Comment by prepend | Hacker News Reader

Comment by prepend | Hacker News Reader

I remember when I first started working and was surprised to learn that email admins could and would read email. When I asked HR for their policy on this they said they had none and the company can do anything they want with employee activity. This was the 90s and was true then as it is now.

Same for the MITM ssl proxy stuff.

This has always been legal and recorded, Microsoft just makes it easier. And I think maybe even better since at least the information is audited and not available to any random sysadmin.

This just makes me choose my employers more carefully as while they certainly have this data to abuse, fortunately few do not.

The risk of a micromanager misusing the information mentioned in this article isn’t one of privacy, but one of being a crappy manager. If someone ever remarked on the amount of screen sharing I did or did not use as if that metric mattered, it would just help me not work for them.

If someone is forced to work for someone, it’s extremely easy to game this metric and maintain privacy.

I learned decades ago to assume everything on company property is recorded and stored for ever. That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy.

> That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy.

The problem right now is: due to Work from home, you basically have blurred the lines between the digital company and private assets. Either you have a company device; or even a personal device running this software in your private networks doing and telemetering you don’t know what.

This especially bad for the folks who aren’t able to properly put those devices in a separate subnet and protect themselves.

Or you have both. For example, I have work equipment and personal equipment on my same home desk.

My home network blocks a lot of traffic, but I’d be really surprised if my personal device provided any telemetry to work.

> "due to Work from home, you basically have blurred the lines between the digital company and private assets"

I have a separate work computer and home computer on my desk; the work computer is on a guest wi-fi network and cannot see local traffic. A decent wi-fi router with guest network capabilities is a trivial expense these days.

We just RDP into our in-office machines when we work from home.

From your personal machine? Do you ever check your email via a web interface on your own box? write a quick textfile or document? Log into a web app?

It's really easy to let your work bleed into your personal machine...

Sure, but the threat level of occasionally writing some notes on a personal box is nowhere near what it would be if I was writing code or connecting to production environments from it.

Second laptop. I know it's expensive, but if your working from home, don't do it from your own computer. do it from a computer work provides. Or at least, create a second account called work and do everything from that. Also make the theme, colors and everything you can different so there's a context shift between the two activities.

Same setup, except three laptops: personal, company-provided, client/project-provided.

You would think it would be unmanageable and you'd be right we're it not for Synergy (https://symless.com/synergy). I've got two laptops docked and connected to external monitors. Synergy lets me use just one keyboard and mouse for all three at the same time. Makes it feel like they're just three adjacent screens on one PC. But because they're not I can maintain strict separation between personal and work, and between internal/corporate and client data.

Then, like others have said, I have a fair amount of filtering on the network level.

I’ve thought about this but I assumed it would be too hard to get Synergy installed on employer or client-provided computers. It sounds like you’ve used this setup with multiple clients – is it normal in your field of work to get local admin rights on corporate devices?

https://answers.microsoft.com/en-us/windows/forum/windows_10...

Why not use the First party equivalent? Microsoft's Mouse Without Borders claims to do exactly this.

Because my personal machine runs Linux, my corporate machine runs macOS, and my client machine runs Windows.

If they were all Windows this might be nice as it claims to support some edge cases Synergy doesn't (primarily logon/UAC).

It's not ideal, but you can run the Synergy client executable (synergyc.exe) without admin rights. You lose the conveniences of having it auto-start and using the GUI configuration, but you still get all the functionality. You also can't use the installer, but you can just copy the Synergy directory from a working machine. You also need a MS C++ runtime DLL, but you can copy that too. I'm not in front of my computer at the moment. I'll edit/reply to this comment with details

For example, on my client/project-specific machine (where I don't have admin rights), I have a batch file (start-synergy.bat) that lives on my desktop with:

  C:\Users\jdbernard\Synergy-1.12.0\synergyc.exe -name client-pc 192.168.1.120

I imagine if the work laptop is 24/7 connected to a VPN, then this tool doesn't work.

Depends on the network filtering done by the company.

I have my router setup with port-forwarding for the Synergy protocol. Combined with stable IP addresses internally on my network and dynamic DNS pointing to my home network, I am able to use this tool even when the client machine is on VPN.

Of course, it's important to realize that by doing this you are sending keystrokes across the internet, so it's important to enable the option in Synergy to encrypt the traffic.

We all know Synergy and for basic setups it gets the job done. I paid for the v2 Pro license to support them and will keep doing so.

I have moved over though to using Barrier, a synergy-core fork. You get ssl crypto for free, and it fixes some simple but long standing bugs that really annoyed me. Have only used on Mac + Linux for now.

https://github.com/debauchee/barrier

Good advise - I know people who got fired because all of a sudden during a zoom session on their personal device some content showed up that would not have been on a work computer.

This won't work at most companies of any size, because you need to use a VPN, and the VPN client enforces policies - checking you are using a company machine, that you have their AV installed and updated, that you have their DLP (Data Loss Prevention) installed, that you have their endpoint protection system installed...

