• jet@hackertalks.com
    English
    931·
    11 个月前

    Everybody has a cell phone nowadays. There’s no excuse not to use your cell phone for private stuff. In fact don’t use the company Wi-Fi. You must use the company Wi-Fi then you must use a VPN

    But no excuse anymore not to use your phone, you don’t need to use the word computer to browse, send emails, flirt, whatever

    • 9488fcea02a9@sh.itjust.works
      41·
      11 个月前

      All of my colleagues have work provided phones and laptops. They do all their personal shit on these devices (they don’t have their own)

      They think i’m a huge weirdo for having my own personal devices… “Why waste money? Work gives us computer/phone… Lol, yoi carry two phones like a drug dealer?”

        • 9488fcea02a9@sh.itjust.works
          6·
          11 个月前

          IT: “You’ve been fired. Please return your laptop…”

          “But how do i retrieve all my personal files?”

          IT: [Shrug emoji]

          • EmbeddedEntropy@lemmy.mlEnglish
            1·
            11 个月前

            Like IT gives you any time to get anything off a corporate-owned device.

            When I got laid off, IT sent a bullet to my laptop immediately kicking me off and completely locking me out of it.

            I was supposed to have another 4 days to transition my work. I contacted IT and was told once the bullet goes out, that’s it. Any and all access to everything has been terminated. Might as well just go home and enjoy the extra 4 days because no one’s going to undo a bullet going off early unless it comes from the C-suite. So I did.

      • monobot@lemmy.ml
        91·
        11 个月前

        Just tell them “I don’t want to spend company’s resources for my own private life.”

        The only way is to give them back that guilt and fear they are feeling.

      • Yarmin@sopuli.xyz
        5·
        11 个月前

        it’s one thing if they pay for them but if they are actually company devices that’s fucking weird

      • JokeDeity@lemm.ee
        3·
        11 个月前

        WTF? What country? Even at jobs where I was given a phone no one felt like ditching their personal devices.

      • jet@hackertalks.com
        English
        5·
        11 个月前

        I mean if your personal device is attached to a work network use a always on personal VPN.

        If you can’t for whatever reason then don’t connect to the wifi!

  • PeachMan@lemmy.one
    504·
    11 个月前

    Of course they can, they literally own the machine. You don’t own it, so don’t treat it like it’s your own private job hunting platform or porn viewer.

    • jmp242@sopuli.xyz
      15·
      11 个月前

      Yea, this regular “surprise” that work computers are… IDK… owned by work and are configured as the owner requires… is so strange to me.

      • linoor@beehaw.org
        3·
        11 个月前

        If I remember correctly you have to pay extra to be able to access private messages. Maybe you didn’t have this option enabled?

      • SokathHisEyesOpen@lemmy.mlEnglish
        31·
        11 个月前

        They can see it. I know because someone had an HR investigation happening and they showed me screenshots of his Slack conversations.

        • library_napper@monyet.cc
          4·
          11 个月前

          If it was a screenshot then they didn’t get it from slack. They have spyware that takes screenshots.

          Obviously if they install malware that records keystrokes or the screen then they can see what you type and what’s on your screen.

          But slack doesn’t let admins export private chats

          • SokathHisEyesOpen@lemmy.mlEnglish
            1·
            11 个月前

            Then they must have been able to capture his whole screen. Idk how they’d do that days later, but they had a screenshot of a private conversation in slack. Maybe he had already set off some flags before then and they were watching him or something.

  • regalia@literature.cafe
    332·
    11 个月前

    Until you get asked by HR why you’re breaking their policies by clearing history and why you’re doing it. If it’s a work device that’s not yours, don’t expect privacy. It’s their property.

    • skookumasfrig@sopuli.xyzEnglish
      13·
      11 个月前

      They don’t need the computer to see everywhere you’ve gone. I’ve never heard of anyone getting in trouble for clearing their history, but lots of people who have had problems visiting questionable sites.

