16 ms·

We installed a single turnstile to feel secure

362 points by firefoxd 8mo ago

CoffeeOnWrite 8mo ago
Allegations of security theater should start with discussing the threat model. This is just somebody complaining about a crappy key card system.
- ableal 8mo ago
  To be fair, he was pointing out that the invisible "credentials in cookies" issue was much harder to get fixed: The turnstiles were visible. They were expensive. They disrupted everyone's day and made headlines in company-wide emails. Management could point to them and say that we're taking security seriously. Meanwhile, thousands of employees had their Jira credentials stored in cookies. A vulnerability that could expose our entire project management system. But that fix required documentation, vendor approval, a month of convincing people it mattered. A whole lot of begging.
  - CoffeeOnWrite 8mo ago
    Again, not security theater. Signs of general dysfunction yes. Embarrassing. Fun to tease about for sure. Aside: the more times I re-read the article the more annoyed I am with the self-righteous tone. It feels like the author is mimicking the style of legendary Usenet posts, but the story just isn’t that interesting and the writing not that witty, it falls flat.
    - mcbits 8mo ago
      The writing is clearly AI-generated or at least AI-assisted, so I think it's safe to assume it's also a work of fiction.
      - leephillips 8mo ago
        I’ll take your word for that. I don’t know how to tell. But I did notice that the writing was conspicuously terrible throughout. Entire sentences make no sense, such as “I'd slip in suspiciously while they contemplated the email that clearly said not to let anyone in with your own card.”
        dryarzeg 8mo ago
        [dead]
        mcbits 8mo ago
        The last two paragraphs are mainly what stood out. I've spent hours trying to get LLMs to stop writing like that. It's hard because you can't just say things like "don't write lists of three items" because sometimes you want a list of three items. The rest of the text could be written by a person as it's kind of disjointed, but that could also be the result of trying to prompt out the AI-isms.
        Rapzid 8mo ago
        Turnstiles aren't theater and Redis doesn't make password storage secure so the entire thing seems a little el-el-emish.. But what about that sentence does that not make sense? They are describing tailgating..
        leephillips 8mo ago
        It doesn’t make sense as a whole. But, for example, what was he suspicious of?
        Rapzid 8mo ago
        "I'd slip in suspiciously" means the "slipping in" was suspicious.
        leephillips 8mo ago
    - summermusic 8mo ago
      If it isn't outright fake it's at least embellished. It even has the "and then everyone clapped" line!
Apreche 8mo ago
I’ve been to many very large office buildings with turnstile systems, and I have never seen any kind of line, even during the busiest hours. Yes, they are security theater to a large extent, but they do legitimately help to make the elevators run a lot more efficiently.
- hinkley 8mo ago
  I’ve only worked two places as big as OP described, but you probably see this more when your company leases a third of a floor on a giant office building. Or a floor and a half, or two half floors because it was easier to expand onto the 12th floor. Elevators do back up, especially when everyone has to scan for their floor. Not like the author suggests, but you can lose a good few minutes a couple times a day that way. It does start some people on an exercise kick of using the stairwell to leave the building. Not great exercise though. The one place solved this by not building parking garages. Flat parking that went to the horizon. By the time I got to work the spot I parked at was going to be over half a mile from my desk. I bought a grownup scooter with oversized wheels, first day I used it security tracked me down and said those aren’t allowed on company property (I had half a mind to use it on the sidewalks around the outside of the property but didn’t, since I’d still be carrying the stupid thing into the building). But I spent a lot on that scooter and had no other use for it, so I was mad. My coworker had convinced me that this was billable hours (court precedent about a factory that had a bad setup for employees to get to the time clock) so I started phoning into standup when I was on site but still eight minutes from my desk. When you’re walking half a mile to the security doors it tends to stagger the arrival times. Which is a feature, if the dumbest one.
Normal_gaussian 8mo ago
There is nothing here that really tells us the turnstile was security theatre? Or the various key card swipes. There are many ways to skin a cat; and there are many ways to ensure authenticated / trusted access. If you have site wide security gates, it means you know everyone on site / on a given floor conforms to a given minimal security or trust level, so now you can conduct operations in that area with more freedom. This makes the risk assessments for other actions so much simpler. e.g. Now when the apprentice IT tech leaves the SLT's laptop trolley in the corridor it doesn't trigger a reflash of all of the machines. Or when a key individual misplaces their keyfob (e.g. in the kitchen) it doesn't trigger a lockdown of core systems, because they had it on the way in and its reasonable to trust that nobody stole it. Obviously the implementation was botched in this case - but "feel secure" and "security theatre" are right as often as they are wrong.
- mikeryan 8mo ago
  It also doesn’t describe any of the why the additional security measures were put in place. It sounds arbitrary, but could be an insurance or regulatory requirement that the acquiring company needed to meet. Similar for the login issue, it’s suboptimal but what constraints caused that solution to be put in place? And why wasn’t it fixed? Sans context there’s not a lot to complain about here.
- formerly_proven 8mo ago
  Card readers in elevators are theater though. You would need separate vestibules to actually secure entry via elevator. That’s why most buildings have those.
  - XorNot 8mo ago
    Are they? The goal isn't to draw a hard boundary it's to create layered defenses which increase the difficulty and reduce opportunity. If instead of open access you need to tailgate on a limited set of employees, that increases difficulty considerably and makes the opportunity much less common. Real security analysis works this way: you don't assume you can build a wall which is never breached.
heytakeiteasy 8mo ago
Security theater, perhaps. Don't underestimate the degree to which those turnstiles were intended to serve the purpose of tracking employees' movements.
deleted 8mo ago
[deleted]
knallfrosch 8mo ago
