Slashdot Mirror
Stupid Security
Buck Mulligan writes "The folks at Privacy International are holding a stupid security contest to discover the "world's most pointless, intrusive, annoying and self-serving security measures." Nominations can be submitted by email: stupidsecurity@privacy.org.
My vote goes to the Ronald Reagan 'Free Trade' Center in Washington, where you have to show your driver's license to visit the food court. (Having a driver's license proves that you aren't dangerous!)"
this
How about...
Using a one million bit key and claiming it's uncrackable on Slashdot?
& also "Company Letterhead via fax"
I've encountered both of those as some sort of "security"
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
US web-vendors that requires international customers to e-mail or fax in a copy of their ID and credit card. Mailing a picture of the card kinda defeats the purpose of the secure, encrypted order form.
I find it strange that there is (almost) no security at all in many chemical labs at universities in Holland where I've been. Anyone can walk in and pick up some chemicals, some of which are very dangerous if you don't know how to handle them. Of course people who work there can always take anything they want, but people who just happen to be there are not (much) resticted.
-- Cheers!
I guess they've stopped doing this, but the airline ticket agents asking if you're a terrorist always seemed pretty stupid to me.
-- Don't Tase me, bro!
How about the "Fax us the change request on company letterhead" for making changes when you don't have the admin password.
Like nobody could possibly fake that.
--
When transferring a domain to another party, I had to have the form notarized, then fax it in.
What's the point of the notary seal (embossed) when I'm going to fax it?
No, of course not, but showing a DL makes you somewhat accountable -- would you rather chase "Caucasion male between 5'6" and 6', with brownish-blondish hair and average build", or "John Smith, 123 Maple Sreet, Clevland OH"?
Sure, credentials can be forged, but at least you've raised the bar.
This next song is very sad. Please clap along. -- Robin Zander
JavaScript on web pages that won't allow you to right click. Very stupid "security", and highly annoying too! Not to mention that it is super easy to get around...
When you use Explorer, which used to mean you would see everything about your computer in one fell swoop, clicking or double-clicking on My Network Places does nothing. You now have to right-click and Explore again if you actually want to get there. It seems it's because some users were getting into Network Neighborhood accidentaly and noticing there were other computers out there, possilby not locked down properly. But really, making someone right-click again, that is not better security, it's reduced functionality.
Going into the JFK Federal building in Boston, one of the security guards told me that they had it because of the Oklahoma bombing. Yes, if they had Timothy take the truck through the metal detector, they would have caught him.
Fight Spammers!
As if somebody who was able to find my CC number and my full name would be stumped trying to figure out this bit of top-secret information.
"What's your mother's maiden name?"
"31337h@ck3rm0m"
Edith Keeler Must Die
you have to show your driver's license to visit the food court.
Heh
Being blind this _really_ anoys me. The number of places that won't accept anything other than a drivers licence as a form of identity.
Before now I've had to explain to people _why_ I don't have a drivers licence!
No, of course not, but showing a DL makes you somewhat accountable
I take it then, the policy of showing a driving licence (What if I don't drive?) has drasticly reduced the theft of pork pies and people punching each other in the dinner line?
(Some people need to get a life and stop invading others privacy for there own power games)
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
Heh
Any internationl flight into the US you have to fill out a little slip declairing that you arn't a communist!
That's my plans to start a revolution fucked then.
Have you guys ever seen one of those things? There's this form you have to fill when you request a VISA for travelling into the US. I think it's the same for most foreign countries. In Mexico, at least, it has about 10 checkboxes that look something like this:
- I am a member of a violent terrorist organization yes / no
- I am trafficking drugs/weapons/any sort of illegal substances into the US yes / no
- I am an active member of a hate/racist group involved in violent attacks of minorities yes / no
- I engage in satanic rituals.... etc. etc.
I'm not kidding you. This is the sort of things the form actually asks. I guess there may be a legal precedent as to the need for these questions, but it's funny as hell anyway. Or maybe it actually works for stopping extremely stupid hatemongers / drug dealers from travelling into the country.
Overcaffeinated. Angry geeks.
disable unsafe attachements.
it only disables non-MS Office attachments.
iframe junk still works
iframe MSWord macros still work
etc...
PDF, GIF, PNG, JPEG don't work, they are too UN-SAFE
the password prompt that pops up on system startup, which can be safely ignored.
I'd rather have you out there driving than most of the fuckwits with a license, especially here in SoCal where 1) half the drivers are uninsured and 2) most see a minor accident as their own personal lottery ticket ("Oh my neck, eeet hurts").
My favourite as of late is applying to security-minded companies, and embedding an image in my email from a server that I have access to. I can watch it as my cover-letter is passed from one department to another. I get to see what systems they are using, and I've found that a lot of companies have their IT department running one version of OS with a Google browser, while HR runs another version of OS (usually XP), and internal managers or reviewers running yet again another OS...
Sillies. You want security, don't claim to be a security firm and yet allow people to view your internal operations... Sillies...
I stick to walls...
