Hacker News Reader

Comment by _8j50 | Hacker News Reader

I hope they also remove USB drives and don't let them connect unauthorized bluetooth and keep their laptops in the office. Most users would just start working on their home pc and then you have their work account compromised on their home laptop. With USBs, you'd be surprised how many air-gap breaching worms there are.

View on HN

The entire story isn't about laptops. It's about the workstations that may be used to work on code locally (or also build it locally). These machines already aren't allowed outside of premises.

I work at a bank and I know our security is higher than most, but I'd be shocked if usb drives are allowed in the Google offices.

At Arm IME they weren't banned, just training on not picking up from car park etc. - I'd expect the same of Google, at BAE Systems I physically couldn't access the USB (or any) ports on my desktop computer, but that doesn't really work when you're given a Macbook and able to work from home and coffee shop etc.

You can block USB mass storage devices through OS policies, it doesn't prevent everything though (people have demoed frying computers using capacitors, or using USB keyboards to open the terminal and execute code)

>but that doesn't really work when you're given a Macbook and able to work from home and coffee shop etc.

MDM like jamf and/or EDR/Antivirus like SentinelOne and Carbon Black can disable USB ports/anything in software. If your account is not admin/root you cannot remove them also.

True, I just think it's more likely Google IT provides external hard drives for extra capacity on request than that they block it. (At least for most roles, ones it's not also air-gapping!) I may well be wrong, no insider knowledge, just my outsider impression of the company.

They have yubikeys, so unless they only use nfc it is likely. Also, chromebooks and usb-c.

I worked at a pharma company who disabled internet access for most people. Many downloaded things on their phone's 4G and transferred them to their computer with a USB cable, it was pretty pointless.

That said, I'm sure Google's IT are far more competent than that horror-show.

Reply on news.ycombinator.com