Comment by al_borland | Hacker News Reader

Comment by al_borland | Hacker News Reader

>It’s all designed to prevent you from sharing screenshots with competitors, relatives, and journalists using Microsoft Edge for Business.

I don’t take screenshots at work to share with any of these people. I take them to share with co-workers for business purposes.

If this is blocked and someone wants to share something with competitors, relatives, or journalists, can’t they just take a picture with their phone or a camera? Then it’s never on equipment the company has control over.

My dad worked at a place that blocked the ability to take screenshots on a company phone. The IT department needed proof he was on a certain release of the OS, and they asked him take a screenshot of his settings. He explained they blocked this feature. They told him to use another phone/camera to take a picture of the screen and send that. He tried to point out how silly it was to lock down screenshots when the work around is so obvious, but that didn’t matter. It was all about the illusion of security, not actually stopping anything.

> It was all about the illusion of security,

Correct. The "IT security" group was practicing what I've termed "checkbox security".

They have a long list of "requirements" and beside each is a check box. If they can check the box by reading the marketing brochure for product X, then they are "secure". In this case one of their check boxes was "screen shots disallowed". So they turned off screen shots, and were able to "check the box" and therefore they were "secure" (at least by their definition, which is "if the box is checked, we are secure"). The fact that trivial workaround exist make no difference to the IT security checkbox specialist.

I've seen the term checkbox security in docs from the 1980's. Vendors delivered an insecure products, e.g. with default passwords. It turns out nobody knew how to secure these products, so vendors reacted by blame shifting: Provide lists about how to secure your products, and niw blame your customers for the insecurity. Customers didn't want to be blameable so did anything to check all boxes.

All in all, I think it's a step up from what came before. A security problem is invisible until you get attacked. Then random unrelated people get caught up in the fallout.

Checkbox security moves the pain to inside the company, where internal forces will provide pushback if a requirement is too onerous. That pushback is exactly what happens for this overly onerous requirement here.

I am constantly screen shotting debugger screens or error logs with our product team. It’s a very effective way to share that type of information.

My responses would be: "I can't take screenshots, you disabled it. No, I can't take photo, my camera is not working. No I can't ask anyone else around, they are all busy with their work. You send someone." Nothing will change unless they feel the pain of their own decisions.

https://old.reddit.com/r/videography/comments/17zuk6d/record...

Reply on news.ycombinator.com