Those turnstiles were inefficient (slowed legitimate users down), but not security theater (they really blocked unauthorized access.)
hamdingers 8mo ago
I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was actually secure.
- PunchyHamster 8mo ago
  How the fuck nobody notices some randoms coming to steal snacks in the first place ?
  - mystifyingpoi 8mo ago
    I work at a company of ~200 people and I already don't recognize everyone. Seeing an unknown face, I just assume they are from some distant team that I never had to interact with, say hi and move on.
  - kjs3 8mo ago
    We have nearly a 1000 people in my building. I don't track every rando that walks by, nor reasonably could I.
  - hamdingers 8mo ago
    ~400 person company spread across a few floors, but only one kitchen. It wasn't weird for people you didn't recognize to come off the elevator and get snacks to take back to their floor.
  - bombcar 8mo ago
    There's a huge difference between a company with its own building, and a company that shares a building in some way with other companies. Many I've seen have it setup so that if you get past the security guard at the lobby, you effectively had full reign of the entire building, including many companies that wouldn't lock the doors or common areas.
amluto 8mo ago
Turnstiles have a genuine security benefit compared to door and elevator security: convincing people not to let their coworkers in the door or up the elevator is difficult because the actual request (“close the door behind you, this blocking the friendly person trying to go through, so their scan their card”) is genuinely obnoxious. But a turnstile really does fundamentally let one person through, even if it’s easy to bypass.
- Izkata 8mo ago
  And then there's full-body turnstiles. Ugly, but good luck bypassing that.
  - TYPE_FASTER 8mo ago
    Put on a UPS/FedEx uniform, put somebody in a box, and drop them off at receiving.
    - XorNot 8mo ago
      So they can die from dehydration while we spend 3 days trying to figure out who ordered the weird coffin sized box no ones coming to claim?
Liftyee 8mo ago
Lift (elevator) sidenote: there are fancy well designed ones where the turnstile communicates what floor you need to go to to the lift, and a "destination dispatch" system assigns/batches groups of passengers with similar/same destinations to the same lift car to improve efficiency.
robomartin 8mo ago
Interesting. I have worked in ITAR environments with serious security and have never experienced 30 minute lines at the door. In fact, I can't remember lines at all. Hard to understand what happened here. Was it really a single turnstile for a building with over 10 floors? That's kind of silly, isn't it? Mass transit operations have this figured out. Most recently for me, taking the monorail in Las Vegas for the CES show. No problems for the most part. It would be interesting to know what this company actually installed.
- wildzzz 8mo ago
  I don't see how any of this wasn't already a problem. In the story, everyone shows up to the office at the same time, how did they use to work out the elevator issue? This story has a bunch of AI telltales so I doubt it's real anyway.
  - TYPE_FASTER 8mo ago
    In the story, they implemented table (building) and row (floor) level permissions simultaneously. So you had to swipe into the building, then in the elevator to get the elevator to stop at your floor. I guess I could see contention possibly happening as described if everybody arrived almost simultaneously and both swiping points had very high latency. But why not keep the door checkpoints armed and disable the elevator swipes? That makes me think it's a contrived example.
jez 8mo ago
As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in while law enforcement arrives,” less than preventing someone from coat tailing their way into the building at all. [1] https://news.ycombinator.com/item?id=16748529 https://news.ycombinator.com/item?id=16748529
- nine_k 8mo ago
  If forced partition of a building were the primary goal, that goal could be achieved without badges. Or, at least, without having to badge into every door. Just have locks on every door that are normally disengaged, but which can be locked remotely and promptly. (While at it, I once worked on an access control system. It was aeons ago; the system ran under OS/2. We installed it on a factory. It worked well, until we ran it in demo mode under production load, that is, the stream of morning shift turnstile registration events. The DB melted. I solved the problem trivially: I noticed that the DB was installed on a FAT volume for unknown reasons, so I moved it to an HPFS volume, and increased the RAM cache for the disk to maximum. Everything worked without a hitch then.)
  - avidiax 8mo ago
    This actually exposes how this type of system is just security theater usually. A shooter can get a badge. Most partitions aren't bulletproof (and probably don't have security film), and a shooter doesn't fear getting a cut on some tempered glass. The thing that would be effective is 24/7 security monitoring with a building lockdown and reinforced entrances/partitions. Of course, the victims whose badges were disabled during lockdown will sue. So instead, just install badge readers and say that "something was done".
    - hinkley 8mo ago
      Shooters tend to be mentally ill people who have been pushed too far by a system, trying to burn that system down. Killing a boss with a keycard that opens everything might not just be possible but also preferable. Fuck you Tom, you made me work through memaw’s funeral
nine_k 8mo ago
This text is another reminder about the fact that as organizations grow, they become more and more dysfunctional. They function despite that, because the economies of scale are apparently still larger than the loss of functionality due to the increased size. Humans' most important achievement is the ability to create structures larger than the Dunbar number. But this is not achieved for free. (And this is another reason why I strive to work at startups more than at huge corporations.)
- okanat 8mo ago
  It is not the economies of scale but entry cost increase per each new player entering the same market. The real world markets are guarded, price fixing oligopolies. The most important thing a startup is expected to do is not to get profitable quick but suffocate all possibilities of competition. Dysfunctionality is not a bug, it is a feature of our economic system.
Scubabear68 8mo ago
Many years ago I was doing due diligence on a point of sale hardware company, I had to head up to an acquisition they had done. People bitched and moaned about the level of physical security added, and when I asked them why they were so upset, they told me to go to the loading dock in the back. The loading dock was kept completely open "because it's hot and we don't have A/C back here!".
