4 ms·

I can give 2 real world examples of stupid security, or where rules are made without employees truly understanding why. First, in the UK about a decade or more

I can give 2 real world examples of stupid security, or where rules are made without employees truly understanding why. First, in the UK about a decade or more ago you used to have to sign the receipt and the checkout staff would check it matched the one on your credit card. There came a time when my credit card expired, so I produced a new one from my wallet. "It's not signed" she told me. So I signed it in front of her, then she gave me the receipt to sign, which I did. She then checked to make sure both signatures matched! Even though she'd seen me sign them BOTH in front of her. Secondly, my wife tried to take 6 items into the changing rooms but was told they have a maximum of 5. I have no idea why. I mean, theft is theft regardless of how many items, right? Anyway, she handed one item over and took 5 in, and they gave her a plastic sign saying 5 on it. The idea is if you take 5 items in then they check that you bring 5 items out with you. Anyway, when she was in there she asked me to swap items around - go and get her 2 belts, swap the jeans for a different size but bring 2, etc So, at the end she came out of the changing rooms with 7 or 8 items. The assistant took the clothes she didn't want and put the sign back ready for the next customer. At no point was she challenged about why the number of items she had didn't match the sign, all their "security checks" were done to make sure she couldn't try on more than 5 items at a time. I wrote to the store but naturally received no reply.

Cthulhu_ 4y ago
I never understood signatures, but then my handwriting is all over the place and at best my signature is a squiggle. I haven't a clue how they're verified these days. I suspect they're basically a legal guarantee, where in court you can be asked "is this your signature". Digital records are IMO better.
- themoonisachees 4y ago
  Signatures are basically the same as credit card numbers. Not secure, but everyone keeps pretending they are, so insurance and legal make sure they are.
- samtho 4y ago
  We can "sign" something by entering our name into a text box on a web form. That's the easiest to reproduce. This works because the contract is between the other party (requestor) and the named person. Entry by any other party not authorized by the signer will render the contract null and void. The signature answers the question of, "Does X agree to these terms or not?" and not, "Is X who they say they are?"
- adamauckland 4y ago
  You're absolutely right, they're pretty much not verified unless there's a dispute and someone says "That's not my signature"
  - inglor_cz 4y ago
    Depends on the country. In Czechia, some documents (such as the contract about selling/buying property) require verified signatures, where you go to a notary or a post office with your ID card, sign the document in front of them, they note what document you brought to them into a book of signature verifications and stamp the document.
  - yellowapple 4y ago
    Mail-in voting in my state entails "signature verification", wherein I learned - the hard way - that they do in fact compare the signature on my ballot to some signature they've got stored somewhere to see if it matches.
talkin 4y ago
> so I produced a new one from my wallet. "It's not signed" she told me. So I signed it in front of her I’ve had this too. It felt weird, but isn’t that bad: You sign just the same before a second attempt, so might as well continue. And the upside of having to do this ad hoc is that it’ll help on future card usage. But the following likeliness check is hilarious of course. :)
jdthedisciple 4y ago
I don't think the 5 item limit is about security, at least not only. I probably has more to do with not wanting too many items to be simultaneously unavailable for other customers, which makes sense. At least that's how I always viewed it, maybe someone can confirm or deny.
- fmajid 4y ago
  More likely they want to limit the time you spend in the changing room, so they are not unavailable either.
  - throwaway744678 4y ago
    That's the reason (at least in the store I used to work). Also, in some stores, the clients drop the items they don't want, and the employees have to fold them back (or put them on a hanger) and to put them back at their correct place in the store. It builds quickly, and you want to keept it manageable.
    - zasdffaa 4y ago
      I've seen people in primark pick stuff off a rail, hold it up to themselves to size it, then if not happy just drop it on the floor and reach for another. It amazes me and not in a good way.
janeway 4y ago
My passport is from a “top” country. To get it I only needed a photo and my birth certificate, which I bought a copy of from a government office for a small fee. Then a signature from police department to say it is “my” certificate to accompany my photo. When I was renewing it in a foreign country I filled out an application online and had it sent to my new foreign address without any checks. Perhaps the embassy checked on my residency but any ID in my new country has been issued based on that passport.
forkerenok 4y ago
I think the story with the credit card makes more sense than it seems at a glance: They want to make sure you hadn't intentionally produced two different signatures. I think, in theory, you could later dispute the charge and the merchant would have nothing on you, if the signature didn't match the one on the card. Not to say that it's a flawless safeguard :)
- dachryn 4y ago
  exactly this. Processes have more than 1 reason to exist.
- red_admiral 4y ago
  I think the credit card check sort of makes sense. Suppose Alex gets a credit card, signs it, and then Bob steals the card and tries to buy something with it at the store. I presume this is back in the days when credit card transactions are processed offline. The store doesn't want to find out at the end of the day that the card has been cancelled and they're not getting the money. "Can you create a plausible replica of the signature on the back of the card" slightly reduces the probability of this scenario happening. If Alex walks into the store with his shiny new card, but he hasn't signed it yet, the store is actually doing him a favor asking him to sign it - otherwise, if Bob nicks it, Bob can sign the card himself before entering the store, and pass the signature test. Even the store clerk blindly following the "do the signatures match" procedure like described above produces some small non-stupid net positive security value.
- nobody9999 4y ago
  >They want to make sure you hadn't intentionally produced two different signatures. I think, in theory, you could later dispute the charge and the merchant would have nothing on you, if the signature didn't match the one on the card. It certainly seems to be pretty useless though, and most stores just ignore the signature. I recall being at a liquor store with my mother (15 years ago or so) and she was buying a bunch of wine. We got to the checkout and she decided she was going back to the car and handed me her credit card in full view of the cashier. After the cashier ran the credit card, I had to sign the receipt. Since she'd seen my mother hand me the card, I asked the cashier (a teenage or early 20s American) "what dead president's name should I sign the receipt with?" (note that this is in the US) Depressingly, she replied "Benjamin Franklin." (N.B., for non USAians, while Franklin was a very important member of our founding generation, he was never president). As such, at least in my experience, it's been a very long time since anyone really cared about signatures on credit card receipts. These days (in the US, and for much longer elsewhere), chip and PIN are king.
deserted 4y ago
They don't care if you come out with more, just less.
blueflow 4y ago
In Germany, when the DHL delivery guy is unable to give you the package in person, they'll put a yellow note into your postbox and bring it to a nearby package store. The next day you can get the package in exchange for the yellow note, provided the recipient address matches your ID card. If you had it deliver to a different address than which you are registered on, the store clerk is (technically) not authorized to hand it to you, because the addresses don't match. But the backside of the yellow note has a mandate form, which you can use to authorize any person to fetch it for you. So if the clerk refuses to give you the package, you turn the yellow note around, fill in the form and authorize yourself in front of their eyes to get it anyways.
- jenny91 4y ago
  Yes, but if you were stealing the package, you'd now not only have stolen a package but you'd have committed all kinds of identity fraud or forged a signature, and so on, which is a way bigger deal.
- samtho 4y ago
  A lot of this is just currier CYA for disputes. DHL (and others) don't really care who collects the package, so long as whoever authorized the shipment is happy with the result of the delivery.
mhb 4y ago
Sphexish https://en.wikipedia.org/wiki/Sphex https://en.wikipedia.org/wiki/Sphex

