feel right at home in the city.

NYC once bought some street sweepers that played a feminine voice saying something like "Please get out of the way of the sweeper". This was replaced with a gravelly voice saying something like "Move it, sweeper coming through".

It's been a few years, but I thought NY's subway voice was more sarcastic-sounding than other cities, and I figured that was because it was more effective. "Please stand clear of the closing doors (dumbass)".

That voice actor was recently featured in a song. https://youtu.be/TA13bQExrh8

Thank you, my life is now just that little bit better. :)

At 3:00, if you're curious

Love this one. There is a similar one in Charlottesville, Va to cross Water Street, which has a delightful southern accent. Pronounces it Wooter and everything :)

https://www.nytimes.com/2012/07/07/nyregion/a-new-york-voice...

Unless they are located in the stairwells at Hogwarts, it does not seem like those names would change often enough to necessitate adding a network connection as a point-of-failure for this sort of technology. (Which I consider the most important aspect. This is life-or-death tech for a subset of our population, and networks are fundamentally unreliable even if you get the security 100% correct.)

Is there an actual indication that these are connected to a network? Depending on how these devices work, some failure may have caused them to get reset to a factory default, requiring a password to be set before accepting settings like a message.

Why would they all fail at the same time unless they're networked? Exactly the same bug triggered by the system clock?

They shouldn't even know the time. All they need to do is count to the same number over and over.

> Why would they all fail at the same time unless they're networked?

Because temperature swings in the area over the weekend caused some physical issue in the devices? Because someone figured out how reset them, and reset a bunch for laughs? I agree that network is a likely root cause, but it's also an assumption.

Cities do all sorts of syncing / timing of lights in order to optimize traffic patterns, to do that they need a network connection.

Makes sense, but I'm replying to a comment that wondered if the assumption that the lights were actually networked was a good one. I thought it was, because they all went out at the same time.

They say "Wait." and "Walk sign is on to cross 23rd St. South" too. These are in Amazon's neighborhood.

is there any reason to think that this is a message from the internet rather than something built into the machine?

> What a world we have built.

That struck me on the Snowden revelations - I was happily building smartphone apps before.

But also miserable: the installers of the traffic lights never seem to have tried them.

it doesn’t actually reach out to get that message, it’s preprogrammed to get the installers to change the default

A world of centralized control and surveillance. A great world if you own it.

https://nitter.kavin.rocks/JosephPolitano/status/15031310053...

I guess its better than "Meow Meow" but I feel bad for the blind.

Anything is better than meow meow, but it was still fun in 2009.

How is no one calling this out as an obvious cyberattack smoke test? It's literally across from the Pentagon.

Because the much more likely and believable explanation is that it is mis-configured. Someone upthread even posted a link to (I assume) the manual, and it calls out the conditions under which one will hear “change password”. One of these days I’m opening that website that sells nothing but varieties of double-edged razor blades, which I shall brand as “Occam”, because sometimes simpler is better.

I like your action movie logic... "It's digital, it's noticably broken, it's close to the Pentagon, it must be a cyber attack!".

If I were the enemy, and I would think the enemy would have people at least as competent as me, and somehow hacking the walk sign is relevant to the misson, I'd test the attack quietly and on a similar system but nowhere near the conspicuous final target, and maybe use an audio file you wouldn't notice is different if you weren't paying attention. Something like have the machine say "streetah" instead of "street"

You forget that the Pentagon likely hid the launch codes in the crosswalk button because nobody would think to look there.

Do you know how many things are across from the Pentagon? Why would anyone bother smoke-testing a crosswalk?

To strategically confuse visually impaired pedestrians causing them to walk out into the street thereby tying up traffic in the nations capital making it impossible to roll out tanks to fight the invasion of liberals putting chemical microchips in the water to turn the frogs gay, obviously

I wouldn't say obvious cyberattack, but I'll bet Pentagon security is aware of this.

For context, is Crystal City much more than an enormous mall/office building and a Metro stop? It's not great to have an accessibility failure, but that doesn't strike me as a place where it would make that much difference.

Blind people have jobs and shop.

The point of accessibility is to enable citizens to have a normal life.

While that's true, my memory of Crystal City is that it's meant for you to get inside the complex first, and then walk six city blocks or so.

A far, far higher percentage of pedestrians than normal are blind/visually impaired in Crystal City. I lived there for several years, in a high rise that had numerous blind people living there.

There are several offices/agencies there that employ blind/visually impaired professionals. It was a fluke for me to walk the few blocks to work and NOT encounter at least one blind pedestrian. Hell, taking the elevator in my building had a high chance of a blind person (red tipped cane and all) being on my elevator.

A lot of people live there; quite a few of the buildings are condos and apartments.

It could be worse: hacked to tell unsighted pedestrians to walk even if there is through traffic. There was an X-Files episode with a guy causing car accidents by messing with traffic lights. However, it was via ESP instead of digital hacking.

> unsighted

funny that this is ostensibly being used as a positive euphemism for blind, when all it does is put the emphasis on what blind people lack. the euphemism treadmill never ends

It's right across from the Pentagon.

I thought Pentagon City was right across from the Pentagon, and Crystal City was in this no-man's-land after the immediate Pentagon services stopped but before you really got into walkable Arlington.

What do you mean by "walkable Arlington"? If you mean a more house-and-sidewalk residential neighborhood, then neither Pentagon City nor Crystal City meet that mark. And Crystal city is fairly walkable even before you account for the underground part.

They're both mixed-use urban developed areas with large towers, although Crystal City actually seems to have more of those. Both are in the same place, south of Interstate 395 and west of the airport (the Pentagon is just north of 395).

edit: and for reference Wikipedia says: "Crystal City includes offices of numerous defense contractors, the United States Department of Labor, the United States Marshals Service, and many satellite offices for The Pentagon. It is also the location of Ronald Reagan Washington National Airport."

All true, but I'd like to add that - after having stayed at Crystal City Doubletree - that hotel is full of service members and what appears to be higher ranking Pentagon staff.

Reply on news.ycombinator.com