Multi-factor is already satisfied
MFA protects the moment you log in. An open desktop is after that moment — the tokens are live, the browser is trusted, and nothing is going to prompt anyone for a code.
Unattended workstation detected
// incident report #0000 · severity: embarrassing
You Left Your Screen Unlocked.
Somebody walked past your desk, found this machine wide open, and typed a URL instead of doing something interesting with it. Today was a good day.
Caught at
--:--:--
Unattended for
0 seconds
Times caught here
1st
Lifetime exposure
0 seconds
Relax. This is a joke page.
Nothing has happened to this computer. This site is a static web page. It cannot and did not read your files, email, passwords or clipboard; install or run anything; or send anything anywhere. The only thing stored is a small counter in this browser's own local storage. The terminal further down is a scripted animation — fake output, no commands, nothing executing.
But this one is worth thirty seconds of your attention.
Whoever sits down at this keyboard is you, as far as every system here is concerned. Not "could pretend to be you" — is you. You are already signed in, so there is no password to guess and no second factor to defeat.
Think about what that actually covers on this machine right now: your mail, your chat history, your files, your ticket system, whatever your VPN reaches, and your password manager — which, if it's unlocked, is every account you own rather than just the ones on this screen. Sensitive information about you, your colleagues, your customers and your employer is sitting behind a screen that anybody could have walked up to.
It could be used against you personally, or against your company, and the logs would say you did it. Today it was someone who only opened a website.
Meanwhile, in the alternate timeline
A dramatisation of the version of this story where the person who found your desk wasn't friendly.
simulation — not a real shell
DRAMATISATION
stranger@your-desk:~$
no commands are being executed
Why an unlocked screen is the good stuff
An unlocked screen doesn't leak a password. It leaks something better: every session you are already signed in to. The attacker skips the hard part entirely, because the machine has already vouched for you.
Your mail client is an identity
A message sent from your seat has your name, your signature, your history, and none of the tells people are trained to spot in phishing.
Open vaults stay open
An unlocked password manager is the whole set of keys. Vault auto-lock timeouts exist precisely because of the walk-away scenario.
Saved browser credentials
Browsers gate credential export behind an OS password or biometric prompt — but that only helps if the machine is locked. Sitting at an unlocked session is a very different starting position.
Everything the machine can reach
VPN routes, file shares, internal dashboards, chat history, ticket systems, prod consoles. The laptop is the perimeter, and the perimeter is currently holding a coffee two floors away.
Quiet, durable footholds
The dangerous version of this prank leaves something behind that keeps working long after you sit back down. It doesn't need long, and it doesn't look like anything.
The page is a joke. The list above is not — none of it needs special tools or special skill, and all of it is prevented by about two seconds and one keyboard shortcut.
The two-second fix
We highlighted the one that matches this computer. Muscle-memory it.
Windows
Win + L
macOS
Ctrl + ⌘ + Q
Linux
Super + L
GNOME, KDE and most others. Some setups use Ctrl+Alt+L.Lock it
Win+L · Ctrl+⌘+Q
Whatever this device is, it has a lock shortcut. Learn it.Better still, make it automatic: set the screen to lock on sleep and after a few idle minutes. The habit covers the times you remember. The timeout covers the times you don't.
House rules
Do
- Find an unlocked, unattended screen.
- Open a browser and go to ylysu.com.
- Walk away. Let the page do the talking.
- Accept the retaliation gracefully when it comes.
Don't
- Touch their files, mail, messages, or settings.
- Post anything as them. That's not a prank, that's the thing we're warning about.
- Do this to someone who'll be genuinely humiliated rather than gently owned.
- Do it on a machine you have no business standing in front of.
A good YLYSU costs the victim thirty seconds of dignity and buys the organisation a habit. Anything beyond opening this URL is just the crime with extra steps.
Questions the victim always asks
Did this site do anything to my computer?
No. It is static HTML, CSS and one JavaScript file that animates a timer and some fake text. There is no download, no extension, no prompt, no account. The scary terminal is a pre-written script on a timer.
How does it know how many times I've been caught?
A counter in this browser's localStorage, scoped to this site — the same mechanism that remembers a cookie banner choice. It is not tied to you, your machine, or any account, it doesn't leave the browser, and it resets when you clear site data. It also won't follow you to a different browser or profile, which is why it says "this browser".
Am I being tracked?
Not in any meaningful sense, but here is the honest version rather than a marketing one. The site uses Cloudflare's cookieless Web Analytics, which counts page views and referrers without setting a tracking cookie or building a profile. Like every web server on the internet, it also writes ordinary request logs — your IP address and browser string — which is what "visiting a website" means everywhere. There is no account, no tracking cookie, no fingerprinting, no ad network, and nothing read from your machine.
Is this an actual security tool?
No. It scans nothing, tests nothing, and proves nothing about your security posture — it can't see your machine at all. It's a joke that happens to carry one true and useful idea: an unlocked screen hands over every session you're signed in to. Take the habit, ignore the rest.
Someone did this to me. What do I actually do?
Lock the screen now. Then set an automatic lock on idle and on sleep, so the next time you forget, the machine remembers for you. If it's a work device and you're unsure whether anything else was touched, tell your IT or security team — nobody has ever been fired for reporting that.