Cthulhu_ 4y ago

I never understood signatures, but then my handwriting is all over the place and at best my signature is a squiggle. I haven't a clue how they're verified these days. I suspect they're basically a legal guarantee, where in court you can be asked "is this your signature". Digital records are IMO better.

themoonisachees 4y ago
Signatures are basically the same as credit card numbers. Not secure, but everyone keeps pretending they are, so insurance and legal make sure they are.
samtho 4y ago
We can "sign" something by entering our name into a text box on a web form. That's the easiest to reproduce. This works because the contract is between the other party (requestor) and the named person. Entry by any other party not authorized by the signer will render the contract null and void. The signature answers the question of, "Does X agree to these terms or not?" and not, "Is X who they say they are?"
adamauckland 4y ago
You're absolutely right, they're pretty much not verified unless there's a dispute and someone says "That's not my signature"
- inglor_cz 4y ago
  Depends on the country. In Czechia, some documents (such as the contract about selling/buying property) require verified signatures, where you go to a notary or a post office with your ID card, sign the document in front of them, they note what document you brought to them into a book of signature verifications and stamp the document.
- yellowapple 4y ago
  Mail-in voting in my state entails "signature verification", wherein I learned - the hard way - that they do in fact compare the signature on my ballot to some signature they've got stored somewhere to see if it matches.