      • regalia@literature.cafe
        3·
        11 个月前

        You underestimate just how dumb some corporate policies are lol. Even if you are completely right.

    • shalva97@lemmy.sdfeu.org
      3·
      11 个月前

      When I turn on my pc I get a prompt saying “this computer is managed by your organization, expect no privacy”

      • regalia@literature.cafe
        6·
        11 个月前

        I have a very hard time believing that lol. Doesn’t matter what country, it’s still the companies property, and the work you’re doing in it is still considered their property. It’s not a personal device. What a pretentious statement.

        • CrazedLumberjack@lemmy.z0r.co
          English
          11·
          11 个月前

          In Canada employees may have a limited expectation of privacy on work computers.

          Quoting from this article, which references the same supreme court case as the above article:

          Mr. Justice Fish, writing for the majority of the Supreme Court, delineated the following instructive principles:

          • Whether at home or in the workplace, computers are reasonably used for personal purpose and contain information that is meaningful, intimate and touching on the user’s biographical core;
          • The user may reasonably expect privacy in the information contained on their computer particularly where personal use is permitted or reasonably expected;
          • While ownership of the computer and workplace policies are relevant considerations, neither is determinative of a person’s reasonable expectation of privacy;
          • The totality of all the circumstances will need to be considered to determine whether privacy is a reasonable expectation in any particular case;
          • Workplace policies and practices may diminish an individual’s expectation of privacy in a work computer; however they may not in themselves remove the expectation entirely;
          • A reasonable, though diminished expectation of privacy, is nonetheless a reasonable expectation of privacy, protected by s. 8 of the Charter and subject only to state intrusion under the authority of a reasonable law.
          • regalia@literature.cafe
            3·
            11 个月前

            Accidentally deleted my post lol, but the court case ultimately ruled for the company, and that these laws aren’t very strong to begin with.

            It is recommended that employers should implement clear policies that define, in unequivocal terms, the employer’s expectations surrounding workplace computer use, including smartphone use, if employers provide such equipment to employees in an employment context. Although Fish J., in R. v. Cole, stated that workplace policies are not determinative of a person’s reasonable expectation of privacy, if properly drafted a workplace policy combined with consistent employer actions in the workplace, may diminish, objectively, the employee’s reasonable expectation of privacy. For example, where both the employer’s workplace policy and the employer’s actions in the workplace are consistent in prohibiting any personal use by employees of employer-issued computers or smartphones and where the employee has acknowledge receipt of employer’s policy that provides that any data sent, stored or received using the employer’s computer or smartphone is the property of the employer and the employer reserves the right to perform random checks or audits of the employee’s computer or smartphone use, the employee may be hard pressed to argue that he or she has a reasonable expectation of privacy.

            And the article you linked still suggests it’s a bad idea to assume privacy.

            While it may be tempting to use an instant chat application for workplace gossip, it is best to follow the golden rule: if you wouldn’t share it with your boss voluntarily, it’s probably best saved for a face-to-face conversation.

            This is more so to protect employees who are browsing facebook or something on a personal computer, that the employeer isn’t then allowed to snoop on their private social media accounts. For work related stuff, the rule still applies that it’s work property.

      • VolunTerry@monero.townEnglish
        2·
        11 个月前

        Unfortunately, words on paper frequently fail to prevent organizations, public of private, from doing things they are technically not allowed to do. See the security state apparatus of any of the nations around the world including the 5, 9 and 14 eyes, or any number of tech companies that claim and market privacy respective policies only for people to uncover later that what they pitch publicly diverges in spirit from what they do or what is in the actual terms of service.

        Hopefully if people find their employer going outside the bounds of the contract they can catch it, catalog it and hold them to account. Accountability can often be tricky and costly though.

    • Case@unilem.orgEnglish
      2·
      11 个月前

      Sadly this.

      Any personal matters I may have attended to during work hours were done on a personal device, through a VPN, preferably borrowing some other WiFi signal than one run by any company I work for.

