Comment by bri3d | Hacker News Reader

Comment by bri3d | Hacker News Reader

Parent Full thread

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring.

They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their team's time) but it's not a lack of basic process in this case.

I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI, these type of candidates (whether state-sponsored malicious actors or overemployment shops) are appearing in every industry and every role constantly by the hundreds. I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm and the North Korean operation specifically may be more tailored, fake candidates are rampant throughout the tech industry now.

> I will say that hiring for remote jobs has gotten to be a gigantic time waste lately.

Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person??

Also, the in-person step is usually at the end, which means yes, you can waste a lot of time phone- and Zoom-chatting with fake candidates, but that is equally true for in-office vs. remote roles. Nobody starts with the in-person, on-site interview.

All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.

10 years ago all interviews were in person. With the pandemic they all went 100% remote. We proved that 100% remote positions can work and so there is temptation to continue doing 100% remote interviews for people that will be working remote anyway.

Though we have been burned by someone we believe (but cannot prove) was 100% remote and working two jobs at the same time (they were laid off in a recent downsizing before we could get enough evidence, but they didn't seem as productive as we would expect). So I expect even if you apply for a 100% remote position you will need to do one round of interviews onsite. (though who knows if this will protect us)

Wow, I guess my experiences are way unusual! Very interesting. Companies are really playing with fire by expecting to hire (either for remote or onsite work) 100% over the phone and videoconferencing.

Yes, my fully remote company has been hiring for the past 3 months, I've conducted at least 70 first-round interviews, and we hire without in-person meetings.

Yes, I am in a hybrid role, went through 5 interviews and several more check-ins, and the first time anyone saw me in person was on the first day when I picked up my laptop at the local office (which wasn't even required, I had the option of having it shipped at my home address)

If your position is remote, and the coat of every in person interview includes two way flights, per diem and a hotel room, it's very tempting to skip the in person step, especially if you expect to fail a lot of in person candidates. Imagine paying that much when your interview to offer rate is 25%, and offer to hire is 50%. That $8k $10k extra per hire, on top of the normal cost of the funnel

You could do the expensive bit as a last step before making an offer.

the co[s]t of every in person interview includes two way flights, per diem and a hotel room

So… you mean the way it's been done for the last hundred years?

If your company is so small that you can't afford to bring someone in, then you hire locally.

Also, $8-10k per hire is too much for an interview. We do ours for under $1,000 with round-trip airfare, hotel, and meals. It's always the last step before signing.

Personally, I wouldn't feel comfortable working for a company that didn't bring me in for an in-person interview, even for a remote job. It's just as important for me to evaluate the company as it is for them to evaluate me.

My company didn't do any in-person interviews, it was all over Zoom. I've never been to the office (which is over 1,000 miles away) and likely never will.

I did not get hired without in-person interview, but a number of my team members (certainly people I interviewed and recommended for hire) did.

Last company that hired me did everything remotely. This was in a company that only hired people living in countries where it had offices and no b2b contract so there are a number of things that needed to be local: - local ID or work permit - physical address in the country - bank account in same country - social security number

Stuff can be forged but that needs local spy level of skills to make it work.

They were also hiring a company specialized in background checks, I literally had to fill up a form with the 14 places I had been living in all my life with dates of entry and exit, super annpying given the UI was slow as hell and that I had low recollection of addresses and date of my early years, I had to ask my parents. I may have been able to cheat probably but I didn't try.

I am also seeking a new position and I have realized that most b2b / work from anywhere jobs you could apply for were for cryptocurrencied / blockchain related companies so they surely make it easier for malicious remote applicants. I think it means they are kind of desperate / have difficulty to find talents. In other areas most companies only hire people who live in same juridiction they have an office and hr department.

> Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person??

You're dating yourself with that question. (yes, and they have been for a while)

it's not even a new thing, certain companies were doing it before the pandemic. for a long time. I took my first offer at a remote company in 2012 -- I only met any of those people by chance, years later.

