6 ms·

Other countries are known for a culture of nothing ever happening without a piece of paper carrying an official-looking stamp. Those are laughably insecure, but

• dotancohen 3y ago
  I think that you are unfamiliar with these cultures. In Japan, you would never ask the voice that sounds like the boss to prove his identity with a digitally signed transcript - even if that's a fireable offense. It is so culturally alien to them that it would never get through.
  • Izkata 3y ago
    I think their idea is that the boss would be the one to introduce it ("Bosses might even enjoy the grandeur of showing off their status with an insignia-device.") and because of the culture it wouldn't be difficult for employees to adapt and go along with those new rules.
    • DSMan195276 3y ago
      I think the point is that this works until the "boss" says they need X right now and can't provide digital proof because it's not working for Y reason. Do the employees say no? That's the real test.
    • gutnor 3y ago
      The problem is that inevitably the boss will forget his signature one day. Who is going to challenge him? And if he his challenged, how will he take it? Even in the West, nobody of low seniority challenges the C-level executive when they tailgate or walk around without their badge. And if you are new, if there is an important looking individual you don't recognise, you leave him alone, totally validating the "act as you belong adage".
      • nmfisher 3y ago
        I was quite annoyed - disappointed too - during security induction (Australian NSA). They explicitly said we should challenge anyone not wearing a badge, but then joked that we should learn the department heads first so we don’t accidentally confront the “wrong” person. Exactly the wrong message to send, particularly for an agency that’s supposedly an expert on security.
        • usrusr 3y ago
          A good example of the challenges of real-life hardening. Anecdotes like this are a valuable addition to any discussion of security I think. I perfectly understand what's wrong about the attitude transferred in the joke, yet I can easily see myself being the person sending that wrong message. Very educational!
      • resolutebat 3y ago
        This is a thing that already happens in Japan, where physical personal and company seals (inkan) are regularly used for all sorts of documents and transactions that would get signed in the West. But they've evolved protocols to ensure they're secured and stored, which is why this rarely causes problems in real life.
        • staunton 3y ago
          In practice, there is little if any difference between seals and signatures in tems of security. A signature (or stamp) is easy to fake and get away with for a while. It's very rare that the authenticity of signatures is checked right away. Perhaps even easier than stealing or faking a not-particularly-secured stamp. It only happens when some problem arises and is investigated after the fact. The question is not whether the signature is "authentic enough" but who signed the document. You can aks and answer this question about a seal equally well. The reason we have signatures (or stamps) is as an explicit ritual signifying ratification of a document that one cannot plausibly deny later.
          • deleted 3y ago
  • wozniacki 3y ago
    Also for a country thats so technologically advanced, Japan loves paperwork. They have reams of paperwork that you are expected to furnish for something as simple as registering an office move from a building in one part of town to another building in another. Its mindboggling just how entrenched bureaucracies get if you give them an inch of room to play.
    • staunton 3y ago
      And don't forget the fax machines...
  • usrusr 3y ago
    What if that voice comes packed in bad clothing, smelly and is full of grammar mistakes? Because that's how an order without credentials would feel like, when the rituals of signature verification are established as expected form. The correct reply to an underling who goes all sir-yes-sir without checking would be "do you consider me so unimportant that you don't think it worth your precious time to verify that I actually am who I claim to be?". It would certainly have to be a cultural adaption initiated from the top. If subordinates are expected to fill in for whatever diligence those higher up lack, it won't work, no matter where. It's true, I don't know Japan, but I suspect that they might have it much easier to adapt than western pretend-buddy orgs.
    • beagle3 3y ago
      Not really. In those cultures, just like in armies everywhere, authority comes from the boss/commander and they can override their previous instructions at any point (and many do at some point). There’s often a distinction in armies between “illegal command” issued by a commander, which one has to obey (or risk disciplinary action) and “blatantly illegal command” which must be disobeyed. An example of the former would be “keep your post for 20 hours straight” (where regulations limit a shift to e.g. 12 hours). An example of the latter would be “cut the limbs off other members of your platoon”. An army setting is a much better model of some cultures. They are not as bad, but if taken ad absurdum they would look like an army setting.
      • usrusr 3y ago
        Armies are a good example of authority clearly coming from the role, not from the person, and roles inseparably tied to a lot of expected formal behavior. In an impersonation-hardened army (or corporation), you simply wouldn't make it beyond the very lowest rank unless you demonstrate flawless authentication on both receiver and sender side. Just like you wouldn't make it badly dressed.
