News for hackers. Stuff that matters.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by alias_neo on Monday March 11, 2019 @06:56PM (#19363689)
As someone that pays attention to things around me, it is interesting the number of people who's name badges I see on display in coffee shops and cafes, indicating, usually, not only their name but also their department, and usually their "rank".

At times I see people with visitor badges on lanyards designed to indicate their security clearance when visiting another department and which are absolutely not meant to be worn off-site.

It might seem pretty benign to the person wearing a green lanyard with a green badge bearing only the word "unescorted", but to those who know, it gives at the very least a security clearance level.

Coupled with their name and department on their usual badge, also being worn, against policy, visibly, in a public space, that information is not only careless but potentially dangerous.

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by cooooooffffeeee on Monday March 11, 2019 @07:29PM (#19363918)
>it gives at the very least a security clearance level.

At the very least. I could reproduce a close-enough badge that would likely fool everyone except the person who designed the original. I've done this twice successfully (failed once and almost got arrested) to fuck with my friend who runs opsec at mid-sized financial services companies.

One company he worked for had these stupid gates that you needed to scan your badge for (it gives you a green light), but there's no physical barrier. All you needed to do was pretend to scan a badge a couple times and say something like 'ugh stupid things' and the security guard just lets you on through.

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by tomglynch on Monday March 11, 2019 @09:26PM (#19364563)
> failed once and almost got arrested

Tell us the story

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by cooooooffffeeee on Tuesday March 12, 2019 @10:51AM (#19368679)
Not much of a story, I was being a fool and trying to go places I wasn't allowed and someone happened to be paying attention. Fortunately my friend working in security told them it was a planned test (it wasn't planned, but he knows I do this to him from time to time).
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by dvfjsdhgfv on Tuesday March 12, 2019 @05:23AM (#19366503)
I thought everyone moved to some kind of RFID cards already.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by cooooooffffeeee on Tuesday March 12, 2019 @10:53AM (#19368699)
Yes and no, visitor badges often don't use RFID. You can get most places if you have a visitor badge and know someone's name (which are all available on LinkedIn). If you get stopped with a badge you can just say "Oh I'm here with so-and-so in X Department" and usually no one follows through beyond that. Saying you're there for an interview will often drop someone's guard too.

Employee badges often do have RFID, but some places just have you use a sign-in sheet if you're an employee and "forgot" yours (i.e., you don't have one), and sometimes security guards will just let you through if your badge is being "temperamental" (i.e., not working because it's fake).

Most corporate security is security theater (or only marginally useful after a crime) and rules are easily skirt-able because companies don't want to restrict employee access under zero-tolerance policies (which are difficult and time-consuming to enforce).

The company I mentioned previously that will just hand-waive you through a gate with no barriers actually goes as far to fingerprint all their employees and contractors. They also won't hire anyone with even a misdemeanor in their criminal record.

Also note that all of this stuff is markedly easier if you're a woman (less likely to be stereotyped as a criminal) and/or if you wear a suit (depending on the office, a suit can often mean "don't confront me because I'm above your pay grade").

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by tehlike on Monday March 11, 2019 @07:19PM (#19363852)
Out of habit, i put my badge into my pocket when i am outside of the office.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by alias_neo on Monday March 11, 2019 @07:30PM (#19363928)
For many, it is policy to do so, and yet, I see people in management positions flagrantly disregarding this.

The sad reality is that a lot of these people don't understand, or don't care about the repercussions of openly disclosing this information.

Just today, I overheard someone discussing that they have a significant number of meetings scheduled with a senior member of government over the next few weeks, in a public space.

