Or...you can take all that time and energy you'd invest building this complex Rube Goldberg machine that just proves you're present 9-5, and instead, invest it in finding a job that's not so toxic.

Seems more healthy for your mental wellbeing in the long run, as toxic policies in workplaces rarely come alone but tend to come sequentially one after another as time goes on if the terror managers don't change or enough employee don't jump ship simultaneously to trigger a management change.

> [...] instead, invest it in finding a job that's not so toxic.

Nobody's saying they're not doing that. Depending on life circumstances and where you live, it can take months to find a new job that's actually better than the one you're in, even when actively looking.

You seem to take this seriously but putting something together like this is exactly what makes programming/engineering fun. lol. I love putting together weird crap like this.

I build a lot of things that like that. From putting a space invaders game on my digital resume website, to an autonomous R/C car that can evade a pursuing dog that jinks left and right like a rabbit, to an internet controlled robot arm used as a cat toy, to a touch screen cat toy that exhibits predator/prey response from the feline interacting with it that results in a paper about improper toe bean rejection because there are not enough science papers written about cats interacting with touch screens, to figuring out which way up a piece of material has been loaded in to a CNC, to "open the pod bay doors" that will open my garage door, to an interactive smart home screen that monitors where my cats, phone, wallet and amazon packages are (and also displays the weather), to a multi-camera streaming setup that is voice activated "Hey producer, roll VT" that talks to me like Cortana from Halo, to a computer vision system for recognizing electronic components and sorting them into appropriate piles, to a remote operated cat litter cleaning robot arm, to cataloguing every book read, science paper digested, class attended, movie watched and album listened too since 1984. And then there is the weird stuff.

Sure, but I'd apply that at the point of the original posters setup already.

You've assumed an awful lot about me based on a few flippant comments I've made on social media. Perhaps that time would be better spent finding a different outlet for your frustration. It appears that these days people on HN jump to the "find another job" solution as fast as people on Reddit jump to the "get divorced" solution.

Can biometric auth be required on iOS? I had thought iOS treated these as convenience alternatives to device pin.

By default in a standard iOS installation, it's a convenience (one only unlocked after a PIN is input on rebooting). Individual apps may request access to FaceID/TouchID (not the raw data, but the iPhone's verification of biometric identity.) The user must whitelist the apps to use that permission, but a company could easily make their app not function if that permission is denied.

I've already circumvented a variety of biometric requirements in various devices in my personal research and just for funsies. FaceID is fooled by a 3D print, and also if you never enroll your face in FaceID but instead use something else that is face-like, the system doesn't care. FaceID is dumb, insecure and doesn't care. TouchID similarly - it just wants to see a squishy thing pressed against it that vaguely resembles a human finger to enroll. It's security theatre. Consumer grade biometric security is as useless as consumer grade paper shredders.

> Consumer grade biometric security is as useless as consumer grade paper shredders.

IIRC, consumer grade paper shredders got pretty good in the past few years. And your examples both rely on the person setting up the security circumventing it by supplying bad training/enrolling. Which makes it bad if you want to guarantee a person is behind it, but fine if you want to treat it as something that belongs to the person doing the enrolling.

You're not wrong, but anything up to DIN P-4 is a couple of evenings of work to defeat with an automated computer vision algorithm. Ask me how I know. Most consumer grade shredders on the market are DIN P-2 and DIN P-5 is where it starts to get really tricky but is still possible to work with.

And I have found that most corporate security, especially in the biometric arena, is sub-par, usually because of the human component doing the enrolling. I am not saying it isn't workable, but that there is a vast landscape between people's perceived utility/functionality of the security and the actual security envelope it provides. Fortunately for me, security is very difficult to get right.

What’s the right way to dispose of paper containing sensitive information?

The NSA recommends P-7 with full incineration. Fellowes has a P-7 model, but do you really want to spend $7,000 on disposing of your credit card statements. P-5 and P-6 are acceptable for home use. P-4 is also acceptable if you aren't really trying to hide anything and just want to dispose of those credit card offers, CVS receipts and that printout you received from your vet. Disposal security sits right alongside digital security in that you have to ask yourself, how much of a target do you consider yourself to be?

I use a P-4 shredder, also from Fellowes, that cost a couple of hundred bucks, that replaced a burnt out P-2 shredder I got for $30 from Staples. I am considering going to a higher capacity P-5 if I can find one at a reasonable price on eBay, mainly for the extra shredding capacity and the hopper feeder than any additional security it provides.

How seriously do I take my disposal security in my home? Well, I'm not a target, and there are other higher value targets with less security, so why would they go after me. I shred any mail or paperwork I don't wish to keep physical copies of, but it sits in the "to be shredded" basket near the shredder for a good six months before I get around to it. There's an oppportunity there, if I were a target. And the "to be shredded" basket will contain bills from my medical insurance provider, phone bills, ISP bills, electricity bills, cheques I've deposited, grocery receipts.

Whilst I practice good op-sec within my house -- no paperwork leaves without being shredded, tightened network security, VLANs for suspicious devices, locked down networks, and 2FA where appropriate -- I'm not a target and I have very little reason to be a target, so I don't need an onerously heavy shield. I'm cautious, not paranoid.

You need to evaluate your disposal security within the context of "what is convenient" rather than "what is best."

Thank you for this detailed response.