4 ms·

I don't work in the public sector but I'm curious, how does one protect their browsing habits on a work computer? I see there are a lot of cases of personal co

by navs 10y ago

I don't work in the public sector but I'm curious, how does one protect their browsing habits on a work computer? I see there are a lot of cases of personal computer usage. While browsing 'sexually explicit' material at work is just plain stupid, I know I'm guilty of logging into my personal e-mail or browsing Hacker News' latest.

pjc50 10y ago
Firstly, check your policy. Then check whether it's actually enforced. Ask around. See if other people are routinely personally browsing. If the admins are serious about it, they're monitoring you at the firewall. Or snooping your screen. Just don't mess with this. Comply with the policy or browse on your phone instead. If there's no real enforcement, then the policy is a figleaf. If someone is abusing it and someone complains, it will be used against them. If you're handling actual personal confidential or classified material on your computer, be very careful. If it gets compromised and traced back to an infection on your PC then the policy may be used against you there too. Try not to do personal business on your work email, even in Europe this is not legally protected: http://www.eversheds.com/global/en/what/publications/shownews.page?News=en/ireland/personal-emails-at-work-have-employers-more-access http://www.eversheds.com/global/en/what/publications/shownew... BYOD tends to erase the "work/personal" distinction, so watch out for other policies that try to enforce it. It may not be worth BYOD.
- wil421 10y ago
  My company's policy is you are allowed light personal browsing. I'm not sure what light is but I've never heard of anyone getting in trouble. They may only look at it if they need a reason to fire you.
- webmaven 10y ago
  A few tips: Figure out whether you can clear your browser's cache and history, also find or figure out IT's strategy for desktop backups. Also find or figure out what sort of network monitoring is in place, and where. If you're a developer, consider places you can shoehorn a plausibly deniable proxy or VPN so monitoring at the network egress for example doesn't trace directly back to your desktop IP address.
  - pjc50 10y ago
    I don't see cache and history as too important, incognito mode will help with those. But there are other forms of monitoring - e.g. antivirus gets to look at all your browsing and potentially log it. > shoehorn a plausibly deniable proxy or VPN This I think is a bad idea, because it greatly increases the severity of getting caught. It serves as evidence that you knew what you were doing was not allowed and took steps to hide it. The whole idea of "taking steps to hide" activity at work is fundamentally doomed, because taking steps to frustrate the enforcement of a policy is itself against policy. Especially if you're in a legal environment with few employment rights.
    - webmaven 10y ago
      > This I think is a bad idea, because it greatly increases the severity of getting caught. The threat assessment and risk mitigation is of course very context dependent. There is usually a trade-off between the risk of getting caught and the severity of consequences if caught. One approach to getting a proxy officially "blessed" is to sell management on a proxy for the use of execs as an obscuring measure to "foil attempts at doing traffic analysis on their web use", should an intruder gain access to the network, which proxy then happens to be available for anyone "in the know" to use. This pitch may be particularly effective if one or more of the execs use Ashley Madison. ;-)
knz 10y ago
Turn on an external VPN or switch to a personal hotspot during your breaks. Hacker News could probably be considered industry related so I'm not sure casual browsing is any worse than reading other IT media assuming reasonable consumption habits.
- webmaven 10y ago
  > Hacker News could probably be considered industry related Depends on your industry. Anecdotally, I have had some difficulty justifying getting HN (as well as a bunch of other sites like StackOverflow) unblocked when working IT in the public sector a few years back.
  - navs 10y ago
    Was that a bureaucracy problem or did the powers that be not consider HN and SO appropriate?
    - webmaven 10y ago
      A bit of both. Both were on some screwed-up blacklist, 1st attempts to get them whitelisted ran into comprehension problems due to the words "hacker" and "stack overflow", subsequent attempts ran into difficulty that I couldn't identify a vendor associated with the sites, and only after that was I able to tackle the cultural issue of discussion/Q&A sites being important resources (it helped that both sites came up on the 1st page of results for queries that were directly relevant to tasks I had been assigned).
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
sailfast 10y ago
There are no protections. Your activity is effectively public. By policy at the Federal level you are typically allowed an amount of browsing that does not cause undue burden to the network / taxpayer. Practically, this is not rigorously enforced unless the site is explicit or taking your network down (or causing security problems). Most agencies are Ok with a bit of casual browsing / Facebook (et al) / news stuff and have policies to that effect but if you are concerned about privacy then you're out of luck and there's a nice monitoring statement on each login to that effect. Keep personal stuff segregated completely if you're concerned about it.

