See https://www.nytimes.com/1992/11/20/nyregion/shoulder-surfing-life-in-phone-credit-card-theft.html?searchResultPosition=5

If you can't make it past the paywall, know that it concerns shoulder surfing at Pennsylvania Station in New York. The reporter estimated that about fifteen surfers were active most times.

Firstly visit 12-foot Ladder at https://12ft.io/proxy secondly paste the NYT link - paywall scaled

I didn't mean to post twice...

It's been a battle making sure we don't let customers just walk into our office where they can see our screens. And I must've shouted "Windows+L" hundreds of times at people getting up from their desk.

People at my office still like me... i think...

Our head of security used to just walk into peoples offices and send emails from their unlocked machines.

I'd like to say it helped, but at least the supply of free cakes was nice.

Madness is trying the same thing again and expecting different results. Telling users repeatedly to do something and expecting them to listen.

A design or engineering solution is required. There are plenty to choose from, starting with office layout, translucent dividers, narrow-angle privacy screens, computers that detect the proximity of a work-issued ID card or mobile phone, pressure sensors in the chair, face recognition on the web cam...

Cone of silence?

Taser?

Cattle prod (using the BOFH's approach to user training).

Experience is a dear teacher and for those who still don't learn there's always the dodgy window fastener.

While i do agree with you on the most part, if people are willing this definitely helps with building habits. It's a small office i work at, and they mostly respond with "oh yeah i should do that". If you're just shouting angrily at people who are unwilling to change, you're not getting anywhere.

I do agree that you get the best results if the solution doesn't require interaction. I'm a huge fan of auto-locking devices, unfortunately we don't have compatible cameras at every desk, but the windows hello camera-based auto-lock is amazing. Even came across some laptops that actually detect when someone is shoulder surfing and dim the screen, or turn it off. That can get quite annoying though, sometimes you just want to show something on your screen to a colleague.

Easier fix - if your screens have confidential information on them, why are outsiders permitted to enter the office? Our HR has two rooms. One we go in to talk to the HR girl, and the other one where going into (*any* excuse including "the building is on fire") is an immediate sanctionable action.

OTOH setting the building on fire is an extreme way to deal with HR.

She's an HR woman

#justsaying

She's an HR waste of space (female) .

Create a bonus pot. For instance 500 per employee (depends on how you value security).

Nominate someone to walk through the office each week and if there is unattended unlocked computer, let them take a picture (using company secure phone) or hire security person.

Remove every person with recorded violation from the bonus pool. Distribute the bonus amongst employees without the violation, after paying % the nominated employee for taking the pictures (if it wasn't done by security).

If a person gets removed from the bonus pool, they'll have to attend mandatory security training.

If they get violation again, give them final warning and sack them on third strike.

Great, your own in-office Stasi - what's not to like

Using technology to change behaviour (IME) rarely works, either someone senior enough to have influence will object to it and become an exception which immediately dilutes the purpose of the policy, or the company implements the technology but does not include compliance with IT policies in their code of conduct so HR can't do anything to stop repeat offenders.

Used to do security audits for a firm and every year was the same, passwords blank, non-expiring, written on post-its, shared accounts all over the place, browsing habits that would even shock the people looking at "tractors" in parliament. Document it all, write it up, then a year later find the same people were doing the same things. My firm were getting very well paid to visit all their sites for this audit, but they never did anything we recommended until a password was compromised by a disgruntled former employee. Even then most of the directors wanted to be made exceptions to the new password policy.

A keyboard with a single key - for example at top right - that performs Windows-L. It still requires user action (and keeps the user in control) but tapping the corner of your keyboard as you stand up is simple, obvious and gets results - all good for engraining it.

I used to do similar if less harmful things. Usually change wallpaper to something yuck, or set off a Rickroll video on loop depending on the access rights of the moment.

It did work with some people

Take a screenshot of the current screen and display it full screen.

[1]Privacy screens for laptops have been around for ages. They should be mandatory for anyone using a government (or indeed corporate) laptop in public places. This is not rocket surgery, so why hasn't it become the norm?

[1] https://www.3m.co.uk/3M/en_GB/p/c/office-supplies/workstation-accessories/screen-filters-protectors/laptop-filters/

I'd agree, but they've still got a certain angle of view. If you've genuinely concerned about the privacy of what's on your screen then don't have that content on screen in a public place. I don't expect much of MPs, Mercer is a former soldier, he really should know better than this, and know when to take some responsibility.

Then again, this government has never taken responsibility for anything.

"Then again, this government has never taken responsibility for anything."

