Hacker News Reader

Comment by chaps | Hacker News Reader

Once had a contract where my client wanted me to do "security work", which was initially meant to be for pentesting their clients, but it turned into me building their wifi auth system.

At some point in the gig, one of their clients went to them asking them if it was possible to de-anonymize someone glassdoor review since someone still-employed worked with them. They then went to me to see if I could do it for them. They didn't clarifywhy they went to me, but I legitimately think they wanted me to "hack" glassdoor. I told them in no uncertain terms that I wouldn't do it and they backed off.

A bit later they fired the employee.. I didn't hear how they found the person, but it really spoke to the lengths that some organizations will go to burn down the lives of those who speak up.

Use this google search to find more companies that do it:

  "Glassdoor Alert: Employer Legal Action" site:glassdoor.com

  https://www.glassdoor.ca/Reviews/Employee-Review-Media-Consulta-RVW23674692.htm
  https://www.glassdoor.ca/Reviews/Canidae-Reviews-E845482.htm
  https://www.glassdoor.com/Overview/Working-at-Echelon-Environmental-EI_IE1069898.11,32.htm
  https://www.glassdoor.ca/Reviews/Canidae-Reviews-E845482.htm
  https://fr.glassdoor.ca/Pr%C3%A9sentation/Travailler-chez-Echelon-Environmental-EI_IE1069898.16,37.htm
  https://www.glassdoor.ca/Reviews/Employee-Review-BW-Legal-RVW58014087.htm

View on HN

DNS records of your VPN or corporate work station would be pretty easy. You can line then up with when the review was posted. Then investigate their workstation more "thoroughly".

Pretty uncool to give employers ideas on how to force their IT staff to rat out employees who speak out.

Edit: yikes, people.

I'm not for it, I'm just saying - it's trivial. I was in your position, kinda - spent many weeks "searching" but "found nothing". They fired them anyway.

Alternatively, it's a warning to employees on how they might get caught.

Once again for those in the back, never use your employer's equipment or network for anything you don't want them to see!

Insidious problems are things like sync (Google Chrome favourites, Dropbox etc.).

Refer to your work laptop as your “girlfriend”.

(SV reference)

Pretty dumb to talk crap about your employer on said employer's hardware and/or network, regardless of how true it is or not.

Nah that's a pretty obvious way to catch people and any sysadmin knows it. Browser history is a good spot to check too.

Be smart kids. Do your employer bashing at the public library.

Or cool to give employees an understanding that employers aren't their friends and can and will go to extreme lengths to screw them over if it benefits the corporation. Also just general advice to avoid doing things on your company laptop if you don't want your employer to know about them.

That's all fine and dandy and I agree that employees should be informed of these methods. My issue is more with the framing of the post, which clearly doesn't have a cautionary spirit that informs those who'd potentially affected by a vindictive employer. Instead, it's playful curiosity of how to rat out an employee.

Pretty much everyone is carrying around a pocket computer connected to the internet 24/7 with which they can do all their non work related tasks on, including badmouthing their employer.

How many get connected to company WiFi?

They all have the ability to disconnect with a swipe and a tap. Life does not get much easier.

Right, but I'm trying to consider the average user. They likely aren't aware their activity on their phone is being logged on WiFi. My assumption is that once they got it connected to WiFi, it leaves attention and isn't considered

If employees cross streams and use the same device on both the employer's network and off, and they post to Glassdoor off-network with the same device, a subpoena could reveal identifying information to the employer. Glassdoor can also choose to just hand over that information when requested, as well.

This is a good example of why not to do personal stuff on your work machine or work network.

If you care at all if your company would see it, _don't_ do it anywhere near their hardware.

Actually, since Glassdoor's protection can obviously be compromized, anyone posting on their site should do so with Tor Browser, which anonymizes access by routing traffic through a minimum of three relays in the "dark web" of the Tor network. It might also be wise to do this on a public WiFi network (not your own ISP or mobile data provider).

Any email provided to Glassdoor should be a burner on a service that is not one of the majors (no gmail) also set up with Tor browser, specifically for Glassdoor (and used for no other purpose).

Finally, the text that is posted should be somewhat disguised if possible, with altered vocabulary, atypical slang, and distinctly different grammar and sentence structure. Any facts that can reveal identity should be removed.

Under no circumstances should a native Android/iOS app be used to post or access any such review.