My friend (who is Australian but of Indian decent) recently re-entered the country from a vacation Down Under. At the airport, the guards put him through all sorts of questions. Among them was "How did you get your Green Card?". When my friend, a professor of Mathematics, replied that he got it through an Outstanding Researcher program, the guard asked him "So, are you an outstanding researcher in mathematics?". My buddy, groggy from a double-digit-hour flight, replied "Well, I guess I am." The guard then asked him "What's the Pythagorean Theorem?" to test him. My friend couldn't believe his ears. This question was supposed to determine whether my friend really was a mathematics professor? Every kid who went through high school math knows that one!
I feel safer already knowing we've got such intelligent guards monitoring our borders...
GMD
watch this
How can something be modded redundant if it's the first post to say it?
(YOMV, but I suspect it will ultimately cause more.)
Sheesh, evil *and* a jerk. -- Jade
What they DID accept was my recently expired college ID. WHAT???
And if you want to call and complain to the passport office, it's a toll number!
I worked for Georgia Tech in college, so I was technically a state employee. As such I had to go through a standard application that included these gems:
Are you or have you ever been a member of the Communist? yes/no
Have you ever advocated that violent overthrow of the government of the state of Georgia? yes/no
Besides being useless screening tools, the first is irrelevant, and the second, well, what the hell would you do if you did violently overthrow a state government?
On another note, I've worked at two companies where you could not change your Windows network password; only an Administrator could do that. Both required frequent password changes, and the protocol was to send a clear text email to a sys admin with your new password.
The last place I worked allowed you to change the Windows password yourself (and required a new one), but there was no mechanism for changing the VSS password. Again the mechanism was to send your new password in clear text to the guy that administered SourceSafe.
And what about using proprietary VPN solutions that require a Windows machine to connect to Unix boxes? Talk about a backdoor. Now you are relying on the impregnability of Windows 98/NT/2000 to keep people from accessing your network.
I worked for another company that required you to shut off your machine every night (can't just logout) for security purposes.
The list for this topic is sadly quite long.
John McNair
but it's a result of stupid bureaucrats nonetheless.
Graduate students in the computing lab at Oxford University have swipe card access to the building 24 hours a day. University regulations stipulate that anyone who could be working alone must take a first aid course; consequently, all graduate students in computer science are required to attend this course.
The first aid course in question is basic CPR.
Tarsnap: Online backups for the truly paranoid
Don't drink lots of beer on a 4 hour flight in a plane with no 'facilities'.
Just open a window and relieve yourself that way. When I did that we were flying over Paris.
Terrorists want to create maximum impact from their actions, so they target areas where large numbers of people will be congregated. Sure, there are no state secrets in the cafeteria, but that's not what terrorists are after. By exploding a bomb in a very crowded place at lunchtime, they create the terror they are looking for.
I was a visitor at M$ corporate campus recently, and everyone has to "badge in" to the lunchrooms (guests must be escorted). The rule is "no tailgating" - one person, one badge swipe.
I've found that a lot of companies have their IT department running one version of OS with a Google browser
WTF is a "Google Browser"?? I thought Google was a search engine!
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
This was a few years ago, back in 1999,so may well have changed (probably got stupider). Here in the UK we still don't need to show ID when checking in for domestic flights (a couple of airlines require it since 9/11, but it's not required by the government). However when me and my girlfriend flew from Cardiff to Belfast in June 1999, after having gone through the gate, before boarding the plane we had to show our boarding passes to a plain-clothes policeman who wrote down our names. No doubt this was because of the ongoing unpleasantnesses in Northern Ireland, and the police were taking it seriously enough that when the guy in front of us objected he was pulled from the line and eventually was last onto the plane bearing a very pissed-off expression.
The thing is though, is that the *only* ID they asked for was the boarding passes, with no corroboration that the names on them were our real names. Presumably the South Wales Police have come to an understanding with the IRA and UVF who've agreed that their guys would never dream of buying airline tickets cash and supplying a false name, or with a fake/stolen card.
Patriot Act?
No sig for you!!
Seriously, mod this guy up.
The Department of Homeland Security. 'Nuff said.
At my first community college, there were several rules that you could not create new accounts, you could not shut down remote systems, you could not format hard drives, etc. . .
Now, these may seem like normal rules at first glance, and most people at the school didn't find them odd. However, I was working in the IT department at the time and I know that these rules were only added after it was pointed out to the lead Network Administrator that the Computer Management Console was openly available to all accounts.
Funny thing is, the Computer Management Console remained open for the next few months.
->Fritz
Spooooon!!!!!
Yeah... right!
Like reading a EULA has ever convinced someone to that they shouldn't install the software from the pirated CD they have.
I think MS should do usage statistics to determine how many people actually scroll down the EULA or just click Agree.
1 x 10^(-1000000)
MS Bob had this wonderful security feature.. you could set it to lock your computer so nobody else could use it.
Only, that wasn't terribly user-friendly, so if you entered the wrong password three times in a row, Bob figured that you must have forgotten it, so it asked you if you wanted to change it.