6 ms·
As someone that pays attention to things around me, it is interesting the number of people who's name badges I see on display in coffee shops and cafes, indicat
by alias_neo 8y ago
As someone that pays attention to things around me, it is interesting the number of people who's name badges I see on display in coffee shops and cafes, indicating, usually, not only their name but also their department, and usually their "rank".
At times I see people with visitor badges on lanyards designed to indicate their security clearance when visiting another department and which are absolutely not meant to be worn off-site.
It might seem pretty benign to the person wearing a green lanyard with a green badge bearing only the word "unescorted", but to those who know, it gives at the very least a security clearance level.
Coupled with their name and department on their usual badge, also being worn, against policy, visibly, in a public space, that information is not only careless but potentially dangerous.
- abawany 8y agoMotorola (of old, in the 90s) used to have a policy of asking employees to remove name badges when going out for lunches and etc. It was a game between the team manager and the employees as to who admonished the other first when going out for team lunches.
- gowld 8y agoMy former employer had a game where if someone left their computer desktop unlocked, you could add their name to a wall of shame web page . Then management decided that was bad for morale so they took down the web page, and people stopped locking their desktops.
- rayhendricks 8y agoI see you Google ;)
- glangdale 8y agoIt supposedly was the tradition at Intel to, on finding a unlocked desktop, to fire up Outlook and send a message just reading "I love you" to the person's manager. I don't know if this really happened.
- alsobrsp 8y agoWe did this, but to all of IT professing their love for all to see.
- mayniac 8y agoBoss at my old company was hot on making people lock their machines. Used to leave notepad windows open saying "lock it" or similar, even when we had just gone to the other side of the room and could see him doing it. After the Nth time of him being hypocritical and leaving his own machine unlocked when he went out of the room I made a scheduled event that popped up with "update complete, rebooting" and then restarted his machine, set to run randomly once a day between 9-5.
- superhuzza 8y agoAt my current company, it's an email to the team promising to bring in for donuts or pastries friday morning. People rarely leave their machines unlocked anymore :)
- technotony 8y agoWe had a version of this at college where if you left a computer logged in (this was the days before everyone had their own device) then you would send an email to the dean of the school making some or other outrageous request and cc'ing the whole school year mailing list. They were pretty funny!
- abawany 8y agoAnother workplace had a similar scheme: an unlocked machine was an invitation for the person's neighbors to send email on the person's behalf. It was all fun and games for a while (fake product announcements, silly questions posed on the internal mailing alias, fake resignation notices) until someone got really upset when it happened to them and then it sort of died down.
- alias_neo 8y agoWe do this at my office, but without email, if someone leaves their computer unlocked, we're allowed to give them a gentle reminder not to do it in the form of a new desktop wallpaper or reversing their mouse keys and/or scroll direction.
- AnIdiotOnTheNet 8y agoLeaving your computer unlocked is a great way to discover you'd sent an email offering to buy lunch for everyone in the department.
- Raed667 8y agoWe do this in my office, but usually we send emails promising m&ms or croissants, it's pretty effective.
- ip26 8y agoCan't most of that information be found on LinkedIn?
- tehlike 8y agoif you can get the name, yes.
- alias_neo 8y agoSome of it, yes, but it shouldn't, you're not supposed to disclose above average security clearances, period, which is what the green badge indicates.
- TooCleverByHalf 8y agoIf above average security clearance is disclosed immediately by someone seeing my badge then thats on the company, not the person with the badge.
- alias_neo 8y agoThe badge exists to identify you and your access privileges, it's purpose is to be on display, and clearly indicate these things. They're not to be worn outside, and the employee policies state that. You can argue all you want with your superiors about who it's on while you're being escorted from the building for gross misconduct.
- fl0wenol 8y agoYou really shouldn't... Only on your resume and don't just give that out to whomever expresses interest; make sure they're legitimate.
- tehlike 8y agoOut of habit, i put my badge into my pocket when i am outside of the office.
- qrbLPHiKpiux 8y agoNothing is visible, no PII, no nothing is visible when my wallet is open. I mean nothing. No barcodes, no bank names, no numbers, etc. Security cameras in retail can pick up very fine details.
- TooCleverByHalf 8y agoYou live in a scary world.
- walterbell 8y agoWhat's a representative camera (e.g. resolution, model number) that is used in retail?
- Nexxxeh 8y agoMost of the cameras I've seen in new retail premises in the last few years are HikVision IP cameras, somewhere between 1080P and 5MP (2592 x 1944). YMMV though, and obviously you've got settings and NVR settings when considering quality of footage (and distance, lens etc.)
- alias_neo 8y agoFor many, it is policy to do so, and yet, I see people in management positions flagrantly disregarding this. The sad reality is that a lot of these people don't understand, or don't care about the repercussions of openly disclosing this information. Just today, I overheard someone discussing that they have a significant number of meetings scheduled with a senior member of government over the next few weeks, in a public space.
- cooooooffffeeee 8y ago>it gives at the very least a security clearance level. At the very least. I could reproduce a close-enough badge that would likely fool everyone except the person who designed the original. I've done this twice successfully (failed once and almost got arrested) to fuck with my friend who runs opsec at mid-sized financial services companies. One company he worked for had these stupid gates that you needed to scan your badge for (it gives you a green light), but there's no physical barrier. All you needed to do was pretend to scan a badge a couple times and say something like 'ugh stupid things' and the security guard just lets you on through.
- tomglynch 8y ago> failed once and almost got arrested Tell us the story
- cooooooffffeeee 8y agoNot much of a story, I was being a fool and trying to go places I wasn't allowed and someone happened to be paying attention. Fortunately my friend working in security told them it was a planned test (it wasn't planned, but he knows I do this to him from time to time).
- dvfjsdhgfv 8y agoI thought everyone moved to some kind of RFID cards already.
- cooooooffffeeee 8y agoYes and no, visitor badges often don't use RFID. You can get most places if you have a visitor badge and know someone's name (which are all available on LinkedIn). If you get stopped with a badge you can just say "Oh I'm here with so-and-so in X Department" and usually no one follows through beyond that. Saying you're there for an interview will often drop someone's guard too. Employee badges often do have RFID, but some places just have you use a sign-in sheet if you're an employee and "forgot" yours (i.e., you don't have one), and sometimes security guards will just let you through if your badge is being "temperamental" (i.e., not working because it's fake). Most corporate security is security theater (or only marginally useful after a crime) and rules are easily skirt-able because companies don't want to restrict employee access under zero-tolerance policies (which are difficult and time-consuming to enforce). The company I mentioned previously that will just hand-waive you through a gate with no barriers actually goes as far to fingerprint all their employees and contractors. They also won't hire anyone with even a misdemeanor in their criminal record. Also note that all of this stuff is markedly easier if you're a woman (less likely to be stereotyped as a criminal) and/or if you wear a suit (depending on the office, a suit can often mean "don't confront me because I'm above your pay grade").
- js2 8y agoSo? Dangerous how? Why is this against policy? I guess in my mind if someone is targeting a company, employees not wearing badges in public doesn't raise the security bar much if at all for an attacker. Meanwhile, the badge is of no value to a random criminal not targeting the company.
- lazyasciiart 8y agoThe badge is of enormous value to a random criminal who doesn't care which company office he steals a few laptops etc from. Even without an attempt to steal/imitate the badge, it gives you an entry point for social engineering.
- TooCleverByHalf 8y agoThat's a fault of the badge system then. You can't fix human and human is to wear the badge with some colors that BigCorp gave me and get lunch.