6/24/2026 at 12:22:42 AM
I worked at a company that had hired Mitnick as a security consultant.His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either.
He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Counterproductive at best. It seemed like his PR exceeded his utility by a great deal.
That trend continues beyond the grave, maybe.
by mcfunley
6/24/2026 at 1:12:39 AM
In all fairness, a genuine attacker WILL be abrasive and abusive. They WILL single out employees that are gullible and exploit them. It's not pretty because a genuine attack is not pretty. Of course a simulated attack will be indecent and discourteous in nature, that is how attacks are.by skeaker
6/24/2026 at 5:57:28 AM
Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.by wjnc
6/24/2026 at 7:10:08 AM
That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.by dmos62
6/24/2026 at 9:44:18 AM
“Shame” is a big word. I wouldn’t shame a member of my team. Why would I!? They are great people. Same with “blame”. Everyone faults, everyone can be blamed something. That doesn’t change the basics of a person.Giving people a chance to discuss, as adults and professionals, how they got sniped beats any second hand training and experience by miles.
Now we get to hear that x% of a sample failed including #y elevated privileges people. How will somewhat naive management handle that?
Sometimes I get a feeling many HN-ers work in ultra toxic environments. HR is not your friend, your manager is there to screw you over and the firm will fire you for pennies. That’s just not my experience in working.
by wjnc
6/24/2026 at 10:05:15 AM
Selective training makes sense. But, I heard a pentest professional provide this counter-argument: if you tell management which individuals failed the test, even if your intention is to provide those people with the training they lack, the management might, due to ignorance, shift blame for suboptimal security on those people, label them as lazy/incompetent/etc, and ultimately not put the necessary processes (testing, training) in place which are the true determinants of penetration rates. The idea is that you get inefficiency by selecting for training broadly, but you prevent extreme sabotage by ignorant management.by dmos62
6/24/2026 at 11:56:06 AM
>Sometimes I get a feeling many HN-ers work in ultra toxic environments.Many people in the world work in toxic environments, not just HNers. Especially when the jobs market is shit, people turn on each other like animals.
>HR is not your friend
Where did you work at that HR was your friends? Did they invite you for beers or visit you in hospital when you were sick?
HR everywhere protect the company from liability, that's it. They're your "friends" as long as you don't risk becoming a liability.
>your manager is there to screw you over and the firm will fire you for pennies.
Your manager maybe not, if you're lucky and cares about those below him more than his own corporate ascension, but managers levels above sure screw over the ones in the trenches when shit hits the fan, that's how they got to the top in the first place. The more unscrupulous one is the more likely they are to climb up.
> That’s just not my experience in working.
Good for you.
by joe_mamba
6/24/2026 at 12:08:11 PM
You are right. Toxic workplaces are abundant. But non toxic I hope as well. I am always interested in how we can or cannot transfer local cultural differences and things we hold as basic truths via a forum.The second question: yes, in a time of need my manager and HR-consultant did indeed help me find appropriate psychological care. (And we also visit coworkers in the hospital.) This was part humanity, but also part of what ‘we’ (a firm is a collection of people) constitute as being part of what it entails to be an employer. It feels like a reductio ad absurdum to think that this was purely transactional on their part. It was deeply human, or at least I choose to see it as such.
by wjnc
6/24/2026 at 1:45:09 PM
>The second question: yes, in a time of need my manager and HR-consultant did indeed help me find appropriate psychological care. (And we also visit coworkers in the hospital.)This is unfathomably rare. I hope you realize this just how lucky you are.
> But non toxic I hope as well.
This never happen to me and I live, on paper, in the most livable country in the world. All bosses only care about my performance, not my healthcare. The moment I got too many sick days, I got dismissed and sent off on welfare.