by navs 10y ago

pjc50 10y ago

Firstly, check your policy. Then check whether it's actually enforced. Ask around. See if other people are routinely personally browsing. If the admins are serious about it, they're monitoring you at the firewall. Or snooping your screen. Just don't mess with this. Comply with the policy or browse on your phone instead. If there's no real enforcement, then the policy is a figleaf. If someone is abusing it and someone complains, it will be used against them. If you're handling actual personal confidential or classified material on your computer, be very careful. If it gets compromised and traced back to an infection on your PC then the policy may be used against you there too. Try not to do personal business on your work email, even in Europe this is not legally protected: http://www.eversheds.com/global/en/what/publications/shownews.page?News=en/ireland/personal-emails-at-work-have-employers-more-access http://www.eversheds.com/global/en/what/publications/shownew... BYOD tends to erase the "work/personal" distinction, so watch out for other policies that try to enforce it. It may not be worth BYOD.

wil421 10y ago
My company's policy is you are allowed light personal browsing. I'm not sure what light is but I've never heard of anyone getting in trouble. They may only look at it if they need a reason to fire you.
webmaven 10y ago
A few tips: Figure out whether you can clear your browser's cache and history, also find or figure out IT's strategy for desktop backups. Also find or figure out what sort of network monitoring is in place, and where. If you're a developer, consider places you can shoehorn a plausibly deniable proxy or VPN so monitoring at the network egress for example doesn't trace directly back to your desktop IP address.
- pjc50 10y ago
  I don't see cache and history as too important, incognito mode will help with those. But there are other forms of monitoring - e.g. antivirus gets to look at all your browsing and potentially log it. > shoehorn a plausibly deniable proxy or VPN This I think is a bad idea, because it greatly increases the severity of getting caught. It serves as evidence that you knew what you were doing was not allowed and took steps to hide it. The whole idea of "taking steps to hide" activity at work is fundamentally doomed, because taking steps to frustrate the enforcement of a policy is itself against policy. Especially if you're in a legal environment with few employment rights.
  - webmaven 10y ago
    > This I think is a bad idea, because it greatly increases the severity of getting caught. The threat assessment and risk mitigation is of course very context dependent. There is usually a trade-off between the risk of getting caught and the severity of consequences if caught. One approach to getting a proxy officially "blessed" is to sell management on a proxy for the use of execs as an obscuring measure to "foil attempts at doing traffic analysis on their web use", should an intruder gain access to the network, which proxy then happens to be available for anyone "in the know" to use. This pitch may be particularly effective if one or more of the execs use Ashley Madison. ;-)

knz 10y ago

Turn on an external VPN or switch to a personal hotspot during your breaks. Hacker News could probably be considered industry related so I'm not sure casual browsing is any worse than reading other IT media assuming reasonable consumption habits.

webmaven 10y ago
> Hacker News could probably be considered industry related Depends on your industry. Anecdotally, I have had some difficulty justifying getting HN (as well as a bunch of other sites like StackOverflow) unblocked when working IT in the public sector a few years back.
- navs 10y ago
  Was that a bureaucracy problem or did the powers that be not consider HN and SO appropriate?
  - webmaven 10y ago
    A bit of both. Both were on some screwed-up blacklist, 1st attempts to get them whitelisted ran into comprehension problems due to the words "hacker" and "stack overflow", subsequent attempts ran into difficulty that I couldn't identify a vendor associated with the sites, and only after that was I able to tackle the cultural issue of discussion/Q&A sites being important resources (it helped that both sites came up on the 1st page of results for queries that were directly relevant to tasks I had been assigned).

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

sailfast 10y ago

There are no protections. Your activity is effectively public. By policy at the Federal level you are typically allowed an amount of browsing that does not cause undue burden to the network / taxpayer. Practically, this is not rigorously enforced unless the site is explicit or taking your network down (or causing security problems). Most agencies are Ok with a bit of casual browsing / Facebook (et al) / news stuff and have policies to that effect but if you are concerned about privacy then you're out of luck and there's a nice monitoring statement on each login to that effect. Keep personal stuff segregated completely if you're concerned about it.