[jedberg]

Way back when I worked at eBay, we once had a major outage and needed datacenter access. The datacenter process normally took about 5 minutes per person to verify identity and employment, and then scan past the biometric scanners.

On that day, the VP showed up and told the security staff, "just open all the doors!". So they did. If you knew where the datacenter was, you could just walk-in in mess with eBay servers. But since we were still a small ops team, we pretty much knew everyone who was supposed to be there. So security was basically "does someone else recognize you?".

[terminalshort]

> So security was basically "does someone else recognize you?"

I actually can't think of a more secure protocol. Doesn't scale, though.

[goatking]

Well, you put a lot of trust in the individuals in this case. A disgruntled employee can just let the bad guys in on purpose, saying "Yes they belong here".

[terminalshort]

That works until they run into a second person. In a big corp where people don't recognize each other you can also let the bad guys in, and once they're in nobody thinks twice about it.

[0x457]

Vulnerable to byzantine fault.

[ermis]

or it could be some troy maybe.

[peterbecich]

I would imagine this is how it works for the President and Cabinet

[chasd00]

way back when DC's were secure but not _that secure_ i social engineered my way close enough to our rack without ID to hit a reset button before getting thrown out.

/those were the days

[bandrami]

Oh I've definitely done that. They had remote hands but we were over our rack limit and we didn't want them to see inside.

The early oughts were a different time.

[jedberg]

Just to test the security, or...?

[chasd00]

late reply but, no, i really needed to hit the button but didn't have valid ID at the time. My driver's license was expired and i couldn't get it renewed because of a outstanding tickets iirc. I was able to talk my way in and had been there many times before so knew my way around and what words to say. I was able to do what i needed before another admin came up and told me that without valid ID they have no choice but to ask me to leave (probably like an insurance thing). I was being a bit dramatic when i said "getting thrown out" the datacenter guys were very nice and almost apologetic about asking me to leave.

[UltraSane]

I was in a datacenter when the fire alarm went off and all door locks were automatically disabled.

[anthonyeden]

Most modern commercial buildings in Australia unlock doors when the fire alarm goes off.

[johnisgood]

Lmao, so unathorized access on demand by pulling the fire alarm?

[chasd00]

There's some computer lore out there about someone tripping a fire alarm by accident or some other event that triggered a gas system used to put out fires without water but isn't exactly compatible with life. The story goes some poor sys admin had to stand there with their finger on like a pause button until the fire department showed up to disarm the system. If they released the button the gas would flood the whole DC.

[fragmede]

Halon, yes.

[UltraSane]

Essentially yes. They should really divide data centers into zones and only unlock doors inside a zone where smoke is detected.

[chasd00]

> They should really divide data centers into zones and only unlock doors inside a zone where smoke is detected.

just make sure the zone based door lock/unlock system isn't on AWS ;)

[ectospheno]

Because surely every smoke detector will work while the building is burning down…

[UltraSane]

most data centers are made out of concrete and isolate fires.

[ectospheno]

My point is that while the failure rate may be low the failure method is dude burns to death in a locked server room. Even classified room protocols place safety of personnel over safety of data in an emergency.

[folmar]

Don't ask about fire power switch

[E39M5S62]

That sounds like an Equinix datacenter. They were painfully slow at 350 E. Cermak.

[jedberg]

It wasn't Equinix, but I think the vendor was acquired by them. I don't actually blame them, I appreciated their security procedures. The five minutes usually didn't matter.