>This was part humanity,
But most employment relationships are exclusively transnational. You're only virtue is usefulness to the boss's bottom line, not your "humanity", as that can't be monetized, unless maybe you work in government, healthcare or NGOs.
by joe_mamba
6/24/2026 at 10:26:08 AM
You can discuss peoples’ own failures with them politely and professionally. To avoid and talk around the issue is political, not professional.by nkrisc
6/24/2026 at 11:31:33 AM
If i was a security consultant, id make it part of the contract that i will not name names unless legally required.by kgwxd
6/24/2026 at 9:37:19 AM
I am surprised how controversial this is. I feel like I'm in that episode of Always Sunny in Philadeplhia where they decide to do an intervention by cornering and berating, while a mental health professional looks on terrified.by dmos62
6/24/2026 at 10:29:16 AM
Yeah, it's some bullshit 90s-era basement-dwelling "techie" attitude that even Linus Torvalds said he doesn't want to do anymore almost 10 years ago by now.As someone who has been training and mentoring and managing people for over 25 years: shame is useless as a tool. There's no "you gotta have thick skin" in people management. That attitude is just covering for the deficiencies of the manager. Most people's natural reaction to shame is to shut down and either slink away or become vindictive. You don't get the right corrective behavior out of using shame.
One's employment of shame as a corrective technique also has a wide blast area. When one singles out and criticizes people in public, the people who aren't being criticized still see it and form new, negative opinions of the criticizer. You undermine your own authority as The Boss when you do that.
Truly being "results focused" means studying actual management theory, negotiation techniques, coaching techniques, and conflict management. Praise in public, criticize in private. Always. And when you do have to criticize, keep the emotion out of it and stick to just the facts.
I have two employees I've had to put on PIPs right now. One of them is actually improving. The other one is a habitual liar, for whatever reason HR won't let me fire him outright, but even him I won't break my rules for, regardless of how angry he has made me, because the rest of my team will see it. During the meeting where I informed them I would be formalizing the process, they were not surprised and agreed that it made sense, because I had done the work before then to establish expectations and work with them to try to improve. There's are also people in the past whom I have fired who have messaged me on LinkedIn, thanking me for being kind to them during the process, because it was what they needed to turn their lives around.
You can tell people they aren't meeting expectations. You can put people on official notice. You can fire people. And you can do all of those things in ways that preserve their dignity. And in that mode, you can get mediocre employees to be good, good employees to be great, and great employees to stay. Or you can treat people like shit and constantly have to go back to the recruiting well. I'm sorry, but I'm far too busy to be constantly interviewing and onboarding new people.
by moron4hire
6/24/2026 at 7:15:49 AM
Shame works for me. If I was ever the one that got sniped and my colleagues saw it I'd forever be paranoid about it. Like when my dad sat me down and told me that I couldn't keep losing hats all the time when I was a kid and that I wasn't a baby anymore and it was expensive, and that shame made me look behind me when I leave somewhere until today and stop losing stuff.Specially for security, yes, shame the personal in a small setting, shame them in a positive way, as in lets all learn from this, but shame is very powerful. Much more powerful than saying "someone in this team failed this" and everyone thinks it was the other guy.
by vasco
6/24/2026 at 7:24:34 AM
I think people saw that old culture and thought "man, that's horrible. We must never do that". And the assessment was right, but also wrong.Previously, shame (and other pressure) was just applied without first empathically inspecting why the node was acting in the way it did, thinking that just enough force will surely solve the problem. It kinda did, but with lots of collateral.
Essentially, the security consultants (and everyone else involved) were just being lazy and not doing their job correctly.
But now we have this overcorrection, because people are still lazy and do not want to do their job correctly, which leads to the systems failing in a different way.
___
The solution would be to understand the individual node and apply the correct corrective measure. This can be shame, but it might also not be. And the level of it is also highly dependent on the situation.
This is a hard problem to solve, but it needs to be solved for good results.
The problem here being that scaling that up is hard, but everything needed to hyperscale. With either the individual nodes or the system integrity picking up the slack.
by hypfer
6/24/2026 at 7:45:32 AM
> I think people saw that old culture and thought "man, that's horrible. We must never do that". And the assessment was right, but also wrong. Previously, shame (and other pressure) was just applied without first empathically inspecting why the node was acting in the way it did, thinking that just enough force will surely solve the problem. It kinda did, but with lots of collateral. […] But now we have this overcorrection, because people are still lazy and do not want to do their job correctly, which leads to the systems failing in a different way.Very well said, and I think your exact description applies to management in general: management is hard, and require hard work to be done correctly, tailoring you response to every person, because two people being bad are their job aren't always bad for the same reason.
