Hacker News new | ask | show | jobs
by cooooooffffeeee 2660 days ago
>it gives at the very least a security clearance level.

At the very least. I could reproduce a close-enough badge that would likely fool everyone except the person who designed the original. I've done this twice successfully (failed once and almost got arrested) to fuck with my friend who runs opsec at mid-sized financial services companies.

One company he worked for had these stupid gates that you needed to scan your badge for (it gives you a green light), but there's no physical barrier. All you needed to do was pretend to scan a badge a couple times and say something like 'ugh stupid things' and the security guard just lets you on through.

2 comments

> failed once and almost got arrested

Tell us the story

Not much of a story, I was being a fool and trying to go places I wasn't allowed and someone happened to be paying attention. Fortunately my friend working in security told them it was a planned test (it wasn't planned, but he knows I do this to him from time to time).
I thought everyone moved to some kind of RFID cards already.
Yes and no, visitor badges often don't use RFID. You can get most places if you have a visitor badge and know someone's name (which are all available on LinkedIn). If you get stopped with a badge you can just say "Oh I'm here with so-and-so in X Department" and usually no one follows through beyond that. Saying you're there for an interview will often drop someone's guard too.

Employee badges often do have RFID, but some places just have you use a sign-in sheet if you're an employee and "forgot" yours (i.e., you don't have one), and sometimes security guards will just let you through if your badge is being "temperamental" (i.e., not working because it's fake).

Most corporate security is security theater (or only marginally useful after a crime) and rules are easily skirt-able because companies don't want to restrict employee access under zero-tolerance policies (which are difficult and time-consuming to enforce).

The company I mentioned previously that will just hand-waive you through a gate with no barriers actually goes as far to fingerprint all their employees and contractors. They also won't hire anyone with even a misdemeanor in their criminal record.

Also note that all of this stuff is markedly easier if you're a woman (less likely to be stereotyped as a criminal) and/or if you wear a suit (depending on the office, a suit can often mean "don't confront me because I'm above your pay grade").