It sounds like we will have examples soon of what happens without these precautions.

I imagine that many reviews will be coming off Glassdoor's site rather soon.

Isn't the entire point of glassdoor that people use their work email to prove they actually work for the company?

I believe that’s Blind.

I see.

If it’s a managed corporate laptop that uses Chrome, then they could remotely check the browser history, likely directly to the review itself.

Are you sure this is possible? I thought managed google accounts didn't allow admins to access browsing or any other history.

If they have managed Google accounts they probably have admin on your device as well.

To belay paranoia, this is not always the case.

I manage a company's google workspace, and we don't have managed browsers or devices, and no one has ever asked to have that capability.

Until the first case when an employee sends death threats from your company laptop and you need to provide the data to the police to help in investigation.

Or the first case when some shared credentials get compromised probably from an infected computer and now you need to find which of the 80 laptops is the infected one.

Or the first time employee converts his laptop into a wifi access point for the office girl upstairs and unknowingly lets her inside your companies private network.

Of course, there are workarounds and better practices for every example. You can solve it without admin access to laptops and network request logging. But company property is not anonymous either with or without full admin access - so why jump trough the hoops to not have it?

I am going to guess you don't have any security or compliance folks.

If you sign into a personal Google account on a new Chrome profile on a managed laptop, can they get access to your entire Google account (drive, emails, etc.) remotely? Can they use an auth token or something to automate the process of downloading all your data? If so, is this legal?

> If so, is this legal?

If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game.

Laptops are cheap. There’s no reason to mix personal and corporate usage.

> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game.

From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it.

You might also get a phone call (on your private phone) about a private medical matter while at work, but I would hope your employer couldn't use the CCTV audio they have in the office to decide to fire you based on that information (though I don't know if US laws actually protect workers in this case -- in Australia and basically all of Eastern Europe this would be insanely illegal on several levels).

> Laptops are cheap.

Not for everyone.

If you live in a civilised country, it is illegal.

>From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it.

How often did that stop an employer?

I don't know if this is the case in the US, but in Australia it's very easy (and relatively cheap) to take your employer to tribunal over violations of employment laws (if it was very clear-cut or severe violation you could even make a complaint to the relevant regulator which could launch an action on your behalf). Something being illegal means if they did do it, you'd be owed compensation.

> Not for everyone.

Still cheaper then searching for a new job... without a current one.

Disagree, with the money I would be awarded from my employer for their breaking of both employment and privacy laws I think I could easily purchase a new laptop - and also fund a few months of vacation while searching for the next job.

(This probably doesn't work so well in the US.)

At least in the EU, it's illegal yes - https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...

From the article: The only thing they did wrong was not more explicitly mention the monitoring. So it wasn't illegal to monitor communications, rather it was illegal to fire someone for using their work account for private communication without sufficiently warning them. All they have to do is make you sign some document on day 1 and they're covered. Also they were not awarded any damages or anything, so it's not like you'd get a payday after being fired.

>Commenting on the ruling, Pam Cowburn, the communications director at in London, said: “The European court’s ruling is welcome. In some workplaces, it may be necessary for emails to be monitored, but if employers are going to do so, they should make staff explicitly aware of it.”

>Despite finding that Bărbulescu’s rights under article 8 of the convention had been violated, the court declined to award him any compensation, saying the ruling was “sufficient just satisfaction”.

It's definitely NOT illegal in EU if the user is appropriately informed, usually in your employment contract you sign a clause about that. Even the government does it to their employees.

No, there have been all kinds cases of enforcement action in EU where the user was informed but the employer could not justify the violation of privacy; in general EU law and especially in privacy law it's quite frequent that some explicit "consent" clause in employment contracts (essentially, if it's a standard clause in all agreements and "take it or leave it") is treated as not representing true consent and void.

The largest example probably is the 2020 GDPR fine of 35 million euro for clothing retailer H&M for violating the privacy of their employees, despite the employees being informed of that.

What you're talking about has absolutely nothing to do with tracking usage of workplace computers and networks - H&M kept "excessive" (sic) records of personal data of people who were not their employees at all (family members of their employees) - and the problem wasn't that they had some data because in EU you're required to keep track of families of your employees due to tax reasons, but that they had too much of it.

In most EU countries, tracking company-owned hardware is explicitly okay, and where it's not mentioned in law there are judicates that make it OK.

