6 ms·

>Isn't the automatic reaction of a Windows desktop/laptop user to lock their workstation Having attempted to encourage this as a habit for my users for about a

>Isn't the automatic reaction of a Windows desktop/laptop user to lock their workstation Having attempted to encourage this as a habit for my users for about a year, and not a single one doing it, I've had to come up with other solutions that takes it out of their hands. (It's not business-critical for us, however we try to encourage good security habits all around). So no, I don't think it is an automatic reaction for the majority of people. Although, this is government - so I would have expected a bit more rigor. Perhaps working in a home environment contributed to relaxing of security habits. Side note: Windows + L was a bit easier to remember than Ctrl+Alt+Del -> Enter -> Enter for the users who made good faith efforts at making it a habit

airhead969 6y ago
IIRC, the trick is practical jokes! Change desktop backgrounds, move icons around, leave goofy/giant text Word documents, etc.
- lemmsjid 6y ago
  That is so true. I struggled to develop the habit and then ended up on a team that did this (mainly send silly emails from the victim’s account). It’s over a decade later and I still hit the lock combo every time I get up.
- amenod 6y ago
  ...or invite the whole team for a beer via e-mail. :)
- duck 6y ago
  Or Slack everyone with "I'm a noob!"...
  - airhead969 6y ago
    Muhaha. I can think of other broadcast communications that would get people fired.
- znpy 6y ago
  Uh, back in high school a schoolmate found a huuge genitalia as desktop background on their laptop since they left it unattended and unlocked. I can tell you, that person never left that thing unlocked ever again.
  - unnouinceput 6y ago
    I did the same cca. 2001 to a fellow female coworker. She had a big Excel document that day and was under pressure to finish it from her boss (well, our boss). She went to toilet and that's all it took me to set it, then maximize back her Excel document. She unaware worked for next hour and then when she finished she called the boss, which was across the room on his desktop, to verify it. The fun part came when I asked for something from her desktop and she had to minimize Excel. She went red in the face and the entire office burst in laughter for next 5 minutes, the boss included. After that day she learned WIN+L.
- greenshackle2 6y ago
  At my old job the tradition was to send an e-mail promising to bring pastries for the team the next day.
- gregmac 6y ago
  Some more: Change their profile photo (github/slack/etc). Flip their monitor orientation. Swap to left-handed mouse buttons (or vice-versa). Go on Amazon and add some "interesting" things to their wishlist/cart. Go on Youtube and "like" a bunch of random videos.
  - edrxty 6y ago
    I miss the good old days of Vista where there was a straight keyboard command to change monitor orientation. It was something like win+shift+arrow so everyone would prank each other with it until it was removed.
    - NathanielK 6y ago
      I remember that. Part of the Intel Graphics driver kit. W10 is pretty good about including basic drivers so that is probably when it stopped working for you. The shortcut still works for anyone who's gone through the hassle of installing Intel's drivers.
- saghm 6y ago
  I installed this app on my roommate's laptop in college one time when he left it unlocked and would run it every time he left it unlocked after that: https://www.macupdate.com/app/mac/26793/ipanic https://www.macupdate.com/app/mac/26793/ipanic It took several months for him to catch on; for a while I had him convinced that his hardware must have an issue where the laptop being left idle for too long caused it to mess up somehow.
- InitialLastName 6y ago
  alias ls=echo "Segmentation Fault"
  - airhead969 6y ago
    Hahaha. source ~/.bashrc
- deathanatos 6y ago
  At my high school, it was to create a folder with an… incriminating name. Then, screenshot the desktop, delete the folder, and then set the background to the screenshot. When the …mark… sits down, inevitably with several… "witnesses" behind them, who then point out in "astonishment" the folder on their desktop, they try (in vain) to highlight it to delete it. (Not appropriate for the workplace, of course.) Also, scotch tape is not transparent to optical mice? and blocks the sensor. Had that one pulled on me once, took a while to figure it out.
panzagl 6y ago
So what you do is take a screenshot of whatever's open on their computer, close it, then set the screenshot as their desktop wallpaper. Also hide their icons for good measure. This should start a cycle of escalation and retaliation that eventually gets the whole office locking their PCs.
- ziddoap 6y ago