chihuahua 8mo ago
Amazon is pretty serious about physical access security. Even back in 2002, you had to scan your badge while a security guard watches, to check if you are the same person as the badge picture. The same guard also checked if your dog was registered (I think my dog got a badge with his picture, although I think that was just for fun, and not functional) And no easy ability to enter through side doors - you couldn't open a side door with your badge. At the time, you could still lurk outside a side door until someone else opens the door to exit. Eventually (11 years later) they locked all the side doors because they noticed people doing this sort of thing. More recently, I think you have to scan your badge to leave so they can even track how long you're in the building, and know when you're supposed to work on site but you were there only long enough to have a coffee and then went home to continue working from home. This last part is second-hand knowledge since I haven't work there in a long time.
- xvedejas 8mo ago
  > they locked all the side doors And this didn't get them in trouble with the fire marshal?
  - malfist 8mo ago
    Amazon employees can just use all the ...water... bottles they keep around their workstation to put out the fires.
    - kuhaku22 8mo ago
      > Additionally, the weapon is not limited to offensive use, as it can be used to extinguish afterburn on oneself and teammates https://wiki.teamfortress.com/wiki/Jarate https://wiki.teamfortress.com/wiki/Jarate
  - amethyst 8mo ago
    If it's anything like Facebook, the side entrances (which always had guards sitting by them anyways) were all converted to alarmed fire exits. So the fire marshal would still be happy, but it was far less convenient for employees.
class3shock 8mo ago
This is the opposite of security theater. It was an apparently an implementation of security with issues but restricting physical access, both for people and vehicles, is absolutely a real improvement to security.
jacquesm 8mo ago
Funny. We had a security guard that had memorized all the faces of the employees. If he knew you he'd buzz you through. If he didn't know you you'd have to be vouched for by someone that he did know or by showing your credentials. By day #3 he'd know you, and he also somehow knew when you were no longer with the company. There never was a line and there were 1400 people in those buildings. I never realized how incredibly that guy's contribution was but this story made it perfectly clear. Also, I don't actually buy the story as related here. It would seem to me that within minutes of that queue building up the turnstiles + card system would be disabled because something clearly was not working.
- hughw 8mo ago
  Also... three buildings with 13 storeys? With all the trouble builders go to to avoid 13th floors.
CydeWeys 8mo ago
I'm not really sure what the point of this article is. Yes, obviously, you need to implement systems that are secure and performant so that you don't get a backed-up line of people waiting an hour just to get into the office in the morning. But that's a notably flawed rollout; millions of employees go into badge-in-required offices every day without issue. And it's kind of hard to imagine running a large office while lacking such basic physical security as "keep unauthorized people out of the building". Having electronic badges and readers is table stakes.
- SiempreViernes 8mo ago
  Yeah, it got very strong "hello, I'm from the internet and this meatspace thing you are doing is wrong" vibes.
  - deleted 8mo ago
    [deleted]
- Rapzid 8mo ago
  I thought the point is store your passwords in Redis because it's WebSecure.
mdavid626 8mo ago
I feel the same way. Once I worked with junior developer, who was really eager to develop stuff. He was tasked to create a development environment, where we can tests features. Nothing fancy, just some scripts and simple containers. He used copies of the production database, but forgot to set the admin password. The machine in ec2, public on the internet. It was fixed few weeks later. But the connection still doesn’t use SSL, sends passwords plain text. Yeah, he doesn’t really like criticism about his work… I always think about the phrase: “Security is our highest priority” Sure.
firefoxd 8mo ago
Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The turnstiles are not useless, they give an active record of who is in the building, and stop unauthorized people. But they also give so much comfort that we neglect the other types of threats.
- horeszko 8mo ago
  Perhaps part of the problem is that an active shooter is easy to visualize and understand whereas unsecured credentials stored in cookies are an abstract and difficult to visualize problem for management. Furthermore, turnstiles are easy to promote and take credit for. Secure web authentication would have to be explained to and understood by the boss's boss before credit for it could be claimed. I suspect it's these aspects of organizational reality that results in security theater.
  - margalabargala 8mo ago
    I think it has less to do with ease of visualization and more to do with priority of consequences. Do a poll of whether people would prefer that a mass shooting or a mass data breach occur at their place of work while they are there. I bet I know which one wins.
- kristianp 8mo ago
  The majority of commenters don't actually read the article, or at least not the whole thing.
- gosub100 8mo ago
  I don't think you could take over the company with a jira token. Another factor for consideration with turnstiles is disability access and fire egress. Those are covered by building code but since this is a parable, it's worth noting that physical security has often caused tragic stampedes that have killed many.
OutOfHere 8mo ago
If you as an employer are not doing physical engineering or working with large or unsafe physical objects, you don't need an office, period. For computer work alone, you don't need an office at all. If you fix the "office theater", the physical security problems disappear.
ARandomerDude 8mo ago
Whenever I see this in practice I always think a determined killer would clearly know not to attack the “secure” building. Rather, attack the densely-packed line of people waiting to swipe their badges. Unnervingly, this usually occurs to me when I’m waiting patiently in the densely packed line of fellow targets.
mikestew 8mo ago
Bad implementations do not "security theater" make. When I did some work for a large coffee company, they had turnstiles at their building entrances, and I don't remember any lines in the morning. The scan/auth/enter process went about as fast as if there was no turnstile. I remember when I started at Microsoft decades ago that there were still "old-timers" who were pissy about having to use card keys to enter the building. With that attitude, man, did that ever explain Microsoft application and OS security in the early 2000s.
