That's amazingly brilliant, but Unfortunately it wouldn't work everywhere as in our org, the 2FA app will only be allowed to be installed on our company provided phones bound to our company issued phone numbers/SIM.

Also, depending on your company and employment agreement, if your Raspberry PI gets compromised by an attacker and uses your 2FA to gain access to your AWS account for example, and causes damage, then your employer can hang you out to dry in court.

I already saw one case where an ex-employee is being sued by his former employer because he decided to be clever and knowingly worked around the company's security policy measures, which he agreed to adhere to in his employment contract. Workaround which lead to an attacker getting his keys and stealing customer data from AWS buckets. Ouch!

Pretty much, if they offer a phone app, you can replicate the 2FA codes yourself.

Edit: Of course, protect the seed with gpg or similar if you do this.

https://smallhacks.wordpress.com/2012/11/11/reading-codes-fr...

As a footnote, I can guarantee I could make it work on your company provided phones too. Even when they're locked and with a biometric scan requirement and the inability to run any non-approved software.

Seems more healthy for your mental wellbeing in the long run, as toxic policies in workplaces rarely come alone but tend to come sequentially one after another as time goes on if the terror managers don't change or enough employee don't jump ship simultaneously to trigger a management change.

Nobody's saying they're not doing that. Depending on life circumstances and where you live, it can take months to find a new job that's actually better than the one you're in, even when actively looking.

IIRC, consumer grade paper shredders got pretty good in the past few years. And your examples both rely on the person setting up the security circumventing it by supplying bad training/enrolling. Which makes it bad if you want to guarantee a person is behind it, but fine if you want to treat it as something that belongs to the person doing the enrolling.

And I have found that most corporate security, especially in the biometric arena, is sub-par, usually because of the human component doing the enrolling. I am not saying it isn't workable, but that there is a vast landscape between people's perceived utility/functionality of the security and the actual security envelope it provides. Fortunately for me, security is very difficult to get right.

I use a P-4 shredder, also from Fellowes, that cost a couple of hundred bucks, that replaced a burnt out P-2 shredder I got for $30 from Staples. I am considering going to a higher capacity P-5 if I can find one at a reasonable price on eBay, mainly for the extra shredding capacity and the hopper feeder than any additional security it provides.

How seriously do I take my disposal security in my home? Well, I'm not a target, and there are other higher value targets with less security, so why would they go after me. I shred any mail or paperwork I don't wish to keep physical copies of, but it sits in the "to be shredded" basket near the shredder for a good six months before I get around to it. There's an oppportunity there, if I were a target. And the "to be shredded" basket will contain bills from my medical insurance provider, phone bills, ISP bills, electricity bills, cheques I've deposited, grocery receipts.

Whilst I practice good op-sec within my house -- no paperwork leaves without being shredded, tightened network security, VLANs for suspicious devices, locked down networks, and 2FA where appropriate -- I'm not a target and I have very little reason to be a target, so I don't need an onerously heavy shield. I'm cautious, not paranoid.

You need to evaluate your disposal security within the context of "what is convenient" rather than "what is best."

If you can automate the observation, you can automate your observance of the observation. The symmetry is great.

It’s even kind of poetic, because the more creative type of person who is less valued as a drone is the type of person to extend the effort to do this, whereas the clock-in-clock-out type with less investment and motivation is less likely. Sort of a “if you’re clever/motivated enough to end run it, your clever enough to not need this anyway.”

Never measure the productivity of engineers with plain numbers. They will just take it as a challenge on how to optimise for that particular measurement.

Nice quote.

Except that controlling people changes their motivations.

That's how Edison got started.[1]

[1] https://www.gjenvick.com/Biography/ThomasAEdison/05-TheBoyTe...

Maybe it’s the type of work or business requirement that causes this behavior, but I view this as such a violation of autonomy that it would immediately kill team morale.

You sound like a very creative/talented developer, if I were you I would not put up with this.

At a previous job we had to log all hours of the day, with a comment, in existing tasks. I felt like my work time was spent mostly making stuff up to manage management expectations, instead of development

On Teams, I believe now on your account management, setting up the 2fa, you can say you have trouble using their app and download the otp key which you can use in a generic app like FreeOTP, or integration

On the desktop I use Caffeine like apps to force the status always online

  Every morning my machine dutifully booted up, logged in, signed in at precisely 9AM and made sure it showed I was available and active throughout the day until it was "time to go home."

That's fucking hilarious/brilliant!

Brilliant. Curious what software do you use to run Android emulator(qemu, bluestack)?