Hacker News Reader

Comment by kstrauser | Hacker News Reader

Your employer provides you with a medical insurance plan. On your break at work, you use your company laptop to access the insurer's website and use their find-a-doctor tool to search for a cancer doctor. This is a legitimate use of your work computer, after all.

Does your employer have a right and obligation to see that you're searching for a cancer doctor?

Go to a large company's IT department and find the person there you dislike the most. Do you want that person monitoring the traffic and seeing that you searched for a cancer doctor?

Now you know why so very many of us believe you are completely wrong about this.

View on HN

> Does your employer have a right and obligation to see that you're searching for a cancer doctor?

Do you have the right to prioritize your personal activities over your employers protection of its' data?

Creating blindspots on enterprise networks won't get far - especially not given today's realities of breaches.

> Do you have the right to prioritize your personal activities over your employers protection of its' data?

It is absolutely fine in many countries to use a work computer for light and occasional personal use or on breaks. And no, employers don't always have the right to monitor all traffic that isn't relevant to the business, or even files on your machine marked as personal. Really depends on the local laws though.

Do you want your bank to be hacked and have a 50GB database backup with all your accounts and transaction history slow-leaked out via DNS queries?

Now you see why so many of us believe you are completely wrong about this.

To your point:

If it is their network, it's their network and their computer. Access the website from home, or from your phone, which isn't MITM'ed on the corporate network.

If it is a resource only available on the corporate network, but it is not a "company resource" such as find-a-doctor, then you can (a) accept that the company may see it, (b) contact information security and ask if they can, or (c) find another way to get the information/complain to HR/ombudsman/whatever.

It is up to the company to do the right thing when possible, which means (in our case) we don't intercept websites categorized banking, health, and a handful of others.

Information security obfuscates/blocks the showing of personally identifiable logs to the rest of IT, as well.

Again, banks (in my example) have an obligation to their millions of customers to protect their data, more than you have a right to browse a doctor tool or upload sensitive spreadsheets to your personal Google Drive to work on over the weekend.

Reply on news.ycombinator.com