Exercise 2: Why Ticket 3 Needed an Independent Callback, Not Just a Badge Check — Possible Solution ==================================================================== WHY A BADGE OR ID CHECK ALONE ISN'T ENOUGH ------------------------------ Per this chapter, an independent callback was used "rather than a badge or ID check alone - which can be faked the same way a phone number can be spoofed." A badge, an ID, or a confident, plausible appearance in person are all things a determined impersonator could replicate or fabricate, the same way Chapter 3 already established that a caller ID number or a claimed callback number can be spoofed over the phone. Visual or physical plausibility doesn't verify identity any more reliably than a friendly voice on the phone does. THE SAME REASONING FROM CHAPTER 3 AND CHAPTER 4, APPLIED IN PERSON ------------------------------ Chapter 3 established that a claim can only be verified through a channel the claimant doesn't control - a caller-supplied number proves nothing, because the caller controls it. Chapter 4 built this into a concrete callback procedure: independently look up the real contact, never rely on anything the requester supplies. An in-person visitor "supplies" their badge, their story, and their claimed manager - all of which are, in principle, exactly as fabricatable as a spoofed phone number, just presented physically instead of over a line. WHY THE CHANNEL (PHONE VS. IN PERSON) DOESN'T CHANGE THE UNDERLYING PRINCIPLE ------------------------------ The specific mechanism of the deception differs (a fake badge instead of a spoofed caller ID), but the underlying vulnerability is identical: trusting information the claimant themselves is providing, rather than information sourced independently. Chapter 4's own procedure - call an independently-looked-up number for the claimed manager - solves this exactly the same way regardless of whether the original request arrived by phone, chat, or in person. WHY THE CALLBACK WORKED HERE ------------------------------ Per this chapter, "the manager confirms no new hire is expected this week" - calling a number the visitor did not supply produced information the visitor had no ability to influence or fabricate, which is precisely what made the verification meaningful. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains specifically why a badge/ID check alone is fakeable, ties this back to the identical reasoning already established in Chapters 3 and 4 for phone-based requests, and explains why the verification channel itself (phone vs. in person) doesn't change which underlying principle applies.