Hacker News Reader

Comment by thom | Hacker News Reader

Regarding number 5, one company I worked for had the donut rule: if you left your computer unlocked, everyone was within their rights to send an email to the whole company offering to buy everybody donuts. It was expected that you would follow through (with whatever treats you deemed appropriate, didn't have to be sugary stuff). Of course this highlighted the security advantages of using a DVORAK layout on your keyboard and only sending email with Emacs which probably wasn't the intended effect, but every little helps.

View on HN

At one specific team we replaced the wallpaper with photos of David Hasselhof and sent email about treats.

One admin proactively put a Baywatch photo as wallpaper : - )

My standard move was to change the background and set the screen to auto-lock after as little idle as the desktop environment would let me. The victim usually immediately saw the background, but the auto-lock change usually remained unnoticed and kept triggering for a few days... Hey, I'm just trying to prevent the problem from reoccurring!

It's possible we worked together.

We also "got Hoffed".

My experience is that the Hoff transcends company, language and country boundaries.

It’s possible we worked together as well- right across from the opera house?

The support manager put a pornstar on mine. Only had to be taught that lesson once.

Haha, had the same in my last place.

At another place I worked, the devs took a screenshot of their desktop and made it the lock screen image, so it looked like it was unlocked, just to annoy security (i.e. me!).

Same, I even put a Thunderbird "New Message" window on mine just to be extra "attractive". Had an extra keybind for that, just in case I need to take my laptop to a customer.

Overall the "buy treats for the office" rule helped to establish the habit even though I think we never followed through with it. We mostly just told newcomers that this is the rule and they locked their screen as expected. And ofc it turned "Hey, lock your screen!" into "Oh, you want to treat us?" which makes for a more cheerful way to remind people.

Your coworkers can just film you while you type the password to unlock the screen. And of course if the machine is running the decryption key for the disk is located in the RAM.

If you can't trust your coworkers in the same office, you should absolutely have private rooms that get locked, and shut down your machine completely every time you leave it.

It's not about trusting coworkers, it's about creating the right security habits so you don't leave your computer unlocked in situations where it is easily compromised. And it's about closing of the easiest attack vectors (open laptops, reused or simple passwords etc) not about nation-state level hacking possibilities :)

Trusting co-workers has nothing to do with it. Any random person walking by could do it - cleaning staff, maintenance folks, a guest or visitor, someone ‘surfing’ in behind someone, etc.

And it gives some incentive to everyone to watch each others backs and keep each other honest. Which is how actual trust gets built IMO.

Knowing someone will catch and make sure you know you screwed up on something important before it became a bigger problem, rather than ignoring it and letting it fester.

Higher stakes areas, but most military combat MOS, LEO, skydiving, and climbing groups do similar things - always check that everyone around you has their act together (and give them shit if they miss something) so that there isn’t something serious that gets missed and gets someone or the group killed.

Or in this case, something serious gets missed and the company gets ‘killed’.

Think of it as tough love. And if they can dish it out, they’d better be able to take it or that is a whole nother level of ribbing that’s coming.

> Trusting co-workers has nothing to do with it. Any random person walking by could do it - cleaning staff, maintenance folks, a guest or visitor, someone ‘surfing’ in behind someone, etc.

Precisely. So if you want to be safe, shut down completely the machine. Then all of the people you listed can't access it.

And then wait minutes for things to start up, even if things reopen to their prior state perfectly. As compared to seconds to lock/unlock.

Suspend adds major security issues above and beyond either of these scenarios.

The majority of scenarios, none of those folks are able to do much to a locked machine without powering it off, which resets it to the state you were referencing.

They could install a hardware keylogger of course, and none of these protections would help.

It’s all tradeoffs. SCIF’s are better still after all, and a nightmare productivity wise.

> And then wait minutes for things to start up, even if things reopen to their prior state perfectly. As compared to seconds to lock/unlock.

The price of security is always wasted time.

> The majority of scenarios, none of those folks are able to do much to a locked machine without powering it off

But they are able to unlock it if they saw you unlock it yesterday.

If you have an encrypted hard drive and the key is in a usb you carry with you, they can't do anything.

What is your point exactly?

> if you left your computer unlocked, everyone was within their rights to send an email to the whole company offering to buy everybody donuts. It was expected that you would follow through

Ah yes, the excellent security practice that if you see someone messing with someone else's equipment that's completely normal - praiseworthy, even - and if you don't challenge them on it, you get donuts.

To me that's kind of silly. Don't get me wrong, I lock my computer whenever I leave the room, but there should be a certain level of trust among coworkers assuming you aren't actually working on classified stuff (or if you have access to HR data).

I couldn't possibly disagree more.

You are legally liable for the messages you send; the access rights you have etc;

This is why shared accounts are one of the first thing a CISO/CIO will try to kill. It makes liability lie with the company and not the individual.

You will not be able to hide behind the fact you refuse or fail to secure your devices if someone sends a threatening message from your email account or if someone deletes the prod database.

Where shared credentials are required there is usually an access log associated: which ties individual named accounts to shared access rights in the event of eDiscovery or forensics.

Some trust is good, but if we really believed in trust then we wouldn't even both having access accounts with our names on them.

You’re assuming that everyone in the office is a coworker.

I recommend Deviant Ollam’s YouTube channel for an entertaining way to expand your assumptions

Eh, if the physical security isn't good enough you'll have laptops going missing whether they're encrypted or not. There's a lot more opportunist thieves who'll snatch a laptop than there are industrial espionage spies rappelling down your elevator shaft or whatever.

The real reason for the policy is so when some dumbass sends a dick pic from their work computer and gets fired for it, they can't claim "it wasn't me" and expect to keep their job.

It's probably better to just install an MDM. This lets you do ongoing reporting re: is disk encryption active, how long is the timeout for screen locking, etc. And to remote lock the device.

That is funny in my case the chief of security used my computer to send an invitation to everybody to buy farewell drinks because of my resignation, fun times. (no harm done we are fun people)

it's the company's policy that should enforce automatic screen locks, not relying on an error prone human

Reply on news.ycombinator.com