alexchamberlain 8mo ago
I'm not going to comment on the security implications of either situation, but is there a companion piece by the facilities team complaining about the amount of paperwork required to install turnstiles only for a software engineer to come along and lock them out of Jira on a whim?
ryanjshaw 8mo ago
Could have been worse. Anybody remember that story where the keycard readers would randomly work and eventually it was discovered the log file had grown huge and was being appended by reading the whole thing into memory over the network, appending the line, and writing the whole thing back out again, thus creating what the random pattern because I guess it would sometimes time out?
deleted 8mo ago
[deleted]
jp57 8mo ago
Am I the only one who finds this post weird because this is a solved problem? I've worked for 18 years at companies where everyone had to badge into every building. There have never been lines of people waiting to get in. Once I worked in a 12-story building. Of course, the badging wasn't in the elevators: the elevator lobbies on each floor had doors with badge readers. The feel of the piece is that the entire effort was misguided, when the real story seems to be, "My company was somehow unable to implement something that every other company does easily."
- cozzyd 8mo ago
  Yes, I sometimes work in the Hancock building in Chicago. The turnstiles are never congested.
arjie 8mo ago
Electronic audit trail makes SOC2 report easier for auditors. You can use paper trail instead, but electronics makes it easier. Few things in the world are required, but some of these compliance things are 'viral' in that if you're a vendor to a guy who needs compliance you need to practice the standards as well. Besides, visibility is sufficient as a deterrent. Back in India, there'd be a big difference between leaving an old man in a chair in front of the shop and having exactly zero people in front of the shop. There are classes of people you deter with the former who will not be deterred by the latter. The old man is not 'security' - anyone motivated can shut him up without much effort. And yet his presence works.
jiggawatts 8mo ago
“If the security is not in your face, then it’s not sufficiently theatre!” That’s a quote I tell security people in jest when they suggest yet another door literally or figuratively slamming in someone’s face to let them know that there is a security procedure in place. Seriously though, “security” is an overloaded word used for two unrelated business goals: 1. Having security. 2. Appearing to have security. The latter is strongly preferred by management that just wants someone else or something else to blame. To reiterate: this isn’t an error! It’s done on purpose.
deleted 8mo ago
[deleted]
albert_e 8mo ago
I feel both cases involved documentation, approval, months of lead time -- only the OP didnt have to deal with paperwork themselves in the physical securtiy domain. In every sphere there are attempts at security that either achieve a practical balance of fit versus downsides. The failure of access cards is probably analogous to a well intentioned sofware authentication system that was implemented without simulating or testing for the scale of deployment, and had to be rolled back when it failed in production.
closeparen 8mo ago
The corporate security theater that kills me is insisting that everyone tap their badge on the reader next to an already-open door. Even in the presence of a guard, this merely ensures that everyone passing through the open door has some object, plausibly badge-shaped, to hold near the reader. Essentially any NFC card will make it beep. Only a valid credential will actuate the lock, but the door is already open, and the click is too subtle for its absence to alarm anyone. There is a device you can deploy if you're serious about ensuring that every single individual in a moving crowd has a valid credential... a turnstile! Assuming you've calculated the appropriate number of them for the expected traffic flow.
crazygringo 8mo ago
> I waited in line for at least 30 minutes just to make it to the lobby... Scanning was already slow, you had to wait to be approved. But once you passed the turnstile, there was another line for the elevators. I'm baffled. I've worked in multiple buildings with turnstiles. There's never been a line. They take about a second to scan. Is this just some horrible broken implementation? I get why they're used. They protect randos from walking in and stealing stuff. It's not about "feeling" secure. When you have someone make off with 10 laptops, it's actual security. And that's before you start worrying about more serious threats that come from plugging in USB keys...
UltraSane 8mo ago
Epic the EMR company in Verona Wisconsin is pretty unique in that during work hours The entrances to all office buildings do not require RFID cards. The Epic campus is enormous with almost 14,000 people with relatively high turnover so a random non-employee isn't likely to be noticed. I even kept my ID card in my wallet and was never reprimanded. The RFID readers were all at perfect rear pocket height.
UltraSane 8mo ago
I worked for a manufacturing company that actually put turnstiles that required RFID cards to enter AND LEAVE factories. I never understood how this was legal.
kevin_thibedeau 8mo ago
Kodak had man trap turnstiles that would lock you in them if you went through too slow or got snagged while carrying things. You had to reach through the bars and swipe the reader again to unlock it.
SkiFire13 8mo ago
At the company I work at we have turnstiles that you open with an app on your phone, however the reason seems to be to know if anyone is in the elevators in case of emergency.
donatj 8mo ago
There was an active shooter in our area a number of years ago and they locked the building down. No one was injured, it was a domestic dispute in a neighborhood a few blocks away. The police caught the guy hiding in some bushes. In response to the perceived need to "do something", my company put cameras in the hallway we share with other companies and gave the receptionist monitors for the cameras and a panic button that locks all the doors. It's not a terrible thing, it's largely security theater though. Someone would have to be clearly brandishing a weapon and our receptionist would have to notice this amongst all her other duties and out of all the people in the hall. It could happen, but it seems unlikely.
wpollock 7mo ago
This discussion reminds me of this bit of security theatre: <https://wpollock.com/images/Security-done-wrong.jpg https://wpollock.com/images/Security-done-wrong.jpg>