      If its even more personal, just drop WiFi I don’t control all together. Either use the phones data plan for 10 minutes, or tether it to a computer and do the same.

  • stevedidwhat_infosec@infosec.pub
    311·
    11 个月前

    I work in cybersec - I’m not going to speak for all businesses or individuals but I will give you my perspective.

    Sometimes we need to see browser history to help with timeline correlation, it’s mainly to see “how did this file get here, was it downloaded etc.

    Sometimes the investigators need to check out the things they need to check out, BUT

    BUT

    It needs to be done precisely and sparingly where needed only. This means instead of going through the entire history file, or doing unrelated correlation work (spying on you without cause) you are going to only grab specific timeframes from things you suspect explicitly to prevent any overreach. It’s a tricky balance to hold but also why it’s so important for people in tech to be privacy advocates as well.

    There’s a difference between searching for answers to a problem that arose and looking for/predicting problems (thought crime detected!)

    • The Bard in Green@lemmy.starlightkel.xyz
      11·
      11 个月前

      I also work in cybersecurity. Second everything this person said.

      This thread is a good reminder, because at many organizations HR / management can and will look at your browser history (and computer activity in general) as a method of monitoring performance and staying in control.

      But at my organization, we have never once looked at anyone’s browser history (and I know that HR hasn’t because they would have to go through us). We certainly could if we were asked to and we would if there was an incident (what we would care about is sensitive / confidential information getting leaked or suspicious activity on the network using a specific person’s credentials, suggesting those credentials may be compromised). But in almost 2 years (we’re a startup in the aerospace electronics sector) we have never once had cause to do that and we have a philosophy that happy relaxed employees who feel trusted by their employer are the kinds of employees that we want, so we wouldn’t intrude that way without cause ever.

      • edric@lemm.ee
        6·
        11 个月前

        I third(?) this. Security and IT teams are too busy to be monitoring your everyday habits. Sure, they can see your history if they wanted to, but they won’t unless there is an appropriate justification to do so, and it’s usually triggered by an incident or HR. There also stricit rules with doing so because employees still have the right to their own privacy. It’s not like HR can just go over to the security guy and ask them to pull someone’s browsing history.

    • _MusicJunkie@beehaw.org
      4·
      11 个月前

      Same for our company, and all companies whose security folks I’ve had a chat with. We don’t give a fuck what you do on your computer. Almost all security folks are into privacy themselves, additionally to simply not having the time to look at people’s browser history or traffic or whatever.

      Yes, we have the option to collect data. No, we don’t look at it unless there is a very good reason to do so. And we protect that data, HR or whoever can’t just have it if they feel like taking a look. There is a process to protect the data, because that means protecting the company.

      Your security team is not the enemy.

  • rah@feddit.uk
    333·
    11 个月前

    your work sees all your browser history

    Possibly, if they’ve bothered to configure their machines that way. And only on the browsers they’ve configured that way and only on their machines.

    Also, please don’t assume that your work operates the same way as everyone else’s work.

  • UsernameLost@lemmy.mlEnglish
    22·
    11 个月前

    Oh no, my employer might find out I’m looking for other jobs after being overloaded for a year and a half and constantly having my concerns/feedback/process improvement initiatives brushed aside.

    • Chaotic Entropy@feddit.uk
      7·
      11 个月前

      I have been hinting to my manager for 6-9 months that he needs to move part of my workload elsewhere so that I can focus and actually achieve something. To think, all it took was for me to tell him straight that I was unhappy and unfulfilled to the point that I was considering resigning. Suddenly he’s all apologies and let’s make changes because you’re kind of vital and we don’t want to lose you.

      • PopularUsername@lemmy.sdf.org
        7·
        11 个月前

        And I was fired for it. Depends on the market demand I suppose, some industries there is no denying your worth, in others you’re disposable.

        • maynarkh@feddit.nl
          1·
          11 个月前

          I love the fact that firing me what the person you’re answering mentioned is illegal here.

          Peace of mind.