Not defending our (soon to be ex) Government, but they are not unique in this and I'm sure their successors will be just as bad for taking responsibility, as indeed all previous administrations have been too.

Yup, the key point here is public space.

I'm sure MPs and ministers are offered lots of training to avoid such situations but as is usual with people in power despite being people of interest and at high risk of targetted attacks they usually consider themselves too important to make themselves available for training or listen to training if they actually turn up.

It must be a bloody nightmare to be a parliamentary infosec manager.

Make it the job of the chief whips.

I saw a commuter on the tube carrying a pack of paper in a transparent case. In the front of the pack was a letter reading Dear $name, ...

I spoke to her by name (great shock) and suggested the transparent case in public was a bad idea.

Macom Tucker ensures this phrase is visible to journalists in order to embarrass the idiots who brainstormed it.

There's been more than a few times where politicians have wandered down Downing Street with transparent folders: https://www.theguardian.com/politics/2016/nov/29/brexit-leak-downing-street-papers-caught-on-camera. That's one place where it's pretty much guaranteed to end up on camera.

Nice to see Mercer's taken time out from defending the nation against Carol Vorderman to warn us about little wierdos. Was he talking about the PM?

Doesn't inspire much confidence really, well known security risk (at a university and /we/ get trained on this, Mercer makes a big deal about his army background), but the reaction is to play the 'weirdo' card as if it's somehow cheating or unforseeable. See also Trump and the overweight people in their parents' basement accusation. As if the odder (and by implication in both cases more pathetic) the person who waltzed through your security the more understandable it was.

Is it 'cheating'? Depends who defines the rules of the game. Is it utterly foreseeable? Yes. Is "I was being stupid and got caught out by some weirdo" a reasonable excuse? No.

Carry spare socks. Wear leather shoes. Wash and dry between your toes. Place cotton wool between your toes if you are really struggling to keep them dry. Dry your shoes when not wearing them by using a shoe tree or fans - don't use heat.

> more popular members of the Conservative party, such as Kemi Badenoch and Penny Mordaunt

Who?

Mind you I've never heard of this Tory plonker either.

Badenoch is even denser that Cruella Braverman. Hope that helps with the context

It's a close match.

It's a comparison on the same lines as "which is your favourite strain of plague?"

Civil service is probably getting training about security including the risk of shoulder surfing.

Do ministers also get it? If so, it may be the case "the rules for the pleb don't apply to me. Who would have dared to look at the screen of the me almighty anyway?".

It's comforting though, that soon these types will be flushed out of the system.

Remember to register to vote folks!

If you think post July will be better than pre July you must be an optimist. Different, yes, better, no.

Remember to register to vote folks!

I was shocked that voter suppression as suggested by the shoulder surfing isn't a dirty little secret but overt (caretaker) government policy. This prat was complaining about his veteran mates being suppressed not the principle itself.

So in addition to registering to vote also ensure you have the required identity documents to cast a vote.

Here in AU the toryoid* (LNP) government (at the time) unsuccessfully attempted this piece of contemptible skulduggery.

Having compulsory voting and registration makes voter id largely unnecessary.

High time the UK adopted both preferential voting and mandatory voting and ditch the lords for an elected regional representative assembly.

* like haemorhhoids but involving the genitourinary tract.

I thought it was practically common knowledge that the whole policy was designed on the basis that the demographic for labour voters was less likely to hold or carry the required ID than those those people making up the Conservatve voting demographic. Therefore decreasing the Labour voting percentage via a side channel attack..

The same thing goes for redrawing constituency boundaries which practically every government does when they get in.

Wait a minute, there are "popular" politicians???

I thought you just picked the best of a bad lot the least smelly turd from the septic tank to vote for...

We make it a crime to read government laptops

Tough on embarrassing leaks, tough on the causers of embarrassing leaks

If your bank's idea of security is that all you need to unlock your banking app is a PIN, I'd suggest you find a bank which has a clue.

You can be on the opposite side of the spectrum and have a bank that will block and cancel every transaction you make and ask to call their fraud department to explain it was you each time.

Please, I'm eating...

(icon closest to "just threw up on the keyboard")

I'm just vaguely surprised that a minister was taking public transit instead of a private car with driver.

As for voter ID, it's always necessary. When you go to vote, how do they know if you're who you say you are? Chances are very good the voting officer doesn't know you by sight after all.

A few years back the UK rejected ID cards, now they are required for people to vote. There are advantages to having an ID card system if guess people wanted someone other than the govt to run it. ARGH !!!

Different things.

ID cards were to give the police reasons to stop anyone they wanted

Voter ID is to reduce the number of opposition voters

What are 'veterans' in Great Britain ?