talkin 4y ago

> so I produced a new one from my wallet. "It's not signed" she told me. So I signed it in front of her I’ve had this too. It felt weird, but isn’t that bad: You sign just the same before a second attempt, so might as well continue. And the upside of having to do this ad hoc is that it’ll help on future card usage. But the following likeliness check is hilarious of course. :)

jdthedisciple 4y ago

I don't think the 5 item limit is about security, at least not only. I probably has more to do with not wanting too many items to be simultaneously unavailable for other customers, which makes sense. At least that's how I always viewed it, maybe someone can confirm or deny.

fmajid 4y ago
More likely they want to limit the time you spend in the changing room, so they are not unavailable either.
- throwaway744678 4y ago
  That's the reason (at least in the store I used to work). Also, in some stores, the clients drop the items they don't want, and the employees have to fold them back (or put them on a hanger) and to put them back at their correct place in the store. It builds quickly, and you want to keept it manageable.
  - zasdffaa 4y ago
    I've seen people in primark pick stuff off a rail, hold it up to themselves to size it, then if not happy just drop it on the floor and reach for another. It amazes me and not in a good way.

janeway 4y ago

My passport is from a “top” country. To get it I only needed a photo and my birth certificate, which I bought a copy of from a government office for a small fee. Then a signature from police department to say it is “my” certificate to accompany my photo. When I was renewing it in a foreign country I filled out an application online and had it sent to my new foreign address without any checks. Perhaps the embassy checked on my residency but any ID in my new country has been issued based on that passport.

forkerenok 4y ago

I think the story with the credit card makes more sense than it seems at a glance: They want to make sure you hadn't intentionally produced two different signatures. I think, in theory, you could later dispute the charge and the merchant would have nothing on you, if the signature didn't match the one on the card. Not to say that it's a flawless safeguard :)

dachryn 4y ago
exactly this. Processes have more than 1 reason to exist.
red_admiral 4y ago
I think the credit card check sort of makes sense. Suppose Alex gets a credit card, signs it, and then Bob steals the card and tries to buy something with it at the store. I presume this is back in the days when credit card transactions are processed offline. The store doesn't want to find out at the end of the day that the card has been cancelled and they're not getting the money. "Can you create a plausible replica of the signature on the back of the card" slightly reduces the probability of this scenario happening. If Alex walks into the store with his shiny new card, but he hasn't signed it yet, the store is actually doing him a favor asking him to sign it - otherwise, if Bob nicks it, Bob can sign the card himself before entering the store, and pass the signature test. Even the store clerk blindly following the "do the signatures match" procedure like described above produces some small non-stupid net positive security value.
nobody9999 4y ago
>They want to make sure you hadn't intentionally produced two different signatures. I think, in theory, you could later dispute the charge and the merchant would have nothing on you, if the signature didn't match the one on the card. It certainly seems to be pretty useless though, and most stores just ignore the signature. I recall being at a liquor store with my mother (15 years ago or so) and she was buying a bunch of wine. We got to the checkout and she decided she was going back to the car and handed me her credit card in full view of the cashier. After the cashier ran the credit card, I had to sign the receipt. Since she'd seen my mother hand me the card, I asked the cashier (a teenage or early 20s American) "what dead president's name should I sign the receipt with?" (note that this is in the US) Depressingly, she replied "Benjamin Franklin." (N.B., for non USAians, while Franklin was a very important member of our founding generation, he was never president). As such, at least in my experience, it's been a very long time since anyone really cared about signatures on credit card receipts. These days (in the US, and for much longer elsewhere), chip and PIN are king.

deserted 4y ago

They don't care if you come out with more, just less.

blueflow 4y ago

In Germany, when the DHL delivery guy is unable to give you the package in person, they'll put a yellow note into your postbox and bring it to a nearby package store. The next day you can get the package in exchange for the yellow note, provided the recipient address matches your ID card. If you had it deliver to a different address than which you are registered on, the store clerk is (technically) not authorized to hand it to you, because the addresses don't match. But the backside of the yellow note has a mandate form, which you can use to authorize any person to fetch it for you. So if the clerk refuses to give you the package, you turn the yellow note around, fill in the form and authorize yourself in front of their eyes to get it anyways.

jenny91 4y ago
Yes, but if you were stealing the package, you'd now not only have stolen a package but you'd have committed all kinds of identity fraud or forged a signature, and so on, which is a way bigger deal.
samtho 4y ago
A lot of this is just currier CYA for disputes. DHL (and others) don't really care who collects the package, so long as whoever authorized the shipment is happy with the result of the delivery.

mhb 4y ago

Sphexish https://en.wikipedia.org/wiki/Sphex https://en.wikipedia.org/wiki/Sphex