  In the past, for me, this has caused needless friction and fostered an adversarial relationship between IT/security staff and everyone else. We weighed our options and decided that it was a battle we would rather not waste our effort and risk staff animosity with. When a more serious security incident occurs, or when we decide to implement something else that may require staff effort, we believe that our staff will be more willing to work with us towards a solution. Sometimes with security policy, a little give (proportional to risk analysis) can go a long way with non-technical staff. I'd rather work with staff to come up with processes that work for both the security staff and all other staff members than become so rigid in my security policy that I may inadvertently alienate the security staff - which has many risks itself.
  - filoleg 6y ago
    It can be done in a bit less adversarial and nicer way than making them deal with an annoyance of "troubleshooting" their desktop. Which, I found, makes things much easier and more frictionless. In my old office, we had this team "tradition" that was supposed to encourage people to lock their desktops. If they left their office for whatever reason and left their desktop unlocked, anyone from the team jumps up to the machine. Then they send an email to the rest of the team on behalf of the person who left their desktop unlocked, saying that they are bringing cookies to share with the team tomorrow. It worked out well for quite a few years, with people being more mindful about locking their machines. And their "punishment" for not doing so was just sharing cookies with the rest of the team the day after and hearing a couple of jokes about the situation. Overall, very positive experience, no one got upset about anything, because their machines themselves weren't screwed with, their work productivity wasn't lost due to it, and everyone shared a moment and baked goods.
asveikau 6y ago
> I've had to come up with other solutions that takes it out of their hands. I guess this means setting the timer really low, so that it auto locks after a very short time?
- Leparamour 6y ago
  >I guess this means setting the timer really low, so that it auto locks after a very short time? The IT department at my former employer tried this out company-wide and it almost led to them getting attacked physically. When every simple distraction leads to you getting locked out of the desktop (phonecall, boss or coworker having a question) it builds frustration quickly. Pair this with frequently changing (company-mandated) complex passwords and permanent lockut after a few mistypes and you have a recipe for disaster: Even some of my technologically less-inclined co-workers researched how to bypass Windows security with hacking tools.
  - chc 6y ago
    I think the problem there is the password policies more than the screen-locking policy. The locking policy is just shining a spotlight on the password policy issues.
    - Leparamour 6y ago
      On top of that, the IT department was unavailable on Fridays after 3 PM.
  - metiscus 6y ago
    I've seen a usb hid mouse jiggler used in exactly this set of circumstances.
    - airhead969 6y ago
      Haha. I used to work at a nuclear energy services consultancy. I heard a story about how an energy think-tank had particular rooms with power-saving motion occupancy sensors for the lights. The problem was sitting still at a computer would result in the lights suddenly going off. An engineer solved this problem with a drinking bird toy with a warm bowl of water right at the level of the sensor. https://en.wikipedia.org/wiki/Drinking_bird https://en.wikipedia.org/wiki/Drinking_bird
TheAceOfHearts 6y ago
People don't like having to type in their password each time they come back to the computer. Especially if their password is required to be fairly long and complex, which can become tedious to have to type in constantly during the day. If you want users to adopt secure practices then you have to lower the amount of friction. Adding a fingerprint reader or some other kind of biometrick unlocking capability would probably help. A better example: I think on macOS the system can be setup to automatically lock and unlock by wearing an Apple Watch. The users aren't the ones that have to be trained, it's the flawed security practices that need to be fixed.
- c0nsumer 6y ago
  Look into Windows Hello for Business. It's very nice in the enterprise for all of this. Native facial recognition or fingerprint, and various other factors can be added.
  - bombcar 6y ago
    Causes all sorts of hell with Remote Desktop, however. But it’s the right direction. For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.
    - c0nsumer 6y ago
      How so? In my experience you are prompted to use it, and you can click and use standard credentials if desired. I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought. Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)
      - 6y ago
lostmsu 6y ago
Windows had "Dynamic lock" for a while now, which would automatically lock PC when a Bluetooth device goes out of range (e.g. typically smartphone or smartwatch). Can't it be required by a group policy?
- airhead969 6y ago
  Probably. IIRC, GPOs can include arbitrary registry keys and can have custom policies. I maybe dated in this area, though.
- whoisthemachine 6y ago
  It also has a timed lock, which I have seen applied as a group policy.