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by anigbrowl on Monday March 11, 2019 @08:03PM (#19364140)
Disregard for such things is a great way to show off power and remind more junior employees of their place. Of course, you might rat them out, but then again that could undermine your own prospects.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by qrbLPHiKpiux on Monday March 11, 2019 @07:22PM (#19363876)
Nothing is visible, no PII, no nothing is visible when my wallet is open. I mean nothing. No barcodes, no bank names, no numbers, etc. Security cameras in retail can pick up very fine details.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by walterbell on Tuesday March 12, 2019 @01:15AM (#19365608)
What's a representative camera (e.g. resolution, model number) that is used in retail?
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by Nexxxeh on Tuesday March 12, 2019 @01:29AM (#19365655)
Most of the cameras I've seen in new retail premises in the last few years are HikVision IP cameras, somewhere between 1080P and 5MP (2592 x 1944). YMMV though, and obviously you've got settings and NVR settings when considering quality of footage (and distance, lens etc.)
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by TooCleverByHalf on Monday March 11, 2019 @09:49PM (#19364643)
You live in a scary world.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by Moru on Tuesday March 12, 2019 @03:14AM (#19366012)
So do you
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by abawany on Monday March 11, 2019 @07:11PM (#19363792)
Motorola (of old, in the 90s) used to have a policy of asking employees to remove name badges when going out for lunches and etc. It was a game between the team manager and the employees as to who admonished the other first when going out for team lunches.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by gowld on Monday March 11, 2019 @08:34PM (#19364310)
My former employer had a game where if someone left their computer desktop unlocked, you could add their name to a wall of shame web page . Then management decided that was bad for morale so they took down the web page, and people stopped locking their desktops.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by technotony on Monday March 11, 2019 @11:57PM (#19365300)
We had a version of this at college where if you left a computer logged in (this was the days before everyone had their own device) then you would send an email to the dean of the school making some or other outrageous request and cc'ing the whole school year mailing list. They were pretty funny!
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by abawany on Tuesday March 12, 2019 @12:36AM (#19365451)
Another workplace had a similar scheme: an unlocked machine was an invitation for the person's neighbors to send email on the person's behalf. It was all fun and games for a while (fake product announcements, silly questions posed on the internal mailing alias, fake resignation notices) until someone got really upset when it happened to them and then it sort of died down.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by alias_neo on Tuesday March 12, 2019 @05:38AM (#19366558)
We do this at my office, but without email, if someone leaves their computer unlocked, we're allowed to give them a gentle reminder not to do it in the form of a new desktop wallpaper or reversing their mouse keys and/or scroll direction.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by glangdale on Monday March 11, 2019 @10:58PM (#19364969)
It supposedly was the tradition at Intel to, on finding a unlocked desktop, to fire up Outlook and send a message just reading "I love you" to the person's manager.

I don't know if this really happened.

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by mayniac on Tuesday March 12, 2019 @05:51AM (#19366606)
Boss at my old company was hot on making people lock their machines. Used to leave notepad windows open saying "lock it" or similar, even when we had just gone to the other side of the room and could see him doing it.

After the Nth time of him being hypocritical and leaving his own machine unlocked when he went out of the room I made a scheduled event that popped up with "update complete, rebooting" and then restarted his machine, set to run randomly once a day between 9-5.

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by alsobrsp on Monday March 11, 2019 @11:54PM (#19365293)
We did this, but to all of IT professing their love for all to see.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by superhuzza on Tuesday March 12, 2019 @03:12PM (#19371867)
At my current company, it's an email to the team promising to bring in for donuts or pastries friday morning.

People rarely leave their machines unlocked anymore :)

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by AnIdiotOnTheNet on Tuesday March 12, 2019 @08:13AM (#19367362)
Leaving your computer unlocked is a great way to discover you'd sent an email offering to buy lunch for everyone in the department.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by rayhendricks on Monday March 11, 2019 @08:41PM (#19364351)
I see you Google ;)
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by Raed667 on Tuesday March 12, 2019 @03:26AM (#19366074)
We do this in my office, but usually we send emails promising m&ms or croissants, it's pretty effective.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by js2 on Monday March 11, 2019 @08:13PM (#19364185)
So? Dangerous how? Why is this against policy? I guess in my mind if someone is targeting a company, employees not wearing badges in public doesn't raise the security bar much if at all for an attacker. Meanwhile, the badge is of no value to a random criminal not targeting the company.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by lazyasciiart on Tuesday March 12, 2019 @12:17AM (#19365383)
The badge is of enormous value to a random criminal who doesn't care which company office he steals a few laptops etc from. Even without an attempt to steal/imitate the badge, it gives you an entry point for social engineering.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by ip26 on Monday March 11, 2019 @07:11PM (#19363795)
Can't most of that information be found on LinkedIn?
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by alias_neo on Monday March 11, 2019 @07:24PM (#19363887)
Some of it, yes, but it shouldn't, you're not supposed to disclose above average security clearances, period, which is what the green badge indicates.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by TooCleverByHalf on Monday March 11, 2019 @09:53PM (#19364665)
If above average security clearance is disclosed immediately by someone seeing my badge then thats on the company, not the person with the badge.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by alias_neo on Tuesday March 12, 2019 @05:47AM (#19366590)
The badge exists to identify you and your access privileges, it's purpose is to be on display, and clearly indicate these things.

They're not to be worn outside, and the employee policies state that.

You can argue all you want with your superiors about who it's on while you're being escorted from the building for gross misconduct.

Re:Googling Strangers: One Professor's Lesson on Privacy in ... by fl0wenol on Tuesday March 12, 2019 @02:49AM (#19365927)
You really shouldn't... Only on your resume and don't just give that out to whomever expresses interest; make sure they're legitimate.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by tehlike on Monday March 11, 2019 @07:19PM (#19363854)
if you can get the name, yes.
Re:Googling Strangers: One Professor's Lesson on Privacy in ... by TooCleverByHalf on Monday March 11, 2019 @09:51PM (#19364660)
That's a fault of the badge system then. You can't fix human and human is to wear the badge with some colors that BigCorp gave me and get lunch.