Hacker News Reader

Comment by version_five | Hacker News Reader

Working in some (tbh mostly theatrical) high security environments, I've had to surrender my phone before going into a room. In the organizations that do this, they have lock boxes outside the room for this purpose. You lock your phone in and take the key with you. Still requires some trust but better than just leaving it with a couple guys, and is common practice in some places.

View on HN

Even in the low security environment of a farmer's cow field at Silverstone in 2016 the lockbox and key system was in place. (This was a service to charge your phone while you were camping at the F1 race)

I am shocked that anyone would trust their 2FA to a slip of paper at an event where half of the crowd would probably describe themselves as a hacker or even social engineer.

Yet, more often than not, everyone just drops thier phones (and car keys) in a pile on top of the provided lock boxes. There is always one or two boxes with labels for the boss and demi-boss, but they too just drop thier phones in the pile.

True. That's what my hat is for (I'm in the Army): my phone goes in my hat, my hat sits somewhere near the boxes, and the name-tape on my hat helps me find my phone later (since all the phones are indistinguishable black rectangles).

There are either way more people who work in the facility than boxes, or nobody trusts that the cheap combo lock will work again when they need to retrieve their stuff at the end of the day. I've had to help a co-worker pry his box open and I was like, "why would you put your stuff in there?"

That same co-worker, by the way, later claimed that his ex-wife (or someone she hired) came to our facility and rooted his phone while it was sitting in our lobby next to the boxes. It turned out that he was deranged, but it made me think for the first time about the risks of everyone with a TS/SCI clearance predictably leaving a big pile of phones unattended.

Lol. We wear berets with trade badges, not names. I came out of a meeting once to find a Sgt standing by the lock boxes all mad about me using my beret as a "bag" for my car keys and three cellphones. He would be more mad if he saw my beret atop my microwave holding my ID badge, wallet, dog tags, car keys, work keys and wristwatch. When the fire alarm goes off, I just grab the beret-bag with the important stuff.

(Fyi, you can always spot the secret squirrels by their watch tans. Only those who work in places where cellphones are not allowed still wear wristwatches 24/7.)

Without name-tapes, I guess the car keys become your unique identifier to find your phone later.

I too have worked DOD. Good times.

Not just the DoD -- pretty much the entire intelligence community, in every developed country. Also, several private companies with high-stakes IP; I know this is the case at some quantitative trading firms, for instance, and I knew some people working in Prime Air at Amazon in the early days who not only had to surrender their phones, but had to arrive at the office (whose address was unpublished even internally) by way of unmarked bus from a park-and-ride (and weren't allowed to wear anything which would identify them as working for Amazon).

When I had to visit a US embassy overseas I always had to turn over my phone before entering.

Reply on news.ycombinator.com