4 ms·

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funn

by bri3d 1y ago

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their team's time) but it's not a lack of basic process in this case. I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI, these type of candidates (whether state-sponsored malicious actors or overemployment shops) are appearing in every industry and every role constantly by the hundreds. I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm and the North Korean operation specifically may be more tailored, fake candidates are rampant throughout the tech industry now.

bko 1y ago
I think its useful to test as to what questions they are and aren't prepared for. In the future you won't necessarily know they were an imposter, so it's good to devise and test certain captcha like questions to tease out the fake from the real candidates.
ryandrake 1y ago
> I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person?? Also, the in-person step is usually at the end, which means yes, you can waste a lot of time phone- and Zoom-chatting with fake candidates, but that is equally true for in-office vs. remote roles. Nobody starts with the in-person, on-site interview.
- squigz 1y ago
  All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.
- bluGill 1y ago
  10 years ago all interviews were in person. With the pandemic they all went 100% remote. We proved that 100% remote positions can work and so there is temptation to continue doing 100% remote interviews for people that will be working remote anyway. Though we have been burned by someone we believe (but cannot prove) was 100% remote and working two jobs at the same time (they were laid off in a recent downsizing before we could get enough evidence, but they didn't seem as productive as we would expect). So I expect even if you apply for a 100% remote position you will need to do one round of interviews onsite. (though who knows if this will protect us)
  - ryandrake 1y ago
    Wow, I guess my experiences are way unusual! Very interesting. Companies are really playing with fire by expecting to hire (either for remote or onsite work) 100% over the phone and videoconferencing.
- deleted 1y ago
  [deleted]
- xp84 1y ago
  Yes, my fully remote company has been hiring for the past 3 months, I've conducted at least 70 first-round interviews, and we hire without in-person meetings.
- MartinodF 1y ago
  Yes, I am in a hybrid role, went through 5 interviews and several more check-ins, and the first time anyone saw me in person was on the first day when I picked up my laptop at the local office (which wasn't even required, I had the option of having it shipped at my home address)
andy99 1y ago
I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI... Good. I hope the whole hiring process gets blown up. The root cause of this is transactional hiring. Companies treat applicants like commodities, and now bad actors have found out how to game it.
- herculity275 1y ago
  Do you want the industry to go back to only hiring from the top ~20 schools and by word-of-mouth networking? Coz that's the only viable alternative to the current interview process.
  - antisthenes 1y ago
    > Do you want to the industry to go back to hiring from the top ~20 schools and by word-of-mouth networking? This never stopped and is still the case for "good" jobs btw.
    - herculity275 1y ago
      Depends on what your definition of "good jobs" is but I know plenty of people from no name unis in third world countries who landed well paying jobs in FAANG thanks to the current process.
      - tough 1y ago
        He means their bosses are from top 20 schools and didnt get hired because of their skills but their status
- dilyevsky 1y ago
  If you think this is going to lead to better treatment of candidates in the industry then i got really bad news for you
- 1y ago
hnlmorg 1y ago
> I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm I can definitely confirm it’s not just finance and crypto being targeted. I can also confirm it’s not just state sponsored North Korean agents too. Sometimes it’s just individuals trying to fake it until they make it. However I dont agree with your conclusion that remote interviews are not dead because of this. Yes it’s annoying and time consuming filtering out these culprits, but the interview process already was an annoying and time consuming process to begin with. So I wouldn’t be so quick to throw the baby out with the bath water.
singleshot_ 1y ago
Today’s bad startup idea: Firm that looks like it is hiring for remote jobs, but is actually a honeypot that harvests credentials and identifiers that will enable our clients tondetect scam applicants.

by bri3d 1y ago

bko 1y ago

I think its useful to test as to what questions they are and aren't prepared for. In the future you won't necessarily know they were an imposter, so it's good to devise and test certain captcha like questions to tease out the fake from the real candidates.

ryandrake 1y ago

> I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single person in person?? Also, the in-person step is usually at the end, which means yes, you can waste a lot of time phone- and Zoom-chatting with fake candidates, but that is equally true for in-office vs. remote roles. Nobody starts with the in-person, on-site interview.

squigz 1y ago
All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.
bluGill 1y ago
10 years ago all interviews were in person. With the pandemic they all went 100% remote. We proved that 100% remote positions can work and so there is temptation to continue doing 100% remote interviews for people that will be working remote anyway. Though we have been burned by someone we believe (but cannot prove) was 100% remote and working two jobs at the same time (they were laid off in a recent downsizing before we could get enough evidence, but they didn't seem as productive as we would expect). So I expect even if you apply for a 100% remote position you will need to do one round of interviews onsite. (though who knows if this will protect us)
- ryandrake 1y ago
  Wow, I guess my experiences are way unusual! Very interesting. Companies are really playing with fire by expecting to hire (either for remote or onsite work) 100% over the phone and videoconferencing.
deleted 1y ago
[deleted]
xp84 1y ago
Yes, my fully remote company has been hiring for the past 3 months, I've conducted at least 70 first-round interviews, and we hire without in-person meetings.
MartinodF 1y ago
Yes, I am in a hybrid role, went through 5 interviews and several more check-ins, and the first time anyone saw me in person was on the first day when I picked up my laptop at the local office (which wasn't even required, I had the option of having it shipped at my home address)

andy99 1y ago

I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Even though even moderate background checking can filter these candidates out, it's quite time consuming and with the rise of generative AI... Good. I hope the whole hiring process gets blown up. The root cause of this is transactional hiring. Companies treat applicants like commodities, and now bad actors have found out how to game it.

herculity275 1y ago
Do you want the industry to go back to only hiring from the top ~20 schools and by word-of-mouth networking? Coz that's the only viable alternative to the current interview process.
- antisthenes 1y ago
  > Do you want to the industry to go back to hiring from the top ~20 schools and by word-of-mouth networking? This never stopped and is still the case for "good" jobs btw.
  - herculity275 1y ago
    Depends on what your definition of "good jobs" is but I know plenty of people from no name unis in third world countries who landed well paying jobs in FAANG thanks to the current process.
    - tough 1y ago
      He means their bosses are from top 20 schools and didnt get hired because of their skills but their status
dilyevsky 1y ago
If you think this is going to lead to better treatment of candidates in the industry then i got really bad news for you
1y ago

hnlmorg 1y ago

> I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm I can definitely confirm it’s not just finance and crypto being targeted. I can also confirm it’s not just state sponsored North Korean agents too. Sometimes it’s just individuals trying to fake it until they make it. However I dont agree with your conclusion that remote interviews are not dead because of this. Yes it’s annoying and time consuming filtering out these culprits, but the interview process already was an annoying and time consuming process to begin with. So I wouldn’t be so quick to throw the baby out with the bath water.

singleshot_ 1y ago

Today’s bad startup idea: Firm that looks like it is hiring for remote jobs, but is actually a honeypot that harvests credentials and identifiers that will enable our clients tondetect scam applicants.