airhead969 6y ago

IIRC, the trick is practical jokes! Change desktop backgrounds, move icons around, leave goofy/giant text Word documents, etc.

lemmsjid 6y ago
That is so true. I struggled to develop the habit and then ended up on a team that did this (mainly send silly emails from the victim’s account). It’s over a decade later and I still hit the lock combo every time I get up.
amenod 6y ago
...or invite the whole team for a beer via e-mail. :)
duck 6y ago
Or Slack everyone with "I'm a noob!"...
- airhead969 6y ago
  Muhaha. I can think of other broadcast communications that would get people fired.
znpy 6y ago
Uh, back in high school a schoolmate found a huuge genitalia as desktop background on their laptop since they left it unattended and unlocked. I can tell you, that person never left that thing unlocked ever again.
- unnouinceput 6y ago
  I did the same cca. 2001 to a fellow female coworker. She had a big Excel document that day and was under pressure to finish it from her boss (well, our boss). She went to toilet and that's all it took me to set it, then maximize back her Excel document. She unaware worked for next hour and then when she finished she called the boss, which was across the room on his desktop, to verify it. The fun part came when I asked for something from her desktop and she had to minimize Excel. She went red in the face and the entire office burst in laughter for next 5 minutes, the boss included. After that day she learned WIN+L.
greenshackle2 6y ago
At my old job the tradition was to send an e-mail promising to bring pastries for the team the next day.
gregmac 6y ago
Some more: Change their profile photo (github/slack/etc). Flip their monitor orientation. Swap to left-handed mouse buttons (or vice-versa). Go on Amazon and add some "interesting" things to their wishlist/cart. Go on Youtube and "like" a bunch of random videos.
- edrxty 6y ago
  I miss the good old days of Vista where there was a straight keyboard command to change monitor orientation. It was something like win+shift+arrow so everyone would prank each other with it until it was removed.
  - NathanielK 6y ago
    I remember that. Part of the Intel Graphics driver kit. W10 is pretty good about including basic drivers so that is probably when it stopped working for you. The shortcut still works for anyone who's gone through the hassle of installing Intel's drivers.
saghm 6y ago
I installed this app on my roommate's laptop in college one time when he left it unlocked and would run it every time he left it unlocked after that: https://www.macupdate.com/app/mac/26793/ipanic https://www.macupdate.com/app/mac/26793/ipanic It took several months for him to catch on; for a while I had him convinced that his hardware must have an issue where the laptop being left idle for too long caused it to mess up somehow.
InitialLastName 6y ago
alias ls=echo "Segmentation Fault"
- airhead969 6y ago
  Hahaha. source ~/.bashrc
deathanatos 6y ago
At my high school, it was to create a folder with an… incriminating name. Then, screenshot the desktop, delete the folder, and then set the background to the screenshot. When the …mark… sits down, inevitably with several… "witnesses" behind them, who then point out in "astonishment" the folder on their desktop, they try (in vain) to highlight it to delete it. (Not appropriate for the workplace, of course.) Also, scotch tape is not transparent to optical mice? and blocks the sensor. Had that one pulled on me once, took a while to figure it out.

panzagl 6y ago

So what you do is take a screenshot of whatever's open on their computer, close it, then set the screenshot as their desktop wallpaper. Also hide their icons for good measure. This should start a cycle of escalation and retaliation that eventually gets the whole office locking their PCs.

