Hacker News Reader

Comment by fulafel | Hacker News Reader

Not sure "nation states" are that interested or capable on doing this, but corporations actually routinely do this against employees and in some places a major portion of people even find it socially acceptable. (Nation state an interestingly often used term in these discussions btw, by chance it doesn't match the US or UK, which are prominent espionage actors on the world stage)

It involves subverting TLS by just the CA trick you mention, just with a private CA preinstalled in company supplied equipment. Worringly browser vendors seem to turn a blind eye to this, because it's not illegal in some countries. (Government espionage is also often legal but fortunately browser vendors haven't bent over there yet at least publicly)

View on HN

If you're on company-owned equipment during hours the company is paying you to work, why wouldn't it be acceptable? Without such capabilities, people could hide any kind of traffic (from "I'll just check my social media while I'm here" to "I'll just upload some company secrets to my future employer" without recourse.

German corporate culture is functioning without snooping around on employee's emails and chats.

It's strictly forbidden by law and only allowed in very constrained circumstances when the employer has a strong suspicion ("Anfangsverdacht") that the employee is doing things they aren't allowed to. Even then the work council has to be informed and a representative has to be present to ensure no laws will be broken and privacy is preserved.

German work councils are a nightmare for security.

I had to spend time in front of them to literally beg them to let us install an EDR (and heard similar stories from others).

At some point I said fuck it, we will disconnect this country and they will have problems.

This helped me to understand that the work council is the last to fall with people routinely working to there, so they do not care. Also Germany of too big of a country.

The net effect is that some projects do not go there anymore because of the complications.

Note 1: the installation was for security reasons. They had a security problem once and I was calling the work council on daily calls (twice a day) to show them that I can be a pain on the ass as well (it was in the contract we signed with them). Calls were at 8 and 21.

I hope they understood a bit why I was asking for the security measures.

Note 2: I am grateful when they ( and the ones in my country) fight for employees protection. This is great to work in such a country. There is however a moment where they lose content with the reality.

US laws, regulations, and B2B contracts tend to require employee surveillance - sometimes explicitly, sometimes implicitly under risk management - as part of the firm’s duty of care to customers. The customer has given the firm his money, his data, his health, etc. The firm must try to prevent abuse, and must have a forensic trail in case it happens.

In the financial industry, it is strictly forbidden by law to miss reps talking to customers from their homes, on their personal devices and accounts. Banks are in the news getting fined for this routinely.

> In the financial industry, it is strictly forbidden by law to miss reps talking to customers from their homes, on their personal devices and accounts.

But they're not snooping on your personal devices at home, so this wouldn't even catch that.

The point of the fines is banks were negligent in not snooping at home. They are now correcting their behavior and doing so.

Even banks still aren't snooping on people's personal devices at home.

Because working in an environment of trust is way to retain employees. I don't expect people to try and steal secret, most of the time but I do expect them to take a few personal moments throughout the day. If I found that a company was monitoring my network traffic, I'd terminate the relationship.

You are probably smart and aware of the dangers on the internet. There are people that need help keeping their work computers safe from malware and to prevent stuff to happen to them.

I think there is false dichotomy that all monitoring is bad.

Yes if they come to you and nag about browsing hacker news because they found out you are slacking here and there it is totally overstepping.

If company decrypts traffic and has automated scanners to find out/block malware/bad sites I don't see an issue with that.

Sounds like you are from one of those cultures I referenced!

To explain it in plain words: It's not acceptable because I have a human right to privacy.

Yes, privacy allows people to "hide" stuff. It's not an overriding thing. Employment relationships, like rest of our society, are largely based on trust and respect.

Simply don’t use your company owned computer for personal stuff, period. I’ve worked in 1st line support and had my share of people calling in asking for help to erase their browsing history from porn urls. But the bottom line is, do you really want to be the one compromising the company you work for by visiting non-work related things? At least that’s the biggest reason for me to keep my work and private computers separate.

Edit: I just want to add that I however wouldn’t agree with or work for a company that monitors my work computer to make sure I’m always ”working” (taking screenshots, tracking mouse and keyboard etc).

You are indeed entitled to privacy on your own equipment. Why should you be entitled to privacy on employer-owned equipment?

There's no reason why ownership of equipment would have a bearing on my basic rights, just like they have no effect on my enjoyment of other basic legally protected human rights.

I mean, one can have whatever view of rights they choose, but many rights are often considered to be contextual.

E.g., in the US, you have a right to not have your picture taken indoors, but outside in public spaces you don't have this right.

You have a right to do more or less whatever you want with your personal laptop, but your agreement with your employer generally implies that you should only use a work computer for work tasks.

Each of the 50 states, the District of Columbia, and the various territories have different laws on that.

Let’s say I am a farmer who owns a tractor. I provide it to you to work my land. I request that you not use it on your adjacent farm. You agree. Do I have the right to watch where you drive it?

I am not trying to trap you. I am genuinely trying to figure out where the lines are.

For the same reason I'd expect privacy in an employer-owned bathroom.

Interesting. That is a fair point. What if your employer provided you a laptop with two user accounts - one for work and one for personal business?

Are you entitled to privacy on employer-owned toilets?

What exactly do you want to say with this? Are you comparing prevention of stealing intellectual property with taking a shit?

No? I'm responding to the poster implying that we're not entitled to privacy on employer-owned equipment.

Whether you're entitled to it or not, you'd be foolish to expect it.

The last corporate IT job I had, they expected me to use my personal cell phone for job-related tasks. No, I didn't want their malware running on my phone, nor did I want to upgrade to an expensive cellular data plan for the required connectivity. If they wanted me to have a phone for their business, they should provide one.

Management and HR were quite upset. I suggested they check the state Labor Board. Shortly after, I was given a purchase authorization to buy a company phone and service.

If you're worried about theft, hopefully you've disabled Bluetooth and USB because I can move a hell of a lot of data without a network device.

Also, if this is a legit concern, you may have a hiring problem (or you work for .gov or on .gov contracts exclusively.)

It’s not just employees who leak data from corporate devices. Malware often exfiltrates data through compromised, “benign” websites.

Toilets are provided as a convenience by employers to perform entirely personal/non-business functions.

A better an analogy would be a desk phone. Does the employer have the right to record phone calls if an announcement is made to all parties?

Well take another example, you have human right to wear what you want like for example a swimsuit all day long.

Somehow most people understand that swimsuit is appropriate on the beach and on the swimming pool and not in the office.

If I trusted my employees that little I wouldn’t trust them to work for me.

Reply on news.ycombinator.com