  • angelsomething@lemmy.one
    17·
    11 个月前

    I’m an infrastructure analyst and at my workplace I implement such rules for specific reasons: 1) we need to be able to have evidence should an employee act maliciously with a company device. We do also monitor all queries but it’s passive. We can drill into your browsing history in great detail but won’t unless we have to (speaking personally here as I follow the code). 2) people will do dumb shit. And will lie to get support. Now, having been on the other end of a support ticket, I get it. Unless you lie a little, you may not get support promptly. Therefore, it’s part of my job to check what’s the lie and what’s the actual issue, which includes being able to see the download history. I would not be surprised if malware is accidentally downloaded and then it autonomously removes itself from the download history as It has happened before. Strictly speaking, this is done for both your safety as well as that of the company. And generally speaking, you should NEVER use your work laptop/phone/iPad for personal use because of all of the above.

    • 1984@lemmy.today
      38·
      11 个月前

      I use my personal laptop at work, no issues. Employer can’t see what I’m doing which is the way it should be.

      If they don’t trust me, don’t hire me then.

      I would never work anywhere where people like you can watch what I’m doing. Luckily I’m in IT so I choose where I work.

      I despise companies who don’t give employees privacy. The reasons you gave means nothing. You can always argue for anything to protect the company. Who protects the employees?

      Safest for the company would be if you have employees in small cells being watched by guards around the clock. That would be really good for the company.

      • Darkassassin07@lemmy.caEnglish
        5·
        11 个月前

        If you’ve connected your personal laptop to your work wifi, they 100% can see all your browsing history (specifically whats passed through their network).

        Hell, I only run a simple homelab and I can see the exact traffic/browsing history of every device on my home network. I’m only tracking via dns traffic, but your https traffic can even be intercepted and decrypted pretty easily. So don’t even trust that.

        This doesn’t require installing anything on your device to fully monitor you.

        • angelsomething@lemmy.one
          2·
          11 个月前

          You’re not wrong. It really comes down to how ethical the IT/company is. And we are, purposely so. Also we have dns-over-https and No other identifier is parsed through. So we can see and block someone browsing porn on the guest Wi-Fi, but we’d never know who it was. Look, I’m not saying things are perfect, but there are people like me who look out for both the user and the company. The goal is ensure that users privacy is respected and that the company is protected agains misuse, malicious intent or just plain bad-luck. This is the “code” I was referring to. As IT people we have to behave ethically for business we operate in. It’s not perfect but nobody is trying to be. This is all best effort from all parties.

          • 1984@lemmy.today
            01·
            11 个月前

            Your ethics goes out the window when being told to do something by your employer.

            Maybe you try to look out for the user, but it’s completely wrong that employees should have to trust you to do that.

            “Company being protected from misuse” is a blanket term for survellience, same as “fighting terrorism”.

            I still stand by my opinion. Companies need to trust employees and not run survellience programs against them. It’s just wrong.

        • 1984@lemmy.today
          01·
          11 个月前

          Sure but I work from home. Don’t use their wifi except when I’m in the office. I could connect to a VPN and they would also see a connection to a VPN, but I don’t care enough to do that.

          But when I’m at home, working on my computer, they don’t see anything.

      • angelsomething@lemmy.one
        31·
        11 个月前

        I hear you, and fully get where you’re coming from. I work in the finance industry and we have auditors to answer to as well as a ridiculous number of compliance regulations we have to abide by. Not every business is the same. I’m personally on the no-trust policy when you have more than 50 users to manage but it also depend on company policy. No one is saying you can’t use your personal device at work. We don’t monitor the guest Wi-Fi in any way specifically because that would be an invasion of privacy. I was referring specifically to using a work device, managed by the business, for personal use. The employee is protected by being briefed during first day induction of he does and don’t with regards to the equipment that is provided to them to do their job. Their personal privacy is not infringed upon as there is a clear agreement about what is expected from them. By the way, I’m in the uk (not sure if relevant).

  • Echo Dot@feddit.uk
    14·
    11 个月前

    So only watch mainstream porn on work computers, got it.

