DEV Community

Discussion on: What are the worst security practices you've ever witnessed?

Collapse
 
molly profile image
Molly Struve (she/her) • Edited

Two things that drive me absolutely nuts.

  1. Not encrypting your hard drive especially on a work laptop. For those who have a Mac and are interested in learning more here is a great post.
  2. Leaving a work laptop that has access to production information and data open, unlocked, and unattended. DONT DO IT EVER!!!! I have actually thought about leaving people notes when I see this, "If I was a hacker you would have been screwed, lock your laptop next time"
Collapse
 
dechamp profile image
DeChamp

We called this hotdogging. Anyone who left their computer unlocked we would send an email from their account talking about their love for hotdogs.

Collapse
 
scrabill profile image
Shannon Crabill

Why does no one seem to take securing work laptops seriously?

In a previous job, we had laptops with no way of securing them to our desks. We had to lock them in our file cabinets at the end of each day.

Collapse
 
molly profile image
Molly Struve (she/her)

I work for a cybersecurity company, we help Fortune 500 companies track down and patch the worst vulnerabilities in their infrastructure. However, I believe that no matter how robust you make your infrastructure the weakest link will always be the human component.

Thread Thread
 
scrabill profile image
Shannon Crabill

this

Right! Common sense and educating the humans that work at or with a company can go a long way.

Thread Thread
 
amorganpd profile image
amorganPD

Not only that, but also removing the human component, where possible. People will always error, so removing the possibility to error is just as important.

Thread Thread
 
gbursson profile image
Greg R.

Simple enough: remove people :D

Collapse
 
fredrikbonde profile image
Fredrik Bonde

we are encouraged to open slack on unattended computers and promise all in company free beer.

Collapse
 
terabytetiger profile image
Tyler V. (he/him)

My favorite is when I bring this to the attention of my co-workers and they say "Yeah, but I know you're supposed to be here"

1) We definitely don't know all the people in our org (and people constantly walk up to desks to drop off papers/notes regardless)

2) What if I was having a particularly salty day and felt like burning bridges?

Collapse
 
guneyozsan profile image
Guney Ozsan

This is especially true if one feels he is gonna be fired soon. Or worse, already fired but had to spent some time to hand off some work.

Collapse
 
molly profile image
Molly Struve (she/her)

I feel this!!!

Most of the devs are pretty good about it bc we will all mess with each other's laptops if they are left open. Nothing malicious but change some vim shortcuts, maybe a new screen saver or background. Great way to promote locking your computer ๐Ÿ˜‚

Thread Thread
 
terabytetiger profile image
Tyler V. (he/him)

I've done the wallpaper one to the others in my department (one of them still hasn't removed the weird picture of them from their wallpaper rotation).

It's really hard to take security seriously when I asked a higher up IT person why we promote IE as the default browser and their answer was "For security reasons" (this person has since moved to another company, but we still default everyone to IE as the browser)

Thread Thread
 
cecilelebleu profile image
Cรฉcile Lebleu

Ohh, right. I work from home, but once I went to get a cup of coffee and my husband put on an update emulator on my MacBook. I just assumed the update started on its own while I was gone and actually waited around for about 30 minutes until I figured out just what was so funny.
The update emulator (a website on full screen, itโ€™s even animated) is a good, safe prank. Bonus points if they had open files unsaved. I suppose it also exists for other operating systems.

Thread Thread
 
terabytetiger profile image
Tyler V. (he/him)

Holy wow this is amazing ๐Ÿ˜

For anyone curious, Fakeupdate.net seems to be a good source for this ๐Ÿ˜‰

Thread Thread
 
cecilelebleu profile image
Cรฉcile Lebleu

I guess that was it. I was so angry at myself for falling for it that I just closed the tab in a split second without checking the name ๐Ÿ˜‚

Thread Thread
 
terabytetiger profile image
Tyler V. (he/him)

I'm realizing this could also be repurposed to get out of things ๐Ÿค”

Thread Thread
 
ben profile image
Ben Halpern

I'm a fan of extensions/user scripts in the browser to give someone a special experience. Like making CSS grayscale filtered, etc.

Thread Thread
 
terabytetiger profile image
Tyler V. (he/him)

At my last job we were also huge fans of the extension that replaces all images with Nick Cage and the one that would randomly play the John Cena intro every 1/1000 tabs.

Thread Thread
 
wolfhoundjesse profile image
Jesse M. Holmes

VSCode has a beautiful theme for this situation. Hot Dog Stand.

Thread Thread
 
terabytetiger profile image
Tyler V. (he/him)

I love it ๐Ÿ˜

Thread Thread
 
aschwin profile image
Aschwin Wesselius

The Hot Dog Stand theme actually is an ancient prank. Windows 3.1 (!!!!!) had this somewhere hidden deep, deep down in it's OS.

Thread Thread
 
guneyozsan profile image
Guney Ozsan

I used to change the language of my friends' mobiles to Japanese. It was easy and fun at Nokia 3310 era.

Collapse
 
ben profile image
Ben Halpern

If you're a Mac user, this is where you want to go to make sure your data is encrypted automatically (described in more details in the link Molly posted)

Collapse
 
mandaputtra profile image
Manda Putra

It woulnt be slow if encrypted?

Thread Thread
 
nicolasguzca profile image
Nick

Yeah but it's barely noticeable on a Mac.

Collapse
 
glennmen profile image
Glenn Carremans

And if you want to go a step further and create an encrypted password protected folder (drive) on macOS check out this post ๐Ÿ˜‰

Collapse
 
francis_pblog profile image
Francis Piche • Edited

Where I work we have a donut rule. If someone is able to gain access to your workstation and send an email to the rest of the company mentioning donuts, you then have to bring donuts for everyone.. Its extremely effective

Collapse
 
buinauskas profile image
Evaldas Buinauskas

We do same, except that we bring cakes ๐Ÿ‘

Collapse
 
8ucik profile image
8ucik • Edited

At my company we do pizza instead. That is more cost unfriendly, but they do get they point.

Collapse
 
molly profile image
Molly Struve (she/her)

Genius!!!!

Collapse
 
oliverobenland profile image
Oliver Obenland

In our company we change settings like background image, color theme or screen rotation. It is fun to see your colleague to try changing it back when everything is up side down ;-) Oh, and he knows what he did wrong

Collapse
 
dvddpl profile image
Davide de Paolis

leaving the computer unlocked and unattended also drive me nuts, especially when the dev has access to production and aws sdk with broad permissions... depending on teams we had different rules.
What we did the most was changing the desktop/lock screen with something very very ugly and embarrassing (which they had to keep for a whole week). This is a kind of personal intrusion and we did that only in teams where we had lots of confidence with each other, but it clearly shows how much control you can take over someoneยดs computer.

Sometimes we simply applied the cookie/cake/pizza rule via a message on slack from the persons computer "Hi, everybody, I love my team and tomorrow I will bring pizza for everybody!"

Currently with I sometimes do is just opening lockyourscreen.com/ on their browser... quite funny.