What Examples of Security Theater Have You Encountered?

swillden writes "Everyone who pays any attention at all to security, both computer security and 'meatspace' security, has heard the phrase Security Theater. For years I've paid close attention to security setups that I come in contact with, and tried to evaluate their real effectiveness vs their theatrical aspects. In the process I've found many examples of pure theater, but even more cases where the security was really a cover for another motive." swillden would like to know what you've encountered along these lines; read on for the rest of his question below.

swillden continues: "Recently, a neighbor uncovered a good example. He and his wife attended a local semi-pro baseball game where security guards were checking all bags for weapons. Since his wife carries a small pistol in her purse, they were concerned that there would be a problem. They decided to try anyway, and see if her concealed weapon permit satisfied the policy. The guard looked at her gun, said nothing and passed them in, then stopped the man behind them because he had beer and snacks in his bag. Park rules prohibit outside food. It's clear what the 'security' check was really about: improving park food vending revenues.

So, what examples of pure security theater have you noticed? Even more interesting, what examples of security-as-excuse have you seen?"

Passwords

[qoncept]

The DOD replaced reasonable passwords with Common Access Cards. The difference? Instead of having to find out someone's 8+ character alphanumeric password that changes every month, you need to have physical access to their card and need to know their 6 digit number that never changes. Meanwhile, everyone is forgetting their card in the reader when they go to lunch, so they can't get back on base -- but feel free to use it yourself in the meantime.

Re:On the web side of things

[Emperor Skull]

I ran into a problem authenticating through their antiquated AD system

AD as in Active Directory? The oldest it could be is about 8 years since AD was first implemented in Windows 2000 and there have only been two newer versions. It can't have been that antiquated. It's also trivial to do authentication against AD in a variety of ways, especially from a web application. That hasn't changed much in Windows 2003 or 2008. Of course a customer that paid for what you describe probably didn't have their AD working right either...

Re:Vista UAC

[Anonymous Coward]

Oh boy. Can't believe this was modded insightful.

I'm a serious user, and I didn't disabled UAC. In fact, I don't know anyone who has Vista and has disabled it. Will some users be bothered with it? Of course, but that's a given for almost all security controls.

Also, the very same logic could be applied to unix. Hey, it's much easier to always log on as root, no need for this sudo shit. I guess that's also security theater, right?

Security Fraud

[Anonymous Coward]

A local school here recently went to a closed campus. They paid a lot of money to fence between all perimeter buildings (really old school), and to put up large gates.

During school hours, the only way onto the campus is through the front office (or any door that someone opens from the inside). You can exit the campus from any perimeter door. For good measure, they mounted a security camera to watch the door into the front office.

They placed it so that it records the back of people as they enter the office. At least it would, if they hadn't mounted it directly behind the four inch steel post they installed to mount the gate that closed the campus.

Now, the camera takes a nice video of a shiny new fence post all day.

Everyone knows the camera is useless in its present position. Nobody cares. All the expense of the fences, the gates, and the cameras was never about security.

Airport security

[Anonymous Coward]

Copenhagen Airport, after the security check. In the departure hall there is a wide open area with about 30 tables from a Steakhouse restaurant, with all tables layed out with big steak knives just for the taking.

Re:The Iraq theater

[Anonymous Coward]

I tend to trust sources that use correct grammar, such as "...deciding for yourself."

Re:MIT ITS passwords, and Microsoft File Servers

[TheRealMindChild]

In a similar vein, Microsoft file server passwords were originally checked only on the client, a fact which went undiscovered until Samba came along.

It wasn't just Microsoft. NFS at one point in my life was synonymous with "no fucking security". It trusted the UserID that you transmitted with it. UserID 0 was a handy value to use...

Re:MIT ITS passwords, and Microsoft File Servers

[novakyu]

UserID 0 was a handy value to use...

... which is why there is such a thing as "rootsquash" on the export option.