As I said, even the government and its wholly/partially owned enterprises are doing it, and working as a contractor for the government here requires you to track usage of your employees' workplace computers too, so I can't see how it could be in any way illegal. Same thing with working for banks and insurance, and I bet there are more cases.

In The Netherlands, employees enjoy a reasonable level (much stronger than this scenario) of privacy even on company equipment [1]. That is: the company cannot randomly access an employee's mailbox. Of course, in case of employer-employee dispute, things become hairy - but even then, the company is not allowed to go on a fishing expedition. Though they can go on a confirmation run, looking for specific evidence, e.g. mail from Glassdoor.

Don't know about other EU countries, but at least NL deviates significantly from the sketched scenario.

[1] https://blog.iusmentis.com/2017/11/22/wanneer-mogen-mailbox-...

This is an interesting question post-pandemic where the network the laptop is using may be an employees home network, especially if there is some kind of active scanning involved.

This is a real problem, especially for InfoSec tools. Many EDR tools, such as MS Defender for Endpoint (or whatever it’s called these days) and Crowdstrike Falcon, include functionality that will scan your local network for devices in order to discover unmanaged devices…

It’s a nightmare from a privacy point, but its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network?

> its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network?

Trivially, from the simplistic (check IPs and router MACs / SSID in use) to the marginally more advanced (deploy an agent that is only reachable from the corporate network) to determine if the tool should even be running in the first place.

Every home router should make it easy for people to create separate VLANs for work to protect against this.

VLAN's aren't security. No way to force respecting the protocol.

Tag on the switch port?

Meta data leaks in frames and devices shown not to be reliable on 'respecting' boundaries.

It's really difficult to find solid guidance on how secure that is.

E.g. tag the port on the switch, run a cable to the device so that it doesn't know there's a vlan involved, block routing between vlans. As far as I can tell that's probably good but might not be.

> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game.

In the USA and other countries with subpar privacy laws.

Which countries don’t allow a company to monitor activity on company equipment and company networks during company time?

IIRC Danish law states that work email may be used for private purposes and that anything clearly labeled as private is to be considered such. For example, by moving email to a folder called “private”.

For the employer to open/read such communication would be highly illegal, akin to opening others private snail mail.

I do believe that this also extends to corporate issued phones and computers. Especially since you’re automatically taxed for “private use” of such equipment when assigned.

That doesn’t apply at all here?

> here

I think you need to specify "here" to get an answer to that question.

The thread we are in about companies monitoring people accessing Glassdoor and penalizing them in various ways for using it to say things the company doesn’t consider flattering.

That has nothing to do with putting private email in a private folder on the company mail server, near as I can tell, and nothing in that statement would address the statement about companies monitoring use of company equipment and network etc.

Since they’d need to know even in the private email case what they folder names were, for instance, to know there even WAS private email.

> Especially since you’re automatically taxed for “private use” of such equipment when assigned.

so you get charged a tax when an employer gives you equipment required for work? What happens if you can't afford that tax then?

This feels very wrong - taxing someone for a potential benefit when it is not proven that such benefit exists.

In Israel, if you are assigned an employer car, you generally have to prove you don’t make personal use of it to avoid taxation - e.g. prove it isn’t in use almost every weekend (usually done by parking in a managed lot and showing the receipts or stuff like that).

The vast majority of people prefer to also use the car privately, and pay the tax (which is reasonable, if taxation is reasonable).

Cars that keep rotating between drivers are not subject to that (but exact record keeping of driver and trip required to avoid tax)

Similarly, employer provided phone subscription is assumed to be partly private use (50% of monthly subscription cost considered a a taxable benefit iirc), not sure what hoops you need to jump through to prove it is not private use at all. (But phone plans are cheap - excellent domestic plans are $10 or so)

It's up to you if you want to use company provided equipment for personal/private use or not. If you declare that it's only used for work purposes, there is no tax. The tax makes sense, because it's effectively extra salary (eg if the company gave you a leased car).

> so you get charged a tax when an employer gives you equipment required for work?

Obviously this only happens when the equipment you get can plausibly be used for personal purposes. Such as a company car.

> What happens if you can't afford that tax then?

That's extremely unlikely.

In Germany, you need to document clear and reasonable suspicion of the employee doing something shady before you can monitor them (especially without their consent). It's not fundamentally illegal, but the rights of the employee also weigh in heavily and need to be outweighed before you can start e.g. recording their screen without their consent.

