Hacker News Reader

Comment by grecy | Hacker News Reader

> Same for the MITM ssl proxy stuff.

If I logon to my personal banking website while at work, and my employer MITM's that connection to snoop, have they genuinely not broken any law?

View on HN

I've often wondered the same thing, but about personal health information and educational information (HIPPA, FERPA). If you intercept that data and store it, transmit it or even just allow real time access to it are you suddenly on the hook for all that those laws require?

I confirmed that at a company town hall once and I asked if that makes that system a hack target. The CISO didn’t seem to understand the vulnerability, as if it were inconceivable that their infrastructure would be targeted to take advantage of their position as mitm.

I'm sure somewhere in the many legal documents you signed to start the job (given to you after you've already resigned from your previous job, of course) you give them the right to do so.

The law is the law: You cannot contract with another party to "allow" either one of you to break the law.

Sadly, not in the states I’ve worked. There’s a login banner on work machines letting them see everything.

Fortunately, my org doesn’t actually mitm bank sites.

I tried looking for cases where this was tried and haven’t found any. I would like to see this prosecuted as it seems wrong.

If you're doing it on a company machine, haven't you implicitly given you permission to see that data?

You don't have privacy on company equipment.

"You don't have privacy on company equipment." is true (AFAIK) in USA, but false in a number of other countries e.g. Germany; so this depends on where you live/work.

In general, in Europe you can't contract away most of your privacy rights, so it's not even worth looking at your job contract because you signing "I allow the company to do X" does not necessarily mean that the company is allowed to do X.

It depends on which country you're in.

Obviously it depends on what country you are in, but in a few examples I know of it is perfectly legal for them to do that.

You don't want to be tracked ? use you own device and network.

Reply on news.ycombinator.com