But most managers are not suited to the job, because it's mostly a status symbol and not something you give to the most qualified person, and most are too lazy to even try learning about it, so they don't make the effort of adapting to every individual, and in the end they end up either tyrannical or complacent.
by stymaar
6/24/2026 at 7:56:00 AM
I mean to be fair, with the business models, incentives, compensation, etc. being how they have been, why would you care?Why would you do the hard work when you can also just not do that?
I mean I agree with "people are not suited for the job", however, I also feel like often, "the job is not suited for people".
It's rot all the way down, essentially.
by hypfer
6/24/2026 at 7:48:37 AM
"shame them in a positive way" Oh my. That's some HR type viciousness right here. (⌒▽⌒)by NonHyloMorph
6/24/2026 at 9:55:22 AM
(Won’t fully repeat my other post.) Shame is such a big word. ‘Give people the chance to _teach_’ would be my reply. Which you probably would see as even more vicious, but it’s 100% sincere.As a junior I made the front page of national news. I answered a question with a very big number on a Friday afternoon. Hit headlines on Saturday. Our prime minister had to defend my mistake in public. (He never admitted any mistake. With just enough spin nothing sticks.)
The head of the organization literally cursed and spat at me. In that same meeting from the no. 2 down they stood up for me. It’s still a great story about how to treat mistakes 20+ yrs on. Admit mistakes. What did __we__ (not: he) do wrong? (Hint: from medior to board everyone had an afternoon off and we had never discussed stakeholder management. I was in no position to say no to a ministerial request.)
by wjnc
6/24/2026 at 9:44:18 AM
Maybe you just were never carefully told about something you did wrong in a way that everyone feels like they learned from it. The top reply to my comment put it better than I could, I think there was an overcorrection. I believe in fixing the process first, but there are situations where shame is the right solution. The current en-vogue thing of pretending all is good but penciling in that person for the next layoffs is I think worse than a bit of shame if that fixes the problem and avoids more drastic actions later on. Silicon Valley is very PC but then lays off without remorse so its funny to see this combo of "we care about never hurting your feelings all the way to the point where we fire you without a care in the world".by vasco
6/24/2026 at 11:56:01 AM
Shame is a subjective feeling. There's no "right" and "wrong". Shaming is the action being criticized. No one is arguing everyone should just shut up when a big mistake is made.by kgwxd
6/24/2026 at 9:07:45 AM
Does for me, too. But not for 30 people around me. They just shut down and isolate. It’s a matter of how self-reflective one is. And who knows who’s going to exploit this to get their way.by throw1234567891
6/24/2026 at 11:41:09 AM
Shame isn't wrong, shaming is. Your dad telling the truth isn't shaming. You just felt shame because you're a decent person that is embarrassed you were causing problems for other people.by kgwxd
6/24/2026 at 7:29:24 AM
> Shame works for me> I'd forever be paranoid about it
Some folks like to work that way, but I don't think most do. This obsession for outward correct behavior, even if it works at the end (at least externally), doesn't sound like a recipe for happy inner life but maybe I am reading too much into that.
by kakacik
6/24/2026 at 12:33:17 PM
Because 99.99% of the industry is not about improving the end state. It's about covering ass. Same as accounting, safety, environmental, and every other compliance industry.by cucumber3732842
6/24/2026 at 12:38:23 PM
[dead]by cindyllm
6/24/2026 at 6:54:35 AM
Assigning individual blame is missing the point of improving the security culture in generalby garbagewoman
6/24/2026 at 7:52:23 AM
Do you hold that same opinion for the training and testing of pilots and surgeons? Do you want to step on a plane with a pilot who is only there because we are too nice to assign individual blame for his inability to do the job properly? Do you want to be going into open heart surgery in a system that dismisses the idea of individual blame when analyzing the outcomes associated with each surgeon? Having no idea if the man cutting into you, has previously had great outcomes or poor outcomes?by quantummagic
6/24/2026 at 11:17:40 AM
You’re both imagining different scenarios.Scenario 1: 20% of staff tested failed. Individual targeting is pointless because the issue is systemic. This has happened in aviation, it’s common for accident investigators to conclude that the entire company culture (or even the entire industry) has failed to handle a problem. They don’t waste time in cases like this pointing at individuals.