The idea that 'company time' and 'company equipment' gives the company absolute right to record and ownership of recording is almost feudal.

Imagine I were to die in the office in some embarrasing way, on company time, in full view of company CCTV, do they have the right to upload the video to YouTube to make money from it?

What if they record audio of me at home, can they publish it? Can they show it to anyone at the company?

What if audio is recorded outside of compaby time by a company laptop thats had its lid closed? What if it's recording 24/7?

Are they allowed to snoop on traffic of my home network? If I have a home camera thats not password protected, can they help themselves to that Video?

If my network drive has no password, is it okay if they help themselves to those files?

You seem to be building a straw man here?

I assume he is trying to establish a dividing line between acceptable and not. For example, I'd consider all mentioned uses to be unacceptable and hopefully illegal, but I think others may be fine with it.

I an not actually sure that they are illegal - are they?

I can't think of which law stops a company sharing a video of your death - presymably they own the copyright

Just about every EU-based company allows for network defense and visibility to include things like SSL inspection and egress monitoring. Some may consider this surveillance, but what needs to be stated from a governance standpoint is that this monitoring is reasonable from a risk mitigation standpoint and the expectation needs to be written within acceptable usage policy.

Even more restrictive countries like Germany are fine with this.

Most of developed countries except the US.

People have legitimate expectations of privacy in the office and/or during working time.

Employment means selling your skills and effort, not becoming a servant or a slave in a feudal society.

Additionally, having delicate information in the hands of the company in general or sysadm/security engineers create a ton of liabilities.

There has to be a balance between security needs, corporate surveillance, privacy and worker rights.

Practically, the company needs to administer and secure their equipment for a number of reasons, including a legal need to keep their customers data safe.

That requires them to use tools which can easily let them know, for instance, what websites someone is visiting, and what executables are executing on the machine, what devices are being accessed and when, etc.

It’s pretty fundamental. An individual looking to secure their machine would need to do the same thing.

If a company abuses that to spy on every waking moment of an employee, that is obviously abusive (barring cases of investigating legitimate suspected abuse by the employee I guess?). But you’d need to somehow codify in law the line, and I haven’t see anyone having any success here so far.

I have seen employees steal massive amounts of trade secrets, secretly steal customers from employers, run porn sites from company equipment, etc.

I’ve also seen employees so creepy stuff like stalking customers, stalking other employees, harassing other employees using this tech too.

Personally, I’ve always kept employer laptops and stuff closed and off when not used, and try to segregate personal and work equipment, but that’s been more to avoid something embarrassing coming up during a presentation or the like.

Just because it is easy and achieves a purpose doesn't make it necessary or right.

People could be making backhanded deals on their phones or they could be having an urgent confidential conversation with their doctor or spouse. Should the company record and review phone calls?

People could be stalking customers/coworkers or making deals in the bathroom. Or they could be using it for more personal purposes. Should the bathrooms have CCTV with audio?

People could be selling company data in the company parking lot, in the mall or at home near/using the company laptop/phone that is permitted to be used for personal reasons, or just mandated to be near them, or they could do the same thing without presence or use of any company equipment. Where do you draw the line, and at what point is it even sufficient to prevent losing information etc.?

Do you trust your employees? All trust can be abused, yet how can the company function if they don't trust their employees at all?

Correct me if I'm wrong but if the assumption here is that the EU prevents employers from reading private correspondence of employees then I find nothing to back that up. On the contrary, an employer in the EU explicitly seems to have such rights, given they jump through a few formal hoops first:

https://www.grcworldforums.com/business/can-employers-legall...

It depends on the country in question. In Ireland, for example, any workplace surveillance must be necessary, legitimate, and proportional. The employee also must be informed in advance of who, what, how, and when they may be surveilled.

It is very hard to see the Workplace Relations Commission (WRC - the body which handles workplace disputes) accepting that identifying a user on Glassdoor would meet the test of being necessary, legitimate, or proportional. This is particularly true as the WRC has previously found that monitoring internet usage for example for pornography is not proportionate where the employer has the option instead to block such sites and make a policy against their access.

Of course, an unscrupulous employer could also use surreptitious surveillance and find another reason to let the employee go, although firing an employee in Ireland is notoriously difficult short of gross negligence.

