4 ms·

So employees are trying to chat "anonymously" on a tech company's wifi network? Seems remarkably dumb for tech employees. It should be assumed as a given tha

by sfifs 10y ago

So employees are trying to chat "anonymously" on a tech company's wifi network? Seems remarkably dumb for tech employees. It should be assumed as a given that any company or hotel wifi network is monitored and HTTPS is quite possibly is MITMed.

Symbiote 10y ago
An employee's personal phone wouldn't accept the certificate if HTTPS was MITMed.
- RyJones 10y ago
  If the employer uses an MDM as a precondition for email access, it might.
  - throwanem 10y ago
    That's a hard stop for me; no employer may have that degree of control over anything I own. I won't even configure an account with Exchange's protocol, because that enables remote device wipe. If an employer wants to issue me a company phone, that's fine. If an employer wants to enable IMAP, that's fine. Otherwise, I won't have mobile access to email, because the risk is unacceptable. And if that's not fine - well, it's been great talking with you, and I appreciate your time, but I'm afraid this position doesn't seem like a good fit after all.
    - Programmatic 10y ago
      I like seeing more awareness of this! It's always depressing to hear people say that they don't care or that it's not a big deal. There are various third party applications that will allow you to use Exchange protocols without the OS integration: they'll let the Exchange server admins wipe the application's container/data rather than the entire phone. I think it's a much fairer implementation.
      - dboreham 10y ago
        The requirement to agree to honor the remote wipe request is optional at the server. That is to say, you can use the EAS protocol and not also require remote wipe, if you want to. In theory you could also interpose an EAS proxy between your device and the server that pretended to honor the remote wipe request but not not pass it on to the device (unless the server is setup to check client certs). Source : I have implemented this protocol.
      - rrdharan 10y ago
        These days the risk of an accidental wipe seems so trivial to me, since every app (photos, music, notes, docs, podcasts etc) I use is of the local-sync-backed-by-cloud variety. So I guess I can understand not trusting the IT department but I worry very little about losing the data on the device. Of course if you're not sold on the cloud-backed model because of privacy concerns and you prefer treating your device itself as a source of truth and a secure store then I can understand the attitude.
- foepys 10y ago
  You don't really have to MITM, you could just check the logs of the DNS server that the network DHCPs to the WiFi clients for queries to Blind's IP addresses. This doesn't tell you the content but if an employee uses the app. Make of this what you want but given Uber's previous actions I don't think they would just ignore this.
  - lojack 10y ago
    I don't use the app, but messages appear to be timestamped, that's probably enough to deanonymize many conversations.
  - slig 10y ago
    > This doesn't tell you the content but if an employee uses the app It appears that one has to register using a corporate email address, so it's trivial to figure out which employees are using this service.
deleted 10y ago
[deleted]

by sfifs 10y ago

Symbiote 10y ago

An employee's personal phone wouldn't accept the certificate if HTTPS was MITMed.

RyJones 10y ago
If the employer uses an MDM as a precondition for email access, it might.
- throwanem 10y ago
  That's a hard stop for me; no employer may have that degree of control over anything I own. I won't even configure an account with Exchange's protocol, because that enables remote device wipe. If an employer wants to issue me a company phone, that's fine. If an employer wants to enable IMAP, that's fine. Otherwise, I won't have mobile access to email, because the risk is unacceptable. And if that's not fine - well, it's been great talking with you, and I appreciate your time, but I'm afraid this position doesn't seem like a good fit after all.
  - Programmatic 10y ago
    I like seeing more awareness of this! It's always depressing to hear people say that they don't care or that it's not a big deal. There are various third party applications that will allow you to use Exchange protocols without the OS integration: they'll let the Exchange server admins wipe the application's container/data rather than the entire phone. I think it's a much fairer implementation.
    - dboreham 10y ago
      The requirement to agree to honor the remote wipe request is optional at the server. That is to say, you can use the EAS protocol and not also require remote wipe, if you want to. In theory you could also interpose an EAS proxy between your device and the server that pretended to honor the remote wipe request but not not pass it on to the device (unless the server is setup to check client certs). Source : I have implemented this protocol.
    - rrdharan 10y ago
      These days the risk of an accidental wipe seems so trivial to me, since every app (photos, music, notes, docs, podcasts etc) I use is of the local-sync-backed-by-cloud variety. So I guess I can understand not trusting the IT department but I worry very little about losing the data on the device. Of course if you're not sold on the cloud-backed model because of privacy concerns and you prefer treating your device itself as a source of truth and a secure store then I can understand the attitude.
foepys 10y ago
You don't really have to MITM, you could just check the logs of the DNS server that the network DHCPs to the WiFi clients for queries to Blind's IP addresses. This doesn't tell you the content but if an employee uses the app. Make of this what you want but given Uber's previous actions I don't think they would just ignore this.
- lojack 10y ago
  I don't use the app, but messages appear to be timestamped, that's probably enough to deanonymize many conversations.
- slig 10y ago
  > This doesn't tell you the content but if an employee uses the app It appears that one has to register using a corporate email address, so it's trivial to figure out which employees are using this service.

deleted 10y ago

[deleted]