Scenario 2: you test very regularly and nobody fails the tests. Except Bob, he fails the tests. In this scenario, your threat analysis document will recommend retraining, firing, or restricting Bob specifically.
Scenario 2 almost never happens because nobody has data that good. If your sampling frequency or ability to conduct tests are limited, no specific sample is enough to cover the entire problem. If you focus on a punishing (or just re-educating) the 20% who failed then your next test will fail for (potentially) 20% of the 80% who weren’t retrained, and thus didn’t learn anything.
TLDR: you need to choose the approach based on the situation, but we collectively tend to treat security poorly enough that we’re almost never in the fortunate situation where scenario 2 fits.
by scratcheee
6/24/2026 at 7:03:04 AM
Yes and no.Yes in general, because usually it's culture and not an individual failing. No in specific situations, because it's not just culture but also some people are just the weakest link.
Only focusing on either of these while ignoring the other is going to lead to bad results.
by hypfer
6/24/2026 at 4:39:28 AM
Not necessarily WILL. I've seen awesome attackers who were mostly checkbox spreadsheet clerks. Friendly, methodical, boring, expert.by deepsun
6/24/2026 at 8:39:42 AM
[dead]by thrownthatway
6/24/2026 at 3:43:43 AM
Isn't he famous for social engineering/physical security type things? If you hire an expert in X, you are probably going to get X.by bawolff
6/24/2026 at 3:46:29 AM
Yeah I agree, caveat emptor and all that. The blameful framing is bad work product though.by mcfunley
6/24/2026 at 10:56:48 AM
How did he go about it? Giving a manager a report saying Foo and Bar are suck at security gives the manager good information on who needs training.If he walked into a conference room and called them out by name, that would be a touch abrasive.
by antonymoose
6/24/2026 at 5:14:14 AM
Isn't he famous for getting caught?by rixed
6/24/2026 at 5:28:08 AM
Getting caught didn't make him a superstar. Telling his techniques in books and public speeches did.by teo_zero
6/24/2026 at 7:20:01 AM
That's not true, he was already famous during his trial which made him well known before any books or public speeches.by vasco
6/24/2026 at 1:06:19 AM
Dude I was called out by name in the report either right before you got there or the first one you were there. I was called out in the one where they got B's Audi keys in his office.Whole thing was so dumb. A floor full of smart monitors that they could have put a keylogger on. A plethora of physical network access and I get called out for leaving my laptop on the lock screen and going downstairs for food.
And they got found out because I ran little snitch I paid for myself and it caught their hijacked chrome making all sorts of weird network calls. But I don't remember being given credit for that.
(Sips mojito)
by leetrout
6/24/2026 at 6:54:08 AM
How would they have been able to install a hijacked Chrome if your computer was on the lock screen?by sersi
6/24/2026 at 8:35:54 AM
perhaps, back in the day, when windows machines would automatically run autorun.inf if present on a cd or usb drive regardless of whether the machine was locked or not.by simg
6/24/2026 at 10:04:19 AM
Little Snitch is Mac software though.by speedgoose
6/24/2026 at 10:56:24 AM
There's often ways around things. Back in the day I worked in a callcenter. You'd screen-lock & take a short break.Screen-lock itself required a password. But lo & behold, if you'd pick up the headset & hit a button "accept call" (usually meaning you're back in action), screen would be unlocked.
Convenience (read: profit) trumps security every time.
by RetroTechie
6/24/2026 at 11:55:15 AM
Mac's had several vulnerabilities during that time including the ability to log in from lock screen with the user "root" with no password. There was also a vulnerability with executing a rubber ducky even with file vault. It was almost 10 years ago so I don't remember the specifics but the point was they had physical access to the building so they could do anything.People walked to conference rooms and to get food without taking their laptop with them all the time (of course) so it's not like I did something out of the ordinary or against policy. I remember them accusing me of leaving my laptop over night but I was just working late.