ziddoap 6y ago
In the past, for me, this has caused needless friction and fostered an adversarial relationship between IT/security staff and everyone else. We weighed our options and decided that it was a battle we would rather not waste our effort and risk staff animosity with. When a more serious security incident occurs, or when we decide to implement something else that may require staff effort, we believe that our staff will be more willing to work with us towards a solution. Sometimes with security policy, a little give (proportional to risk analysis) can go a long way with non-technical staff. I'd rather work with staff to come up with processes that work for both the security staff and all other staff members than become so rigid in my security policy that I may inadvertently alienate the security staff - which has many risks itself.
- filoleg 6y ago
  It can be done in a bit less adversarial and nicer way than making them deal with an annoyance of "troubleshooting" their desktop. Which, I found, makes things much easier and more frictionless. In my old office, we had this team "tradition" that was supposed to encourage people to lock their desktops. If they left their office for whatever reason and left their desktop unlocked, anyone from the team jumps up to the machine. Then they send an email to the rest of the team on behalf of the person who left their desktop unlocked, saying that they are bringing cookies to share with the team tomorrow. It worked out well for quite a few years, with people being more mindful about locking their machines. And their "punishment" for not doing so was just sharing cookies with the rest of the team the day after and hearing a couple of jokes about the situation. Overall, very positive experience, no one got upset about anything, because their machines themselves weren't screwed with, their work productivity wasn't lost due to it, and everyone shared a moment and baked goods.

asveikau 6y ago

> I've had to come up with other solutions that takes it out of their hands. I guess this means setting the timer really low, so that it auto locks after a very short time?

Leparamour 6y ago
>I guess this means setting the timer really low, so that it auto locks after a very short time? The IT department at my former employer tried this out company-wide and it almost led to them getting attacked physically. When every simple distraction leads to you getting locked out of the desktop (phonecall, boss or coworker having a question) it builds frustration quickly. Pair this with frequently changing (company-mandated) complex passwords and permanent lockut after a few mistypes and you have a recipe for disaster: Even some of my technologically less-inclined co-workers researched how to bypass Windows security with hacking tools.
- chc 6y ago
  I think the problem there is the password policies more than the screen-locking policy. The locking policy is just shining a spotlight on the password policy issues.
  - Leparamour 6y ago
    On top of that, the IT department was unavailable on Fridays after 3 PM.
- metiscus 6y ago
  I've seen a usb hid mouse jiggler used in exactly this set of circumstances.
  - airhead969 6y ago
    Haha. I used to work at a nuclear energy services consultancy. I heard a story about how an energy think-tank had particular rooms with power-saving motion occupancy sensors for the lights. The problem was sitting still at a computer would result in the lights suddenly going off. An engineer solved this problem with a drinking bird toy with a warm bowl of water right at the level of the sensor. https://en.wikipedia.org/wiki/Drinking_bird https://en.wikipedia.org/wiki/Drinking_bird

TheAceOfHearts 6y ago

People don't like having to type in their password each time they come back to the computer. Especially if their password is required to be fairly long and complex, which can become tedious to have to type in constantly during the day. If you want users to adopt secure practices then you have to lower the amount of friction. Adding a fingerprint reader or some other kind of biometrick unlocking capability would probably help. A better example: I think on macOS the system can be setup to automatically lock and unlock by wearing an Apple Watch. The users aren't the ones that have to be trained, it's the flawed security practices that need to be fixed.

c0nsumer 6y ago
Look into Windows Hello for Business. It's very nice in the enterprise for all of this. Native facial recognition or fingerprint, and various other factors can be added.
- bombcar 6y ago
  Causes all sorts of hell with Remote Desktop, however. But it’s the right direction. For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.
  - c0nsumer 6y ago
    How so? In my experience you are prompted to use it, and you can click and use standard credentials if desired. I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought. Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)
    - 6y ago

lostmsu 6y ago

Windows had "Dynamic lock" for a while now, which would automatically lock PC when a Bluetooth device goes out of range (e.g. typically smartphone or smartwatch). Can't it be required by a group policy?

airhead969 6y ago
Probably. IIRC, GPOs can include arbitrary registry keys and can have custom policies. I maybe dated in this area, though.
whoisthemachine 6y ago
It also has a timed lock, which I have seen applied as a group policy.