Hacker News Reader

Comment by Volundr | Hacker News Reader

The right move here would have been to have separate work/personal computers so that this PDF never landed on a system with access to the Ronin network.

I know I'm pushing a boulder uphill with that one but it really is the way to go, better for both the individual and the company.

View on HN

I'm in this camp. All employees should be sent a laptop, or work with a remote environment that is isolated from your personal computer.

what would stop a developer from checking personal email on a work machine?

Or more to the point, what would stop someone from sending malicious documents to the employees' work emails?

Figure out a company uses <some-saas> register a phishing domain (e.g. gith.ub) send them an email with important info about their account, and a PDF attachment with more details.

If it's that easy to compromise a system all you have to do is get a few employees to open the PDF right?

And this is exactly why your IT department sends out those simulated phishing emails everyone likes to complain about.

Themselves. I'm saying developers (and employees in general) should not do any personal stuff on work machines or any work stuff on personal machines.

This has benefits for the employee, not just the company, in that it keeps the employees personal data out of the hands of the IT department.

Exactly. I was on a meeting a couple of years ago and the co-worker who was presenting his desktop received a personal iMessage that flashed for everyone to see.

yeah but that's solved by disabling notifications before presenting.

True, but that’s just one of several reasons I’m reluctant to share work and personal activity on a single computer. I certainly wouldn’t conduct a job search on a work computer.

It makes it a bit harder to travel with two laptops, which is one of the nice advantages of working from home.. but I'm otherwise in support of this.

This might just result in employees finding ways to remote access their work computer from their personal computer from wherever they are, but at least that's an additional wall for would-be attackers to hurdle.

Nahhhhh, I gotta browse the internet to be effective. That requires me logging into random sites with personal logins.

I don't install anything personal on my work computer, but I wouldn't hesitate to open an email or pdf from a seemingly trusted source. I don't really blame the dev here.

What you propose is a reasonable solution, but I feel like it slams in the face of actual human behavior. Most people act the way I describe, even most tech professionals.

I work in conjunction with this segment of the industry. You can do it, but don't be surprised when you can't recover anything in a termination suit.

So then the attackers can only get my bank password?

I think the clear move here should be to avoid pdf, just like the move is to avoid doc

The right move would be to have separate work / production computers, where the production system requires 2FA, and the finanical production system requres 3FA.

Reply on news.ycombinator.com