    I’ve always assumed work will be looking at the browser history. Anyone who assumes they won’t is an idiot.

  • N-E-N@lemmy.ca
    9·
    11 个月前

    Anyone know exactly what they could see if you’re on a personal device but work-wifi?

    • freundTech@feddit.de
      161·
      11 个月前

      Usually the websites and apps you use, but not what specific page you visit and it’s content.

      If you for example visit https://en.wikipedia.org/wiki/Labor_unions_in_the_United_States they could see that you visited https://en.wikipedia.org/ but nothing more.

      This is assuming that the website is encrypted (it starts with https://, not http://), which nowadays luckily most websites are. Otherwise they can see the specific page, it’s content and most likely also all information you input on that page.

      • henfredemars@infosec.pubEnglish
        9·
        11 个月前

        My work runs MITM with corporate certificates, so they can see everything no matter whether it’s encrypted or not. If you don’t accept the certificates to let them monitor, you can’t browse.

        Therefore, I just don’t use it.

        • Pixel@lemmy.sdf.org
          2·
          11 个月前

          Is that for the VPN, or actually all wifi connections? Not sure how it would be possible for wifi

          • Darkassassin07@lemmy.caEnglish
            6·
            11 个月前

            Corporate networks (especially those utilizing MITM) block vpn access altogether.

            You can’t reach your vpn server, falling back to plain un-tunneled https. Then instead of dns retuning the true ip, it returns a local corporate ip; you connect to that with https and it serves you a cert generated on the fly for that particular domain signed by a root cert your browser already trusts. Your browser sees nothing wrong and transmits via that compromised connection.

            You can usually check for this by connecting via mobile data, taking a screenshot of the cert details, then doing the same on work wifi and compare.

            If the cert details change on wifi, your traffic is being intercepted, decrypted, read/logged, then re-encrypted and passed to the server you’re trying to reach.

            • Pixel@lemmy.sdf.org
              0·
              11 个月前

              I was talking about work VPN, the thing I connect to every morning to access work’s internal services.

              I don’t see how a 3rd party device connecting to wifi can have https MITM. Otherwise many wifi out there would do it and steal your info.

                • Pixel@lemmy.sdf.org
                  0·
                  11 个月前

                  Can you link to something with more info on how it works? I know how certs work and CAs but not how some random wifi network can hijack that whole trust system. It sounds like it would defeat the whole purpose of https. Thanks in advance.

    • Trono@reddthat.com
      52·
      11 个月前

      Every URL visited minimum unless you are going to an encrypted VPN outside their network first, then they will still see the network traffic to that vpn . I Know someone that got caught redditing on work wifi. granted they also had their device name set to use their name in it… so some of that is on them

        • andrew@lemmy.stuart.funEnglish
          1·
          11 个月前

          That’ll also depend on whether you’re on a personal device that’s using DoH (DNS over HTTPS). Which most phones do by default now. If you haven’t disabled that then they’ll only know IP addresses which are often not actually owned by or even unique to specific websites these days.

    • GrappleHat@lemmy.mlEnglish
      3·
      11 个月前

      I’m on Ubuntu at work! The only employee on Linux at a tech company of >150 people! (Where are my Linux nerds?)

    • Honytawk@lemmy.zip
      53·
      11 个月前

      Kind of yeah, the rest of the working world uses Windows for good reasons.

        • rog@lemmy.one
          01·
          11 个月前

          Legacy software with incredible backwards compatibility, exponetially more software options, user familiarity, pretty much everything that active directory provides from user management to group policies, the list goes on.

          Im a linux guy, but the thought of rolling out even the most user friendly linux distro gives me nightmares.

    • Zink@programming.dev
      0·
      11 个月前

      I’m in a company that uses Microsoft stuff, but I use a lot of fedora and Linux mint in VMs. The latter is based off Ubuntu at least!

      It’s actually kind of nice to be able to save the state of my VM since forced restarts are so infrequent.