And this was in a secure area with cameras within earshot of the over night crew and behind a door in a private shared office (glass door, glass wall so someone could have seen them) so it's not like I was at a common area and just walked out leaving my laptop on a random table).
by leetrout
6/24/2026 at 11:50:21 AM
He also took MG’s O.MG usb cable and got it manufactured and sold from under him.All that “Free Mitnick” support from the early 2000s he got must have gone to his head, or he was just a dick all along
by alfiedotwtf
6/24/2026 at 2:37:18 AM
He mostly used social engineering. Not technical exploits. So that's how he succeeded. Call it crazy, but it worked.by firebot
6/24/2026 at 4:29:44 AM
Why hack a password when you can get the employee to just tell you.by fma
6/24/2026 at 4:43:28 AM
Because the employee now knows who might have done it.by deepsun
6/24/2026 at 7:33:35 AM
The employee doesn’t know who you are. They met “Bob the support rep from Vendor xyz” who just needed access to fix an issue.by imgabe
6/24/2026 at 8:00:29 AM
And now all that shitty KnowBe4 nonsense we have to sit through every couple of months is all "What do you do if your manager phones you up and says they're on a business trip and need you to use the company credit card to buy Amazon gift cards", over and over and over.Bold of them to assume I'll answer the phone if I see my manager's number come up.
by ErroneousBosh
6/24/2026 at 9:19:54 AM
> What do you do if your manager phones you up and says they're on a business trip and need you to use the company credit card to buy Amazon gift cards"If I've learned anything from the scambait people such as kitboga on youtube, if you're bored you play along with it, pretend to have acquired the gift cards, and then tell the "boss" you've scratched off and emailed their company address the codes, as the scammer on the phone wails "do not redeem! SIR DO NOT REDEEM!"
by walrus01
6/24/2026 at 10:34:48 AM
“He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent.”VS
2002 “Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems that contain protected information.” — Kevin Mitnik
“Amateurs hack systems, professionals hack people.” — Bruce Schneier
source < https://archive.md/LiQN4> / (paywall) <https://economist.com/special-report/2002/10/26/the-weakest-...>
by bootload
6/24/2026 at 8:52:31 AM
Dumb people are dumb. And will be. Their ability to learn from experience is almost non-existent. They are biggest security threat. Corporate structure didn't identify their mental limits and gave them way more access. So Mitnick, as outsite observer identified them and did good job.I might say "sorry for your loss of job" .... but seriously not. You shouldn't got that job in first place.
Atleast you can brag about getting unemployed thanx to Mitnick.
by shuwix
6/24/2026 at 12:45:56 AM
Kevin's security company is also a mess, and the training videos they produce are embarrassing at best.I understand he probably just lent his name to the company (though he did show up in some of the videos), but still...
by the_af
6/24/2026 at 12:48:52 AM
This is what happens when the 90's PC community renamed crackers as hackers. Proper hackers would have been the ITS/WAIS ones doing crazy things with computers for its era.by anthk
6/24/2026 at 12:28:55 AM
He social engineered your company into contracting him, and that adds to the legend, but people don't see how many other companies he failed to social engineer.by lern_too_spel
6/24/2026 at 4:50:13 AM
I mean, the landscape changed quite a bit since early days of what Mitnick did as a blackhat. He did his best to adapt and make money, which given his prison term, isn't really that surprising.by ActorNightly
6/24/2026 at 2:44:39 AM
"He didn't breach us the way we wanted him to do it so it was dumb." Idk man, sounds like you locked your doors but left the windows open. That's the point of these things.by esikich
6/24/2026 at 3:16:16 AM
The point is really after working through remediations, there were pretty massive issues remaining that weren’t hard to find and were relatively vastly easier to exploit if the attacker is a Russian teen and not Bruce Lee. And the budget for such things was blown. Priorities, etcby mcfunley
6/24/2026 at 3:13:11 AM
"a client that turned out to have been rife with SQL injection" sounds more like they left the doors open, but the report focused on the lack of security bars on the windows.by murderfs
6/24/2026 at 12:31:32 AM
The hero worship of him makes me physically ill, always has.He did cost people their jobs though, so I guess he's a good person.