362 points by firefoxd 8mo ago

Allegations of security theater should start with discussing the threat model. This is just somebody complaining about a crappy key card system.

ableal 8mo ago
To be fair, he was pointing out that the invisible "credentials in cookies" issue was much harder to get fixed: The turnstiles were visible. They were expensive. They disrupted everyone's day and made headlines in company-wide emails. Management could point to them and say that we're taking security seriously. Meanwhile, thousands of employees had their Jira credentials stored in cookies. A vulnerability that could expose our entire project management system. But that fix required documentation, vendor approval, a month of convincing people it mattered. A whole lot of begging.
- CoffeeOnWrite 8mo ago
  Again, not security theater. Signs of general dysfunction yes. Embarrassing. Fun to tease about for sure. Aside: the more times I re-read the article the more annoyed I am with the self-righteous tone. It feels like the author is mimicking the style of legendary Usenet posts, but the story just isn’t that interesting and the writing not that witty, it falls flat.
  - mcbits 8mo ago
    The writing is clearly AI-generated or at least AI-assisted, so I think it's safe to assume it's also a work of fiction.
    - leephillips 8mo ago
      I’ll take your word for that. I don’t know how to tell. But I did notice that the writing was conspicuously terrible throughout. Entire sentences make no sense, such as “I'd slip in suspiciously while they contemplated the email that clearly said not to let anyone in with your own card.”
      - dryarzeg 8mo ago
        [dead]
      - mcbits 8mo ago
        The last two paragraphs are mainly what stood out. I've spent hours trying to get LLMs to stop writing like that. It's hard because you can't just say things like "don't write lists of three items" because sometimes you want a list of three items. The rest of the text could be written by a person as it's kind of disjointed, but that could also be the result of trying to prompt out the AI-isms.
      - Rapzid 8mo ago
        Turnstiles aren't theater and Redis doesn't make password storage secure so the entire thing seems a little el-el-emish.. But what about that sentence does that not make sense? They are describing tailgating..
        leephillips 8mo ago
        It doesn’t make sense as a whole. But, for example, what was he suspicious of?
        Rapzid 8mo ago
        "I'd slip in suspiciously" means the "slipping in" was suspicious.
        leephillips 8mo ago
  - summermusic 8mo ago
    If it isn't outright fake it's at least embellished. It even has the "and then everyone clapped" line!

Apreche 8mo ago

I’ve been to many very large office buildings with turnstile systems, and I have never seen any kind of line, even during the busiest hours. Yes, they are security theater to a large extent, but they do legitimately help to make the elevators run a lot more efficiently.

hinkley 8mo ago
I’ve only worked two places as big as OP described, but you probably see this more when your company leases a third of a floor on a giant office building. Or a floor and a half, or two half floors because it was easier to expand onto the 12th floor. Elevators do back up, especially when everyone has to scan for their floor. Not like the author suggests, but you can lose a good few minutes a couple times a day that way. It does start some people on an exercise kick of using the stairwell to leave the building. Not great exercise though. The one place solved this by not building parking garages. Flat parking that went to the horizon. By the time I got to work the spot I parked at was going to be over half a mile from my desk. I bought a grownup scooter with oversized wheels, first day I used it security tracked me down and said those aren’t allowed on company property (I had half a mind to use it on the sidewalks around the outside of the property but didn’t, since I’d still be carrying the stupid thing into the building). But I spent a lot on that scooter and had no other use for it, so I was mad. My coworker had convinced me that this was billable hours (court precedent about a factory that had a bad setup for employees to get to the time clock) so I started phoning into standup when I was on site but still eight minutes from my desk. When you’re walking half a mile to the security doors it tends to stagger the arrival times. Which is a feature, if the dumbest one.

Normal_gaussian 8mo ago

There is nothing here that really tells us the turnstile was security theatre? Or the various key card swipes. There are many ways to skin a cat; and there are many ways to ensure authenticated / trusted access. If you have site wide security gates, it means you know everyone on site / on a given floor conforms to a given minimal security or trust level, so now you can conduct operations in that area with more freedom. This makes the risk assessments for other actions so much simpler. e.g. Now when the apprentice IT tech leaves the SLT's laptop trolley in the corridor it doesn't trigger a reflash of all of the machines. Or when a key individual misplaces their keyfob (e.g. in the kitchen) it doesn't trigger a lockdown of core systems, because they had it on the way in and its reasonable to trust that nobody stole it. Obviously the implementation was botched in this case - but "feel secure" and "security theatre" are right as often as they are wrong.

mikeryan 8mo ago
It also doesn’t describe any of the why the additional security measures were put in place. It sounds arbitrary, but could be an insurance or regulatory requirement that the acquiring company needed to meet. Similar for the login issue, it’s suboptimal but what constraints caused that solution to be put in place? And why wasn’t it fixed? Sans context there’s not a lot to complain about here.
formerly_proven 8mo ago
Card readers in elevators are theater though. You would need separate vestibules to actually secure entry via elevator. That’s why most buildings have those.
- XorNot 8mo ago
  Are they? The goal isn't to draw a hard boundary it's to create layered defenses which increase the difficulty and reduce opportunity. If instead of open access you need to tailgate on a limited set of employees, that increases difficulty considerably and makes the opportunity much less common. Real security analysis works this way: you don't assume you can build a wall which is never breached.

heytakeiteasy 8mo ago

Security theater, perhaps. Don't underestimate the degree to which those turnstiles were intended to serve the purpose of tracking employees' movements.

deleted 8mo ago

[deleted]

knallfrosch 8mo ago

Those turnstiles were inefficient (slowed legitimate users down), but not security theater (they really blocked unauthorized access.)

hamdingers 8mo ago

I worked at a company that had effectively no physical security during work hours until the second time someone came in during lunch and stole an armload of laptops. Then we got card readers and a staffed front desk, and discovered our snack budget was too high because people from other companies on other floors were coming to ours for snacks too. I never felt the office was insecure, except in retrospect once it was actually secure.