        • beagle3 3y ago
          Except .. there’s no effective authentication protocol in place to verify that a specific person is indeed in a specific role (or is indeed person they claim to be).
  • tidenly 3y ago
    That's not true though because most decision and execution processes in Japan are daisy chained. One person can't just make you send a tonne of money because you'd normally have to forward it onto someone else, who clears it with someone else, and then we all sign a ringisho. The daisy chaining prevents single responsibility stuff like this. Also for what it's worth I've done verification callbacks to every single one of my bosses at some point during my career here and no-one's ever questioned it.
    • gilleain 3y ago
      Interesting, I had no idea what a 'ringisho' was, so I found some (likely simplistic) information here: https://en.wikipedia.org/wiki/Japanese_management_culture https://en.wikipedia.org/wiki/Japanese_management_culture > The term of "ringi" has two meanings. The first meaning being of "rin", 'submitting a proposal to one's supervisors and receiving their approval,' and "gi" meaning 'deliberations and decisions.' Corporate policy is not clearly defined by the executive leadership of a Japanese company. Rather, the managers at all levels below executives must raise decisions to the next level except for routine decisions. The process of "ringi decision-making" is conducted through a document called a "ringisho". (For reference)
    • dotancohen 3y ago
      I take it that you were not raised in Japan? Do you agree that someone raised in Japan would have a harder time questioning their boss? I'm no expert, I've never been to the land of the rising sun. This is what people have told me of their time there. Your input is very much appreciated.
  • robertlagrant 3y ago
    > It is so culturally alien to them that it would never get through. If there's a need then this will change. You might as well say that they'd never use a telephone because it's culturally alien. It was alien, but it was useful, so they adapted. Same with email and video calls. The boss has to log into their banking just like everyone else, because there's a need for it. If there's a need for this, the OP's suggestion seems like a pretty good one, as it augments the existing culture with a security step.
  • bmacho 3y ago
    Show them voice transfer with the boss's voice, that should convince them.
  • exe34 3y ago
    I think the way it would work is that the boss himself would send the signature somehow (e.g. on teams) and bosses that don't want their businesses to fall victim would have to ensure that their employees would never accept a call from them outside of the system that allowed the signature check.
  • HeatrayEnjoyer 3y ago
    That attitude will have to change, there's no way around it. These live deepfakes will be as easy to create as a word document in no more than five years and maybe less than two.
    • dotancohen 3y ago
      The Fukushima nuclear accident was not enough to change this culture. And it is far too easy to state that a foreign culture needs to change. The Japanese could say that American or Western culture needs to change, just for example with the glorification of violent criminals in media.
      • HeatrayEnjoyer 3y ago
        The Fukushima nuclear accident had a far narrower impact than this will have. The Fukushima accident did not result in a 'push button to gain money' GitHub software projects. If an angry video call from the boss is all that is required to exfiltrate millions of dollars, and boss video calls become as easy to produce as spam emails, then the exfiltration of funds from Japanese organizations becomes as fast as approximately (spam email send rate) * (millions of dollars). When you have received the 7th angry call from the boss that day, demanding funds be sent immediately, you eventually realize you need a different system. At a minimum the boss will need to come be angry in person.
  • ladyanita22 3y ago
    You can kinda enforce it from the IT side, though.
• ctrw 3y ago
  Yeah with the advent of good deep fakes were at the point where everyone having their own private key is a must for all communication that's not face to face.
  • usrusr 3y ago
    And the only way to get meaningfully reliable at performing those checks would be to make them a habit in face to face as well.
    • ctrw 3y ago
      I mean there is no reason to not do a digital handshake when doing a physical handshake. Just need a fairly non invasive implant.
• daymanstep 3y ago
  Which cultures are like that?
  • ladyanita22 3y ago
    Confucian cultures
• cryptonector 3y ago
  Fake boss: I can't get to my keys. Just wire the money.
  • aussieguy1234 3y ago
    Calls real boss. Was that you? Nope, I guess not.
    • beagle3 3y ago
      That would work in Australia. In most places in the US and Britain as well. I can imagine Israelis calling the real boss and tell them “I don’t believe it’s really you” and refuse to do it. But that’s not how it works in authoritative cultures.
      • mcv 3y ago
        Maybe it will teach authoritative cultures to be less authoritative, and to allow people to question authority. Because it's going to cost you money if they don't.
  • usrusr 3y ago
    Diligent boss: I can't get to my keys. Just wire the money (to a honeypot account operated by the security department)