The funniest interview I had, in a similar sneaky question, were the HR guy asked "so you wrote city X, I am also living here, whereabouts do you live?" and I turned the laptop and showed through my window a very unique skyscraper and a super marker right across my flat, and the guy recognized my building because his gf lived in the same building (had more than 100 flats), and we both had a laugh about it. (I got the job later but after having 2-3 more rounds of domain-specific interviews) Those days the "AI" was not around so I wouldn't be able to fake that even if I wanted.

EDIT: I also had interviews with Credit Suisse some years back (decade or so), they wanted me to speak to some people in the US and London, but didn't allow the video conference from home, but they asked me which major city in Europe I was in, so they book some meeting room in their own offices or some WeWork facility in case I was somewhere where they wouldn't have offices.

>>Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person??

Yeah, absolutely. The company I work for is in a different country, seeing anyone else would require flying over there, I interviewed and got the job without meeting anyone in person.

> Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person?

Yes, I got multiple job offers like that back in 2022 at FAANG and similar places, and a lot of my friends who interviewed recently had plenty of processes that were fully remote as well. The first time I’ve actually met someone irl from the company I signed my offer with was at least a month after I already started working, and it was just an optional lunch meetup.

However, afaik, these days most serious companies like big tech or tech-centric finance (JS/Citadel/Jump/etc.) or top AI places (OpenAI/Anthropic/etc.) would have the final rounds in-person.

I went couple times through fully remote projects. No in-person interviews, no team gathering during the project work.

However, there was a background check done by third party agency. Basic check: criminal record, education and employment history (is it fake or real).

> I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm

I can definitely confirm it’s not just finance and crypto being targeted.

I can also confirm it’s not just state sponsored North Korean agents too. Sometimes it’s just individuals trying to fake it until they make it.

However I dont agree with your conclusion that remote interviews are not dead because of this. Yes it’s annoying and time consuming filtering out these culprits, but the interview process already was an annoying and time consuming process to begin with. So I wouldn’t be so quick to throw the baby out with the bath water.

  I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI...

Good. I hope the whole hiring process gets blown up. The root cause of this is transactional hiring. Companies treat applicants like commodities, and now bad actors have found out how to game it.

Do you want the industry to go back to only hiring from the top ~20 schools and by word-of-mouth networking? Coz that's the only viable alternative to the current interview process.

> Do you want to the industry to go back to hiring from the top ~20 schools and by word-of-mouth networking?

This never stopped and is still the case for "good" jobs btw.

Depends on what your definition of "good jobs" is but I know plenty of people from no name unis in third world countries who landed well paying jobs in FAANG thanks to the current process.

He means their bosses are from top 20 schools and didnt get hired because of their skills but their status

If you think this is going to lead to better treatment of candidates in the industry then i got really bad news for you

Hate to say it but jobs are commodities for the employee too. Why would it be any different the other way around?

So many roles are basically interchangeable and I’ll choose whichever one looks best on my resume or gives me some other tangible benefit. And I am prepared to bounce as soon as my vesting schedule drops. We all game this system too.

The days of us loyally working at any firm for 20 years, singing the corporate cheer songs and retiring with a pension are stuff of a different age.

> I hope the whole hiring process gets blown up.

I can't see how the fake-candidate epidemic blows the hiring process up in anything but a candidate-hostile direction.

With the open hiring market becoming more inefficient, companies will move more towards hiring through networking and vetted sources (select college job boards etc.) rather than the open market. In situations where they evaluate candidates from open market listings, companies will now have invasive proof-of-identity red tape earlier and earlier in the funnel (for example, background checks prior to application rather than offer in places where that's legal). Plus, look forward to overly clever hiring panels introducing annoying "trap" questions and weird hoops like this article alluded to - I hope you're ready to review local restaurants and pick up random stuff in the room during your interview!

I think its useful to test as to what questions they are and aren't prepared for. In the future you won't necessarily know they were an imposter, so it's good to devise and test certain captcha like questions to tease out the fake from the real candidates.

Today’s bad startup idea:

Firm that looks like it is hiring for remote jobs, but is actually a honeypot that harvests credentials and identifiers that will enable our clients tondetect scam applicants.

Reply on news.ycombinator.com