OK thanks interesting, although I would like to add that I did not address trying to identify and punish reviewers on Glassdoor, which may or may not be illegal all over Europe depending on the nature of the review. That point I tried to make was that the GP was exaggerating when painting the US as an outlier regarding the rights of employees of not to be monitored.

The US is more "employer-friendly" if you like, and much less complicated to fire employees (boo!) compared to Europe - yes. But generally not categorically different when it comes to the right of employers to snoop on their employees, which people here might want to be aware of.

> The US is more "employer-friendly" if you like

Understatement of the year.

Surprisingly I was at a party in SF with a bunch of Apple employees. Somehow some topic came up and I was like "I don't do anything personal on my company laptop. I especially don't look at porn". All 6 of them said they used their company laptops and phones to look at porn all the time.

Wow

I've heard some pretty simultaneously funny and Orwellian stories about this, mostly about people being fired for looking at porn using work laptops and the specific porn they were looking at.

Don't use work computers to look at porn, your employers already know about it.

Apple generally encourages employees to use their devices as they usually would to “dogfood”.

Some cynicism on the part of their engineers would be prudent despite that advice. Lots of places encourage you to use the company phone as your only phone, which is convenient, but still not a great idea.

My prior employer was the same, I wouldn't use it to make tooling or do anything that might be for my own business, or open source for that matter, they had been known to strong arm staff into giving over IP that might have ever been on that laptop or was ever created during your employment.

But they were quite frank about allowing us to do what ever we want on the laptops providing we delivered positive outcomes for the business.

If this meant the laptops were used to browse porn at home or even during business hours (clearly not on the shop floor if you were in the office) or playing video games, it was fair game.

This employer also had _incredibly_ poor standards and culture for removing misogyny and bigotry, in fact it was one of the worst I've ever seen. Not saying causation = correlation or similar but an interesting data point nonetheless.

It's very common. Most IT groups collect this information for HR and don't do anything with it. The truth is the company doesn't care if you look at porn as long as you do your job. Until the day comes that the company wants to fire you. If you claim retaliation/discrimination/etc, company just opens up your file and lists all the violations.

Once when another person in IT was on vacation, I was handed off a manager's laptop to scan for porn. There was no automated tool, so as I recall I did a search for files created or modified since the last check. I found nothing to report.

I think that the periodic checks were set up because a subordinate of the manager's had seen the porn on the machine, and had gone to HR.

None of my employers pay for Spotify.

I don't want to work somewhere where this would ever be an issue. More than happy to leave if they pull this kind of personal invasion (yeah, it's their property, but still- basic human decency dictates: don't do it).

Your advice is still sound.

>There’s no reason to mix personal and corporate usage.

Exactly! I'm always amazed at people who do ANYTHING personal on corporate resources, especially in this day and age. Even when personal computers were rare and cost thousands of dollars I still didn't do jack shit on work computers, no matter how tempting or "acceptable use" it was.

It will depend on your employee handbook, but generally any data you produce on a company laptop belongs to the company. Anything in the browser cache is fair game.

Not specifically through Chrome (managed chrome does not give your employer access to incognito or personal profile data), but if it's a company owned and issued laptop you should assume they have other ways of capturing all activity on the device.

I have actually done exactly that, copy over the sqlite broswer history sqlite database and run a query to generate a browsing history report.

I understand that this is all technically possible, but how do you feel about the morality of it?

Do you mean Chrome has some special support for this, or is this the same as for any other browser (where the adversary could copy the history db file)?

I run a Tor middle relay on one of the 8 IP addresses I have purchased as a block from a certain ISP that allows you to, I have been for around a year. The amount of traffic passing through it is heavy. Obviously, this comes with certain caveats (the middle relay's, or any TOR relay IPs are publicly available and published weekly on GitHub and as you can imagine, some places like to instant ban anything to do with TOR).

Since it is only 1 of the 8 IP addresses; the other 7 remain free from blockages of any kind and the one running the TOR middle relay is setup in a manner in which I can use it normally (for the most part) and my traffic would just "blend in" with the normal tor traffic passing through it.

You might ask, what is the purpose of this? Well, if it is normal for a lot of TOR middle relay traffic to be passing through one of my IP's on a daily basis, plausible deniability becomes a real defense as checking DNS logs becomes a moot point as there are requests being routed 24/7/365.