PunchyHamster 8mo ago
How the fuck nobody notices some randoms coming to steal snacks in the first place ?
- mystifyingpoi 8mo ago
  I work at a company of ~200 people and I already don't recognize everyone. Seeing an unknown face, I just assume they are from some distant team that I never had to interact with, say hi and move on.
- kjs3 8mo ago
  We have nearly a 1000 people in my building. I don't track every rando that walks by, nor reasonably could I.
- hamdingers 8mo ago
  ~400 person company spread across a few floors, but only one kitchen. It wasn't weird for people you didn't recognize to come off the elevator and get snacks to take back to their floor.
- bombcar 8mo ago
  There's a huge difference between a company with its own building, and a company that shares a building in some way with other companies. Many I've seen have it setup so that if you get past the security guard at the lobby, you effectively had full reign of the entire building, including many companies that wouldn't lock the doors or common areas.

amluto 8mo ago

Turnstiles have a genuine security benefit compared to door and elevator security: convincing people not to let their coworkers in the door or up the elevator is difficult because the actual request (“close the door behind you, this blocking the friendly person trying to go through, so their scan their card”) is genuinely obnoxious. But a turnstile really does fundamentally let one person through, even if it’s easy to bypass.

Izkata 8mo ago
And then there's full-body turnstiles. Ugly, but good luck bypassing that.
- TYPE_FASTER 8mo ago
  Put on a UPS/FedEx uniform, put somebody in a box, and drop them off at receiving.
  - XorNot 8mo ago
    So they can die from dehydration while we spend 3 days trying to figure out who ordered the weird coffin sized box no ones coming to claim?

Liftyee 8mo ago

Lift (elevator) sidenote: there are fancy well designed ones where the turnstile communicates what floor you need to go to to the lift, and a "destination dispatch" system assigns/batches groups of passengers with similar/same destinations to the same lift car to improve efficiency.

robomartin 8mo ago

Interesting. I have worked in ITAR environments with serious security and have never experienced 30 minute lines at the door. In fact, I can't remember lines at all. Hard to understand what happened here. Was it really a single turnstile for a building with over 10 floors? That's kind of silly, isn't it? Mass transit operations have this figured out. Most recently for me, taking the monorail in Las Vegas for the CES show. No problems for the most part. It would be interesting to know what this company actually installed.

wildzzz 8mo ago
I don't see how any of this wasn't already a problem. In the story, everyone shows up to the office at the same time, how did they use to work out the elevator issue? This story has a bunch of AI telltales so I doubt it's real anyway.
- TYPE_FASTER 8mo ago
  In the story, they implemented table (building) and row (floor) level permissions simultaneously. So you had to swipe into the building, then in the elevator to get the elevator to stop at your floor. I guess I could see contention possibly happening as described if everybody arrived almost simultaneously and both swiping points had very high latency. But why not keep the door checkpoints armed and disable the elevator swipes? That makes me think it's a contrived example.

jez 8mo ago

As others have mentioned, it comes down to the threat model, but sometimes the threat model itself is uncomfortable to talk about. It’s sad to think about, but in my recollection a lot of intra-building badge readers went up in response to the 2018 active shooter situation at the YouTube HQ[1]. In cases like this, the threat model is “confine a hostile person to a specific part of the building once they’ve gotten in while law enforcement arrives,” less than preventing someone from coat tailing their way into the building at all. [1] https://news.ycombinator.com/item?id=16748529 https://news.ycombinator.com/item?id=16748529

nine_k 8mo ago
If forced partition of a building were the primary goal, that goal could be achieved without badges. Or, at least, without having to badge into every door. Just have locks on every door that are normally disengaged, but which can be locked remotely and promptly. (While at it, I once worked on an access control system. It was aeons ago; the system ran under OS/2. We installed it on a factory. It worked well, until we ran it in demo mode under production load, that is, the stream of morning shift turnstile registration events. The DB melted. I solved the problem trivially: I noticed that the DB was installed on a FAT volume for unknown reasons, so I moved it to an HPFS volume, and increased the RAM cache for the disk to maximum. Everything worked without a hitch then.)
- avidiax 8mo ago
  This actually exposes how this type of system is just security theater usually. A shooter can get a badge. Most partitions aren't bulletproof (and probably don't have security film), and a shooter doesn't fear getting a cut on some tempered glass. The thing that would be effective is 24/7 security monitoring with a building lockdown and reinforced entrances/partitions. Of course, the victims whose badges were disabled during lockdown will sue. So instead, just install badge readers and say that "something was done".
  - hinkley 8mo ago
    Shooters tend to be mentally ill people who have been pushed too far by a system, trying to burn that system down. Killing a boss with a keycard that opens everything might not just be possible but also preferable. Fuck you Tom, you made me work through memaw’s funeral

nine_k 8mo ago

This text is another reminder about the fact that as organizations grow, they become more and more dysfunctional. They function despite that, because the economies of scale are apparently still larger than the loss of functionality due to the increased size. Humans' most important achievement is the ability to create structures larger than the Dunbar number. But this is not achieved for free. (And this is another reason why I strive to work at startups more than at huge corporations.)

okanat 8mo ago
It is not the economies of scale but entry cost increase per each new player entering the same market. The real world markets are guarded, price fixing oligopolies. The most important thing a startup is expected to do is not to get profitable quick but suffocate all possibilities of competition. Dysfunctionality is not a bug, it is a feature of our economic system.