BTW, what do you mean "at one point"? I thought NFS still accepted UID for filesystem permisson purposes, unless you have the "secure" option set, which then it requires one to "keylogin".

Re:The Iraq theater

[marxmarv]

Islam was a young religion when Christians first attacked the Middle East. How are you not supposed to harbor a grudge, or at the very least distrust, with that kind of introduction, especially when (usually wrongly) self-identified Christians indiscriminately hold a gun to Muslims' heads while their hated cousins steal their land, the "Christians" steal their natural resources, and both of the robbers tell themselves fairy tales to rationalize it?

Re:The Iraq theater

[Onan]

Comparisons between Hussein and Hitler are pretty facile.

Hitler was quite openly intent upon conquering most of three continents, and was part of a functional alliance that was directly attacking the US. He was at the head of an enormously powerful and aggressive military force, and represented a huge threat to both the world in general and the United States in particular.

Hussein, on the other hand, only engaged in war with two other countries: Iran, with the US's urging and support, and Kuwait, with the US's permission. He was quite happy with his role as the US's pawn, and enjoyed only mutual opposition with the one group that had attacked America. He ruled a nation that had been so devastated by a decade of bombings and sanctions that it was mostly ineffectual even within its own borders, much less outside them. He could not have been less of a threat.

Re:The blinking red light

[Anonymous Cowpat]

well, in that it's meant to deter the casual thief by tricking them into believing that your car has an alarm, it IS an anti-theft device. Just a rather unsophisticated one which most nefarious types will see through these days.
It's just an LED, some flashing thingumy wotsit and something (probably a simple logic gate of some variety) to turn it off when the engine is running - it adds probably less than $1 to the cost of the car, which you'll more than make back if even one particularly gullible criminal decides not to break into your car because of it.

Re:Frist Posty?

[dondelelcaro]

Traffic court is now very "secure"

That's generally because it's in the same building as family court. For those who don't know, family court is way more dangerous than criminal court.

Re:The blinking red light

[Malekin]

That only works in the US and Japan, though. Most of the world has a much more diverse mix of transmissions.

Re:The Iraq theater

[1u3hr]

Iraq had a tyrant and was allied with Osama and other terrorist groups (similar to Hitler and Nazi Germany which I am comparing it to)

Sorry, you're sadly misinformed. Saddam was not an ally of al Qaeda. He was a nominal Muslim, but his policies were anathema to he fundamentalists. (He let women work and attend university, for instance.) Saddam was on al Qaeda's hit list, and he knew it. They wanted to get rid of corrupt, loose-living secularists like Saddam and install a theocracy, like the Taliban, in every Muslim country. Saddam was an evil dictator, but never, to my knowledge, took any action against the US outside the Middle East.

University of Winnipeg

[Secret Rabbit]

(Quotes are paraphrases)
(Yes, I have emails to back this up and CTV and Global has on-line articles to corroborate the facts below)

A while back at the University of Winnipeg some delinquent wrote that (s)he would "shoot this place up" on a specific date at a specific time. After that, the University's President Lloyd Axworthy said that "Universities are under attack." Which is rather an embarrassing statement. There is a profound difference between bad things happening AT Universities and bad thing happening TO Universities. Universities are certainly NOT under attack.

They at least planned the typical impotent measures. Namely, more CCTV, bag checks, etc. Nothing that would actually improve security. Worse yet, I personally emailed them not only telling them of this, but I provided recent real world examples of these measures not working. Point of fact, the answer that I got from Lesely Thomson (Senior Executive Officer & Advisor to the President) was that (exact quote) "we will now have a new "normal" and we are in the process of establishing that." You know, mandatory bag checks at entrances that create bottlenecks enough to create proverbial fish in barrel. Nice work.

