Hacker News Reader

Comment by flukus | Hacker News Reader

> For military, yes. For civil, that's going a bit too far into the dystopian realm.

Destroying the devices might go a bit far, but there are plenty of jobs that require things like phones going into a drawer before a shift starts. Not everyone is always on all the time.

View on HN

> there are plenty of jobs that require things like phones going into a drawer before a shift starts

It honestly frustrates me that so many of my friends and family can't fathom this. They're all on their phones 24/7 and can't seem to handle the fact that my job requires me to (from their perspective) ignore them for eight-to-ten hours a day.

Hell, back before mobiles it wasn't a problem to only call someone after hours, otherwise you'd get an answering machine.

I have done this, and also had to return a smartwatch that someone (very thoughtfully) gifted me, because I can't wear it at work. And if I can't wear it at work, it's not really going to be of enough use to justify keeping.

Eh, I'd keep the smartwatch to be honest. I have a collection of nice watches, but only my G-Shock regularly comes with me to work because it's the only one I'd trust to survive the rough and tumble when I'm not in front of the computer. But it's nice to have a collection I think.

I collect watches and have a G-Shock for similar purposes. I don't need it for work because I'm in a pretty sedate environment, but I wear it to work sometimes because I just like it.

I've got friends who work at places where company policy says that any electronics you travel to China with can never be connected to the corporate network again.

They don't destroy the devices, but all travel phones/laptops are "burners" and get given away instead of ever used for work again.

Why? Couldn't you just format the drives if you were that paranoid? Are they worried about some kind of hardware bugging or sub OS exploits while the owner is not looking?

Quite simply yes. A modern "computer" is made up of multiple layered CPUs and OSs at this point. WiFi, sound, ssd, GPU all often have embedded cpu and firmware that could get "enhanced" and survive a recore

Hell - even the _batteries_ have embedded cpus and firmware...

https://www.defcon.org/images/defcon-19/dc-19-presentations/...

(Note slide 116 there - about 7 up from the end: "Attacking the OS kernel")

https://www.v3.co.uk/v3-uk/news/2099616/black-hat-charlie-mi...

http://www.karosium.com/2016/08/smbusb-hacking-smart-batteri...

In the end, if it runs code, you cannot trust it.

You could reformat the drives but what if someone has infected the firmware on the drive?

Check out: https://www.malwaretech.com/2015/04/hard-disk-firmware-hacki...

Every company I've worked with with business in China or Russia does this. Same rule was implemented last year when there was a ban on laptops on flights to/from Iran and the other Muslim majority countries the US put travel restrictions on, despite being UK based.

The devices aren't given away however, they're just wiped and reused as burners. Not 100% secure as a nation state would have access to BIOS rootkits but it's better than nothing.

X-ray and check flash content, also use tamper-evident seals (glitter nail polish) on internal parts.

care to go into more detail about the glitter/nail polish? I've heard of the "straw" technique[1], flour/baby powder by the door, but never this stuff.

(chucking a random assortment of straws on top of your laptop then taking a photo, with the idea that it will be more difficult/time consuming/impossible to recreate exactly like in the photo).

Same thing as the straws basically: paint glitter over screws and such, take a picture.

Seems utterly bizarre considering all of those devices must have come from China in the first place...

But they're _probably_ not installing exploits on the entire logistics chain "haystack, at least not exploits with the level of sophistication they'd use on a high-value "needle" with an evil maid (or an evil customs inspector) attack.

Also - the Australian Government banned the NBNCo from using any Huawei gear in out National Broadband Network. Sadly that's _probably_ either just racist political point scoring, or effective lobbying (or outright bribery) from the non-Chinese based network gear companies - rather than any real intent to improve security based on evidence from people/organisations capable of making that sort of determination...

I feel that for a lot of the IT workforce, the opposite (phone goes into a drawer when a shift ends, no constant unpaid onduty or evening answering of work e-mail) would be a good start, although not for security reasons.

This rings true for all of society. Who could have known there would be negative social implications to having an always-on, always-connected computer in your pocket?

I work in entertainment and security was moving in the direction of leaving your phone outside the building and using a isolated browser with no copy/paste. I was happy to switch jobs before I was required to do any of that. Those kinds of precautions were taken for specific, shorter projects, but I wasn't interested in doing that full time.

Not sure if it's apocryphal, but I heard a company in Seattle (Starbucks?) had a policy of no visible tattoos. At some point there wasn't enough people to hire and they overturned the policy.

I can see it playing out both ways.

>I heard a company in Seattle (Starbucks?) had a policy of no visible tattoos.

The vast majority of companies had this policy up until about ~2005.

I still remember being extremely surprised the first time I saw an employee with a nose ring working at CVS (around ~2005).

A secure locker system should probabbly be the SOP for a lot of places.

Reply on news.ycombinator.com