Scubabear68 8mo ago

Many years ago I was doing due diligence on a point of sale hardware company, I had to head up to an acquisition they had done. People bitched and moaned about the level of physical security added, and when I asked them why they were so upset, they told me to go to the loading dock in the back. The loading dock was kept completely open "because it's hot and we don't have A/C back here!".

chihuahua 8mo ago

Amazon is pretty serious about physical access security. Even back in 2002, you had to scan your badge while a security guard watches, to check if you are the same person as the badge picture. The same guard also checked if your dog was registered (I think my dog got a badge with his picture, although I think that was just for fun, and not functional) And no easy ability to enter through side doors - you couldn't open a side door with your badge. At the time, you could still lurk outside a side door until someone else opens the door to exit. Eventually (11 years later) they locked all the side doors because they noticed people doing this sort of thing. More recently, I think you have to scan your badge to leave so they can even track how long you're in the building, and know when you're supposed to work on site but you were there only long enough to have a coffee and then went home to continue working from home. This last part is second-hand knowledge since I haven't work there in a long time.

xvedejas 8mo ago
> they locked all the side doors And this didn't get them in trouble with the fire marshal?
- malfist 8mo ago
  Amazon employees can just use all the ...water... bottles they keep around their workstation to put out the fires.
  - kuhaku22 8mo ago
    > Additionally, the weapon is not limited to offensive use, as it can be used to extinguish afterburn on oneself and teammates https://wiki.teamfortress.com/wiki/Jarate https://wiki.teamfortress.com/wiki/Jarate
- amethyst 8mo ago
  If it's anything like Facebook, the side entrances (which always had guards sitting by them anyways) were all converted to alarmed fire exits. So the fire marshal would still be happy, but it was far less convenient for employees.

class3shock 8mo ago

This is the opposite of security theater. It was an apparently an implementation of security with issues but restricting physical access, both for people and vehicles, is absolutely a real improvement to security.

jacquesm 8mo ago

Funny. We had a security guard that had memorized all the faces of the employees. If he knew you he'd buzz you through. If he didn't know you you'd have to be vouched for by someone that he did know or by showing your credentials. By day #3 he'd know you, and he also somehow knew when you were no longer with the company. There never was a line and there were 1400 people in those buildings. I never realized how incredibly that guy's contribution was but this story made it perfectly clear. Also, I don't actually buy the story as related here. It would seem to me that within minutes of that queue building up the turnstiles + card system would be disabled because something clearly was not working.

hughw 8mo ago
Also... three buildings with 13 storeys? With all the trouble builders go to to avoid 13th floors.

CydeWeys 8mo ago

I'm not really sure what the point of this article is. Yes, obviously, you need to implement systems that are secure and performant so that you don't get a backed-up line of people waiting an hour just to get into the office in the morning. But that's a notably flawed rollout; millions of employees go into badge-in-required offices every day without issue. And it's kind of hard to imagine running a large office while lacking such basic physical security as "keep unauthorized people out of the building". Having electronic badges and readers is table stakes.

SiempreViernes 8mo ago
Yeah, it got very strong "hello, I'm from the internet and this meatspace thing you are doing is wrong" vibes.
- deleted 8mo ago
  [deleted]
Rapzid 8mo ago
I thought the point is store your passwords in Redis because it's WebSecure.

mdavid626 8mo ago

I feel the same way. Once I worked with junior developer, who was really eager to develop stuff. He was tasked to create a development environment, where we can tests features. Nothing fancy, just some scripts and simple containers. He used copies of the production database, but forgot to set the admin password. The machine in ec2, public on the internet. It was fixed few weeks later. But the connection still doesn’t use SSL, sends passwords plain text. Yeah, he doesn’t really like criticism about his work… I always think about the phrase: “Security is our highest priority” Sure.

firefoxd 8mo ago

Author here. I posted this on Sunday for a light read, but I guess it got traction today. Based on the comments I see here, I think the focus is going on the turnstiles just as it did when I worked there. While the cookie credentials are pushed aside. I think that's the security theater. We are worried about supposed active shooters, different physical threats while a backdoor to the company is left wide open. The turnstiles are not useless, they give an active record of who is in the building, and stop unauthorized people. But they also give so much comfort that we neglect the other types of threats.

horeszko 8mo ago
Perhaps part of the problem is that an active shooter is easy to visualize and understand whereas unsecured credentials stored in cookies are an abstract and difficult to visualize problem for management. Furthermore, turnstiles are easy to promote and take credit for. Secure web authentication would have to be explained to and understood by the boss's boss before credit for it could be claimed. I suspect it's these aspects of organizational reality that results in security theater.
- margalabargala 8mo ago
  I think it has less to do with ease of visualization and more to do with priority of consequences. Do a poll of whether people would prefer that a mass shooting or a mass data breach occur at their place of work while they are there. I bet I know which one wins.
kristianp 8mo ago
The majority of commenters don't actually read the article, or at least not the whole thing.
gosub100 8mo ago
I don't think you could take over the company with a jira token. Another factor for consideration with turnstiles is disability access and fire egress. Those are covered by building code but since this is a parable, it's worth noting that physical security has often caused tragic stampedes that have killed many.

OutOfHere 8mo ago

If you as an employer are not doing physical engineering or working with large or unsafe physical objects, you don't need an office, period. For computer work alone, you don't need an office at all. If you fix the "office theater", the physical security problems disappear.