But, here's a kicker. The same things were happening at Brandon University (and I believe that the University of Manitoba as well). All of this and the President of the Student Unions at both BU and the UofW were quoted as happy with the reaction and found it completely appropriate. I was also still subscribed to the UWMSSA mailing list and its President encouraged co-operation of these nonsensical measures. I'd expect better from a Math person given the high level of critical thought required in that discipline. I also cc'd both UofW student reps and got zero replies from them (at least that I saw).

The entire episode was a ridiculous over reaction with profoundly negative impacts for our future. One of the pillars of society, our educational institutions, had fallen that day. When the world of education and critical thought can't use what it apparently teaches... such things are so very disturbing.

Airport search while everyone else boarded.

[Anonymous Coward]

I was flying with my wife. A big black guy and I were called over to the side of the door before boarding started. We were forced to be wanded and patted down the entire time the plane was being boarded. Right next to the boarding door.

This was after having to pass through the main security line and having everything X-rayed and metal detected once already. It was obvious that they weren't even looking for anything, just passing time so that the other passengers could see that the big scary men were being searched extra specially well.

One of the big ugly male security guards cupped my penis and balls through my pants during the search. For several seconds. There was motion like he was weighing what he found. I told him that usually a man has to buy me dinner before I let him touch me there. He just glared at me.

Good times.

Any Smithsonian Museum, Washington, DC

[berendes]

Scenario 1: My wife carries small black purse (maxes out at Ipod + cellphone + small digital camera) through the door. Guard insists on "inspecting" it by poking inside with a wooden drumstick.

Scenario 2: My wife puts camera in one coat pocket, Ipod in second, cell in third along with the collapsed purse, and walks right through security.

Makes. Me. Crazy.

Re:The Iraq theater

[JasterBobaMereel]

We don't seem to run away as fast as the Yanks ...and most of these appear to be democracies (Except Burma...)?

America : 1607 - 1775 (168 years)
Turkey : ??? Not since it has been turkey?
Afghanistan : 1839 - 1919 (80)
Iraq : 1921 - 1932 (11)
Burma : 1824 - 1948 (124)
Egypt : 1882 - 1922 (40)
Palestine : 1917 - 1948 (31)
Bosnia : Not occupied except as part of UN force?
Kosovo : Not occupied except as part of UN force?
Malaysia : 1786 - 1963 (177)
Hong Kong : 1841 - 1997 (156)
India : 1856 - 1947 (91)
Pakistan : Created after we left ...
Bangladesh : Created after we left...

Re:The entire war on drugs

[permaculture]

"the only drug liberals I see are upper class people with no personal experience of drug abuse"

Such naïvety is easily corrected. Here's a whole website of people from all walks of life, who deal with drug abuse and would like to see the law changed.

http://www.leap.cc/cms/index.php [www.leap.cc]

Re:The blinking red light

[pthisis]

No, cars with automatic transmissions are cheaper used than cars without, because no one wants a car with worse performance and worse fuel economy, when the only benefit is that you don't have to change gears. Cars with automatic transmissions are only for the stupid and lazy.

"Manual transmissions get better mileage than automatic transmissions" is one of those things that was absolutely true 20 years ago but requires more thought these days.

It depends entirely on the specifics of the transmission, vehicle, and driver. e.g. the 5-speed automatic in the Toyota Rav4 gets better mileage than the 5-speed manual, no matter how carefully you shift. But the 4-speed automatic gets worse mileage than a careful driver.

The Toyota FJ cruiser likewise gets better mileage in the automatic than the manual. I think the Mazda5 with the 5-speed auto is another.

Moreover, even in cars where the reverse is true studies show that most drivers don't optimize their shifting for fuel economy. Most people wind up getting better performance but worse fuel economy than most modern automatic transmissions (which are significantly more advanced than older versions).

Now, manuals do give more control (e.g. allowing better engine braking on snow/ice). And they almost always have better performance. You can pop-start them if the starter/battery dies. In many places they're cheaper. And if you're careful about driving for fuel economy, you can get better mileage in most models (but you'll lose the performance benefits then).