Edit: https://hacky.solutions/blog/2020/06/06/operating-a-tor-rela...

This is an excellent, detailed, and in-depth guide of the process of going through running a TOR middle relay. The statistics provided and data presented are simply superb, Great read!

Its a nice setup, but you can’t see any DNS data in the TOR middle relay traffic. Middle relays just pass on encrypted data to the next tor node, not “the Internet”. So any DNS requests hitting outside from your 8 IPs are still all attributable to you.

For any activity in which I do not feel safe and threatened for my Identity, I utilize the middle relay as a full on end-to-end Wireguard VPN itself to route all traffic through a VM I've got specifically built for this.

In addition, there is also this for those that do not want to go through the hassle: https://blog.cloudflare.com/welcome-hidden-resolver/

Cloudflare runs their own DNS Tor resolver.

I understand why websites would ban Tor exit nodes, but what's the point of banning middle relays? Wouldn't those only communicate with either other relays or exit nodes?

Sites that don't want Tor users should only block exit relays, but some will lazily block all relays. It's unfortunate but that is the current state of affairs right now.

'should' from whose perspective though? 'Sites that don't want Tor users' have no incentive to care do they? If anything it stands to reason such a site would block anything and everything to do with Tor, using it as a search term, usernames containing it, anything?

(I don't know much about Tor, so am I missing something about 'middle relays' that such a site would want to allow them?)

Edit: oh is the point that you're not accessing the site using Tor, just from an IP addociated with Tor use?

Exit nodes are the interface between Tor and the "clearnet" (regular internet), whereas relays just relay traffic between Tor nodes (to make it harder to trace the route). So there wouldn't be any Tor traffic from this person's IP going to websites.

Presumably most folks neither know or care about this distinction and just block all Tor related infrastructure outright, since some of the traffic coming through is malicious.

Frankly, as the OP stated, one reason to use a tor relay for direct traffic is to hide your traffic. A bit like a guy in a trench coat and fedora trying to look inconspicuous.

It's not illegal, but it's also not surprising when such folks are escorted out.

Why would an employer looking to fire you care about plausible deniability? Even if your setup worked technically, if the traffic traced back to you then you'd probably find yourself fired under these circumstances regardless.

I think this talk about tracing traffic could well be missing a bigger point. The last time I left a Glassdoor review I had to provide a company email address to do it. This means, although publicly my review was anonymous, Glassdoor knew (and very likely still know[0]) exactly who left it. If they have to hand over email addresses to the company taking legal action there's no need to get clever with traffic tracing.

[0] Even with GDPR and similar legislation all they need is a valid business reason and they can keep my PII.

This. One cannot post anything on Glassdoor today without first establishing an account. Nearly all companies that create accounts use services to “enrich” your user data via the IP, email address, etc. so they grab and keep that data. It is certainly no longer anonymous if it ever was.

> I had to provide a company email address

You mean you had to currently be working there, rather than formerly? I thought this lawsuit was about people who had already left Zuru, but I may have misread the article.

You have plausible deniability but just be careful because the cops can still get a warrant based on IP alone. Also most savvy companies wouldn't say that they're firing you for posting unfavorable reviews, but they'd still terminate you.

DNS over HTTPS would solve that, right? It's an options flag on Firefox.

Barely anyone supports it yet.

in any proper corporate IT , the workstation would already have DLP software which you can use to track Glassdoor use or any other activity ,if you wish

That's why you shouldn't use your work computer for anything but work!

Yes, it's important to separate work you do for your employer from your personal life and everything else basically.

I never understood people who use their work/school machines to do stuff that could hurt their employer/school. Or even just to cause them potential problems.

But of course, the other way around is true imo: I won't use my personal devices for work - but that's mostly to prevent me from giving free extra work time to my employer.

why on earth would someone log onto glass door with their corporate work station? are they a fool?

https://www.glassdoor.com/Reviews/Employee-Review-Kraken-Dig...

https://www.kraken.com/ is doing it too.

This Google shows all the companies listed within Google’s index with the “Glassdoor Alert: Employer Legal Action” flag; just kept removing the companies for the SERPs using the negative search operator until none were left. No idea why Glassdoor doesn’t just have a list of all the companies doing this.

https://www.google.com/search?q=Glassdoor+Alert:+Employer+Le...

"did not match any documents"

Because they removed all the companies, remove the "-company name" paramters from the search.