ARandomerDude 8mo ago

Whenever I see this in practice I always think a determined killer would clearly know not to attack the “secure” building. Rather, attack the densely-packed line of people waiting to swipe their badges. Unnervingly, this usually occurs to me when I’m waiting patiently in the densely packed line of fellow targets.

mikestew 8mo ago

Bad implementations do not "security theater" make. When I did some work for a large coffee company, they had turnstiles at their building entrances, and I don't remember any lines in the morning. The scan/auth/enter process went about as fast as if there was no turnstile. I remember when I started at Microsoft decades ago that there were still "old-timers" who were pissy about having to use card keys to enter the building. With that attitude, man, did that ever explain Microsoft application and OS security in the early 2000s.

alexchamberlain 8mo ago

I'm not going to comment on the security implications of either situation, but is there a companion piece by the facilities team complaining about the amount of paperwork required to install turnstiles only for a software engineer to come along and lock them out of Jira on a whim?

ryanjshaw 8mo ago

Could have been worse. Anybody remember that story where the keycard readers would randomly work and eventually it was discovered the log file had grown huge and was being appended by reading the whole thing into memory over the network, appending the line, and writing the whole thing back out again, thus creating what the random pattern because I guess it would sometimes time out?

deleted 8mo ago

[deleted]

jp57 8mo ago

Am I the only one who finds this post weird because this is a solved problem? I've worked for 18 years at companies where everyone had to badge into every building. There have never been lines of people waiting to get in. Once I worked in a 12-story building. Of course, the badging wasn't in the elevators: the elevator lobbies on each floor had doors with badge readers. The feel of the piece is that the entire effort was misguided, when the real story seems to be, "My company was somehow unable to implement something that every other company does easily."

cozzyd 8mo ago
Yes, I sometimes work in the Hancock building in Chicago. The turnstiles are never congested.

arjie 8mo ago

Electronic audit trail makes SOC2 report easier for auditors. You can use paper trail instead, but electronics makes it easier. Few things in the world are required, but some of these compliance things are 'viral' in that if you're a vendor to a guy who needs compliance you need to practice the standards as well. Besides, visibility is sufficient as a deterrent. Back in India, there'd be a big difference between leaving an old man in a chair in front of the shop and having exactly zero people in front of the shop. There are classes of people you deter with the former who will not be deterred by the latter. The old man is not 'security' - anyone motivated can shut him up without much effort. And yet his presence works.

jiggawatts 8mo ago

“If the security is not in your face, then it’s not sufficiently theatre!” That’s a quote I tell security people in jest when they suggest yet another door literally or figuratively slamming in someone’s face to let them know that there is a security procedure in place. Seriously though, “security” is an overloaded word used for two unrelated business goals: 1. Having security. 2. Appearing to have security. The latter is strongly preferred by management that just wants someone else or something else to blame. To reiterate: this isn’t an error! It’s done on purpose.

deleted 8mo ago

[deleted]

albert_e 8mo ago

I feel both cases involved documentation, approval, months of lead time -- only the OP didnt have to deal with paperwork themselves in the physical securtiy domain. In every sphere there are attempts at security that either achieve a practical balance of fit versus downsides. The failure of access cards is probably analogous to a well intentioned sofware authentication system that was implemented without simulating or testing for the scale of deployment, and had to be rolled back when it failed in production.

closeparen 8mo ago

The corporate security theater that kills me is insisting that everyone tap their badge on the reader next to an already-open door. Even in the presence of a guard, this merely ensures that everyone passing through the open door has some object, plausibly badge-shaped, to hold near the reader. Essentially any NFC card will make it beep. Only a valid credential will actuate the lock, but the door is already open, and the click is too subtle for its absence to alarm anyone. There is a device you can deploy if you're serious about ensuring that every single individual in a moving crowd has a valid credential... a turnstile! Assuming you've calculated the appropriate number of them for the expected traffic flow.

crazygringo 8mo ago

> I waited in line for at least 30 minutes just to make it to the lobby... Scanning was already slow, you had to wait to be approved. But once you passed the turnstile, there was another line for the elevators. I'm baffled. I've worked in multiple buildings with turnstiles. There's never been a line. They take about a second to scan. Is this just some horrible broken implementation? I get why they're used. They protect randos from walking in and stealing stuff. It's not about "feeling" secure. When you have someone make off with 10 laptops, it's actual security. And that's before you start worrying about more serious threats that come from plugging in USB keys...

UltraSane 8mo ago

Epic the EMR company in Verona Wisconsin is pretty unique in that during work hours The entrances to all office buildings do not require RFID cards. The Epic campus is enormous with almost 14,000 people with relatively high turnover so a random non-employee isn't likely to be noticed. I even kept my ID card in my wallet and was never reprimanded. The RFID readers were all at perfect rear pocket height.

UltraSane 8mo ago

I worked for a manufacturing company that actually put turnstiles that required RFID cards to enter AND LEAVE factories. I never understood how this was legal.

kevin_thibedeau 8mo ago

Kodak had man trap turnstiles that would lock you in them if you went through too slow or got snagged while carrying things. You had to reach through the bars and swipe the reader again to unlock it.

SkiFire13 8mo ago

At the company I work at we have turnstiles that you open with an app on your phone, however the reason seems to be to know if anyone is in the elevators in case of emergency.

donatj 8mo ago

There was an active shooter in our area a number of years ago and they locked the building down. No one was injured, it was a domestic dispute in a neighborhood a few blocks away. The police caught the guy hiding in some bushes. In response to the perceived need to "do something", my company put cameras in the hallway we share with other companies and gave the receptionist monitors for the cameras and a panic button that locks all the doors. It's not a terrible thing, it's largely security theater though. Someone would have to be clearly brandishing a weapon and our receptionist would have to notice this amongst all her other duties and out of all the people in the hall. It could happen, but it seems unlikely.

wpollock 7mo ago

This discussion reminds me of this bit of security theatre: <https://wpollock.com/images/Security-done-wrong.jpg https://wpollock.com/images/Security-done-wrong.jpg>