But that's a good strategy regardless of Corona, you don't want you kid to download stuff into your work environment or watch NSFW stuff on a work related computer.

I am using a second account, configured differently, like you recommend, as this is the simplest solution.

For even better isolation, a virtual machine could be used, instead of a second computer.

> your working from home, don't do it from your own computer. do it from a computer work provides

Wait, is this something that needs even saying?! Are people relly BYODing personal laptops too? Why? It would not even cross my mind to use personal computer to touch work stuff with ten foot pole.

I wish there was a better solution to this. I tried creating a VM and joining that to the work "services" but HyperV, VirtualBox, etc. all add an audio delay making Teams unusable.

Also tried Barrier and dedicating one monitor to work, but I still can't share/mix the audio so have 2 separate headsets.

I know ideally I'd just use the work computer all the time when "working", but they're VPN-ing all traffic and I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic.

So my plan for the audio problem is to use a set of raspberry pis with USB-gadget stuff enabled to be a webcam & soundcard then running them as a usb device. The webcam is going to be an RTSP feed (with the microphone audio) from the main system to push it through and pulseaudios network side of things to do speaker\headphone out.

it's a bit complex for what i need but it should work well.

> I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic.

Low friction answer to that is a personal smartphone. Bonus points because it works in the office too!

You could buy a small desktop mixer with two sends, so you could connect a microphone to it and choose which computer it will send voice to and also mix sound from both computers.

> separate subnet

Why ? theoretically you have a point, but practically which company would spy on your network ? I totally understand, and agree to some degree, a company protecting its assets and tracking what their employees are doing but it's not the same as putting a general spyware.

It’s not about that I don’t trust my company. I just don’t necessarily trust the software I need to use for a job.

For example if it has some device management software, or some VPN clients or whatnot installed, this increases the attack surface.

Also „leipert“-private might be boring for targeted attacks. But „leipert“-corporate might be interesting, if someone owns my private network OR my work computer, it might have an impact on the other.

> This just makes me choose my employers more carefully as while they certainly have this data to abuse, fortunately few do not.

I think the issue with this approach, which is one that I completely agree with, applaud, and also adhere to is that many people are not as fortunate to be in such a position to turn down employment opportunities.

Those are the people who need protection from "features" such as these, because those are the people who's employers WILL take advantage of them using features.

Here's an example: "'I monitor my staff with software that takes screenshots'" https://www.bbc.com/news/business-54289152

AFAIK legislators in most countries do not agree that this protection is needed.

Employers are not allowed to track you in your private time, in the toilets or putting a camera under you chair, but it is perfectly fine to track your usage of the company's resources and adherence to regulations.

We software engineers are a spoiled kind of employee, but in most traditional work places your time and actions are tracked

>it’s extremely easy to game this metric.

This reminds me how companies used to rate the performance of programmers based on how many lines of code they produced and why so many companies eventually abandoned this model. All it did was incentivize programmers to quickly hammer out superfluous, inefficient, bug ridden code that would just bite them in the ass later rather than concentrating on writing quality code. I think that's all that would end up happening with MS Teams tracking. Once employees figure out the game, they're just going to spend as much time as they can chatting, posting messages and scheduling pointless meetings rather than doing actual work.

> Same for the MITM ssl proxy stuff.

If I logon to my personal banking website while at work, and my employer MITM's that connection to snoop, have they genuinely not broken any law?

It depends on which country you're in.

I'm sure somewhere in the many legal documents you signed to start the job (given to you after you've already resigned from your previous job, of course) you give them the right to do so.

The law is the law: You cannot contract with another party to "allow" either one of you to break the law.

If you're doing it on a company machine, haven't you implicitly given you permission to see that data?

You don't have privacy on company equipment.

"You don't have privacy on company equipment." is true (AFAIK) in USA, but false in a number of other countries e.g. Germany; so this depends on where you live/work.

In general, in Europe you can't contract away most of your privacy rights, so it's not even worth looking at your job contract because you signing "I allow the company to do X" does not necessarily mean that the company is allowed to do X.

Sadly, not in the states I’ve worked. There’s a login banner on work machines letting them see everything.

Fortunately, my org doesn’t actually mitm bank sites.

I tried looking for cases where this was tried and haven’t found any. I would like to see this prosecuted as it seems wrong.

I've often wondered the same thing, but about personal health information and educational information (HIPPA, FERPA). If you intercept that data and store it, transmit it or even just allow real time access to it are you suddenly on the hook for all that those laws require?

I confirmed that at a company town hall once and I asked if that makes that system a hack target. The CISO didn’t seem to understand the vulnerability, as if it were inconceivable that their infrastructure would be targeted to take advantage of their position as mitm.

Obviously it depends on what country you are in, but in a few examples I know of it is perfectly legal for them to do that.

You don't want to be tracked ? use you own device and network.

Admins that read their users email without express instruction from management to dig up and review a particular email should be fired.

Reply on news.ycombinator.com