Manually curated list from parent process:

-Steidle

-legatum

-Medspira

-Media Consulta

-Keller, Fishback & Jackson

-ABG Accessories

-Echelon Environmental

-Admiral Markets

-canidae

-Discovery Clinical Trials

-kraken

-zuru

-bw legal

-kurland

-SynapseFI

This page gives a little context about when they post such warnings:

https://help.glassdoor.com/s/article/Glassdoor-Alerts-Badge-...

Based on the wording on this page you have to be pretty flagrant to get a warning sign attached to your company.

It might be possible to do linguistic analysis (ie. What they did to catch the Unabomber) to compare the language they used in the review vs how someone usually write in things like performance reviews, manager evaluations, emails, etc

Write your review, machine translate it into Mandarin, translate it back to English, and run it through a leet speak text filter

So you have to be a CIA spy to post a workplace review. Nice.

Isn't the final law here New Zealand's law?

No, they get the user information now - before any charge is made in New Zealand to justify providing access to the data.

I know it is cool to shit on the US, but:

   “We are deeply disappointed in the Court’s decision, which was effectively decided under New Zealand law.”

Yeah it was odd finding out this was an NZ decision. I was under the impression that they were a bit ahead of the US on privacy.

> What they did to catch the Unabomber

Have everyone's siblings read all the reviews and see if anyone recognized it?

Exactly. Not sure what to do about only children. Buddy system early on I guess.

And they fire the wrong person. And the real poster adds another review. It can almost be a skit.

- Oct 12, 2022 "They fired Bobby!!! Bobby's been working with us for 10 years and they fired him overnight?? Told you that place is bonkers!"

- Oct 14, 2022 "Mona's down, I repeat Mona's down!! This is a sinking ship! Do not attempt to join this place!!!"

Meanwhile in the C-suite's office.

"Seriously, who is this guy?"

This could happen even if the culprit does get fired - as far as I know, there's nothing preventing you from posting reviews despite no longer being employed by the company.

Most of the time they won't need to go that far. The review itself will usually indicate which department a person's from and what their main gripes are. Sure, this won't work for FAANG or a factory where everyone hates "long hours, low pay" though the text analysis probably won't help much either, but if it's someone from an SME's dev team (n=10), the dev team manager is going to have their suspicions as soon as they see the bullet point about rescinded work from home policies or lack of attention paid to testing deployments...

(the non-trivial possibility they'll get the wrong person isn't going to stop fingers being pointed)

Another query you can use for another kind of alert is "Glassdoor Alert: Inflated Reviews site:glassdoor.com" for companies that were caught trying to fake positive reviews to flood out negative ones.

I had a company do this once after they let me go.

The place was a toxic personality cult around the owner/manager, and I left a Glassdoor review saying as much. Someone at the company found it within a couple months, and then overnight several current employees had posted glowing reviews refuting mine. Certainly we wouldn't expect a personality cult to launch an Internet brigade to protect the boss' ego.

If you experience deliberate techniques* used to erode your sanity inside-outside the company, then no matter the cost, you must make sure it gets public. There is an ongoing epidemic at certain companies where individuals who refuse to become a lapdog on all fours, who reject the brainwashing experiments and who reject the pretend you are stupid and should not excel in your job mantra are forced out.

* psyops: running/scurrying in your periphery

mentioning personal things from your personal/sex life yesterday, but addressed to others

compliment you for bad work, berate for good work

silent treatment

throwing out your performant code and replacing it with trash

employees one after each other, one by one turn against you, trying to give you the impression you are going insane... imagine you talk with someone on a daily basis and then all of a sudden he refuses to interact with you or gives you looks and avoiding you

slamming doors

doing borderline insane things before you, like getting elbow deep in the toilet then smiling at you

pretend face to face that nothing happened

"oldworld" things

etc etc

This oppressive system must be burned down, nuked big time.

> [...] then no matter the cost, you must make sure it gets public.

Is this supposed to be a moral obligation? I'd be careful about putting moral obligations on other people.

Also sounds like they had no idea what they were doing, since instead of missing with the Wi-Fi, SOP would have been to MITM SSL/TLS on the office firewall (trusting company root CA on all company equipment) and log everything.

This is why corporate IT tells you they're moving to zScaler because it's "more secure"...

Reply on news.ycombinator.com