Hacker News Reader

Comment by Kaotique | Hacker News Reader

I find that first advice a bit paranoid. What country are you from where it is normal that a company is logging and spying on its employers? I have a company laptop but there is no logging whatsoever. Outside office hours I use this laptop to do personal stuff all the time.

View on HN

In many countries if you have a company laptop then everything on that laptop or done on that laptop belong to the company. They are unlikely to be spying on your directly, but they will often have administrative access, will perform backups to ensure continuity of business data you are working on etc. If you leave and start a competing company someone in IT is going to get a call asking them to check your archived data (email, etc.) to see if you were working on this new company while using old company equipment or during old company time. If they find evidence of this then in many jurisdictions you are going to be in trouble...

Save the headache and use your own equipment. At the very least have a personal VM that you run to do your personal work on.

I appreciate your concern, but in this case, there is really nothing going on this laptop that I am not aware of. Company e-mail is archived somewhere in Google but I obviously don't use my company e-mail for personal use.

I am a bit surprised that multiple people here are living in such a permanent state of paranoia.

Most companies in the US monitor everything. And you probably wouldn't know, things like intercepting DNS are not obvious from users end. Many monitoring tools hide themselves like malware.

If the owner didn't want it installed, it would be malware!

(but since the owner is the company....)

I've worked in information security my entire career, and let me tell you: we have the ability to monitor anything and everything, and it's often completely invisible to the end user. Read your employee handbook and there are likely places in there talking about monitoring on work-issued machines.

It may be that your employer doesn't do that. You would be extremely in the minority. Even connecting to the employers network, either from VPN or at the office (can get everything on the network up to layer 7), even using their DNS server (can log every DNS request), even using their AV software (can read every file on your system, even removable media), even using their proxy (can watch all your Internet traffic and decrypt SSL), or MaaS tools (game over, full access, including keylogging), there is a ton of tracking and monitoring that can be done from the most basic tools. Most web proxies are capable of breaking SSL requests to inspect the traffic and then rebuilding it before passing it on. I work with a technology that does deep packet inspection and full payload capture on every flow that hits the network.

It may be that your company doesn't do any of that. But before you go coaching people to quit their jobs or assume they're not being tracked, you should realize this is extremely common and any company who does not do it is putting themselves, their employees, and their customers at extreme risk when it comes to security. The most basic of malware could bring down the entire company if they don't have a proxy or AV. And if anyone can attach any device to the internal network without needing any controlling software or inspection software, if anyone can send whatever data they want out of the network, it's not a question of if you will be hacked, it's a question of how long have you been hacked and you just don't know it.

They're not using monitoring software to watch your Amazon shopping habits. They're using it to protect the company, their employees, and their customers.

>You would be extremely in the minority.

Rubbish. Most companies don't even have an IT department and are too busy trying to keep the business going and make payroll to be worried about malware or what their employees are Googling.

I agree with being cautious, but by the sounds of it you don't know what "most" businesses are like in the real world.

You're right. Anyone who doesn't have a corporate network likely isn't going to have a security team or even an IT department. But considering I explicitly mentioned the corporate network and the security department, you obviously knew what I was talking about and just wanted some reason to disagree with me.

Companies without an IT department are extremely unlikely to let their developers take a company-owned laptop home, for the sole reason that they don't have developers or company-owned laptops.

"What country are you from where it is normal that a company is logging and spying on its employers? "

This is everywhere.

"I have a company laptop but there is no logging whatsoever."

I suggest they very well could be logging your web requests. This is very common.

It's not like your manager is necessarily even going to have access to this. They're not interested in what you are doing, generally.

But if there is a serious security problem, or a legal problem ... this will then be used.

I don't know if you mean logging of traffic on the company network or all network traffic on the laptop itself. The latter is definitely not happening here.

How do you know it's not happening?

Because I installed it myself and nobody else touched it. If you suspect your employer to secretly keep logs of your internet traffic to one-day claim your IP rights you seriously need to search for a new employer.

I'm really sorry, but this is naive. It may be true that in your case you have complete control over your laptop and there is no possibility of logging, but this is not broadly the case, and it is not a good litmus test of an employer. If you start working for a company with lots of employees and valuable proprietary data, they will have access to take a look at what you've done with your company computer. And not because they're evil, but because "insider risk" is a real problem that scales with a company's size and success. An employee could be looking up private information of an ex-partner, or sending a zip file of customer credit card data to their private email account, the company could be sued and need to provide information on those acts during discovery, etc. I think good employers should assume good faith by their employees and should not employ the sort of active monitoring and productivity tracking stuff that exists, but I think having the ability to reactively look at backups and system logs is important.

They'll log at a network level, not from software on your laptop.

If you work remotely obviously they can't.

But if you work in an office, there's a very good chance they are.

Quite a lot of larger companies use various endpoint monitoring / protection solutions that will log and stream back a lot of data in order to e.g. protect against device compromise and insider threats. It's not as though your manager is likely to have the ability to grep through your device history on a whim, but if you do get into a legal tussle they might be able to go back and review those for evidence.

These days it is super common. It used to be the domain of only fairly large organizations, but now even smallish to medium sized companies have easily available options to do it.

If you have an IT department (or person) who pushes updates or otherwise controls (or can control) software configuration on your machine, there is at least a decent chance they are also doing at least some of:

- logging all traffic on company network (+ VPNs, of course)

- MITM all SSL traffic on this network (and do filtered logging based on deep packet inspection and/or endpoints)

- above including personal devices connected to that network

- logging all software configuration changes on your machine

- logging all network requests on your machine (regardless of network)

- logging all crash logs and/or other OS level interactions

- timetracking app usage

- logging all communication layer traffic (i.e. mic usage, camera usage, endpoints)

less likely: keylogging or other direct monitoring.

In my limited experience all of this stuff is too logistically complex for small companies, but as soon as you start centralizing IT servicing at all, you will be offered products with some of these capabilities along with more standard virus scan etc.

Indeed.

Also, I remember that when the GDPR got implemented in the EU, I had to agree on a new contract amendment in which the company legally had to list all the data that was collected on its employees (e.g. emails, personal info like age, address and income, ...).

GDPR includes an exemption for companies logging information that is required to maintain the security of their infrastructure. This includes things like logging employee's DNS requests, AV logs, DHCP logs, web proxy, etc. Things that are fundamental to ensuring the security of the corporate network and the data it contains.

That means even under GDPR, your employer could (and should) monitor what you're doing on their company-owned assets.

My company literally says "assume 0 privacy". Not joking.

Reply on news.ycombinator.com