by topham
6/24/2026 at 4:57:52 AM
It's like we don't have any messiah's today that are mediocre professionals at best.by deepsun
6/24/2026 at 12:35:48 AM
> "He was a hacker-turned-security consultant who, later in life, helped shape the modern white-hat."They left out convicted criminal.
by kingforaday
6/24/2026 at 12:41:13 AM
I have so many stories about his absolutely terrible behavior at conferences. He once refused to pay the entry fee to a charity event and had to be physically ejectedy.Absolutely better at PR than any actual work, pay careful attention and none of his early stuff was particularly novel, from a technical perspective.
But for whatever reason, we venerate him just because he was victimized by the state. The world is not a dichotomy -- sometimes bad things happen to bad people.
by firefax
6/24/2026 at 1:01:41 AM
He got all of the "Free Kevin" attention because of how long he was left in jail before trial and then being stuck in solitary confinement after sentencing for months.If he had been treated fairly by the justice system he wouldn't have gotten nearly as much attention.
He was also autistic, a lot of the behavior can be explained through that lens.
by colechristensen
6/24/2026 at 1:19:32 AM
>He got all of the "Free Kevin" attention because of how long he was left in jail before trial and then being stuck in solitary confinement after sentencing for months.That was uncalled for on the part of DOJ.
>He was also autistic, a lot of the behavior can be explained through that lens.
I'm autistic. Maybe I should go commit a bunch of felonies to increase my chances of a good job and stature in the hacker community, since things like publishing code, publishing peer reviewed papers, and mentoring newbies have not been productive ways of finding gainful employment nor respect of my peers.
I have friends who did things like take a gap year to travel the world or met their spouses on nights I stayed in to study, and some evenings when browsing HN I feel very sad that I wasted my 20s on a society that does not care about me.
Anyways, sorry to wall of text, but what you said really struck a nerve with me -- there are hierarchies in any community, and one thing I've noticed with the hacker scene is one group of people can mess up over and over using the same sets of facts or diagnoses, but others can expect to have worse outcomes with better behavior for reasons that elude me to this day.
by firefax
6/24/2026 at 2:12:37 AM
> I have friends who did things like take a gap year to travel the world or met their spouses on nights I stayed in to study, and some evenings when browsing HN I feel very sad that I wasted my 20s on a society that does not care about me.I'm glad you have finally recognized the problem.
Stop living for your idea of others and start living for yourself.
by coryrc
6/24/2026 at 2:20:28 AM
Kevin was famous for being mistreated by the DoJ and writing some books which were perhaps not particularly true in hindsight. After he got out of jail and rejoined the community he lost a lot of respect for being himself, though it's not impossible that years of imprisonment and a long time in solitary had some permanent negative effects. In other words... you shouldn't envy Kevin's life.For the rest: nothing's stopping you from having fun, regardless of age.
by colechristensen
6/24/2026 at 7:06:33 AM
Vienna waits for youby user_of_the_wek
6/24/2026 at 7:57:44 AM
Is Vienna the place to be for security researchers in their 30s starting to doubt their life choices?by rcbdev
6/24/2026 at 8:56:35 AM
The OWASP conference is being held there next week, so in a way, yes?by stavros
6/24/2026 at 9:11:40 AM
But is it a good place to meet future spouses?Because missing that that seems to be the main problem of the poster above.
by lukan
6/24/2026 at 9:13:04 AM
Anywhere where you meet people is a good place to meet future spouses.by stavros
6/24/2026 at 9:29:45 AM
Maybe, but if I am looking for a female spouse, a mens conclave is probably not the best place to find one. (I would assume the audience there is largely male?)But well, he also is looking for respect and regocnition among his peers and vienna is a nice city.
by lukan
6/24/2026 at 3:32:53 AM
It's good that somewhere the quality of work is rewarded more than the quantityby lnxg33k1
6/24/2026 at 4:52:37 AM
You act like thats a bad thing given the nature of his crimes.If more people strived to be like Mitnick today, the tech world would have a lot more power.
by ActorNightly
