2 ms·

But it's far worse than that. Look further down in the thread where a security guy has pre-emptively invoked the "acceptable use" policy to cover for up for inc

But it's far worse than that. Look further down in the thread where a security guy has pre-emptively invoked the "acceptable use" policy to cover for up for incompetence to secure the MITM proxy appropriately. Acceptable use policies are not self-enforcing, they are really only used selectively, regardless if they say you shouldn't use your computer for personal use. Everybody does that to some degree and it is accepted in reality as long as it's within certain limits. If the policy was self-enforcing then half the internet would be blocked, but of course companies don't do that because no one wants to work in that environment. If you're watching porn or torrented movies, you'll either get a warning or fired, but the company will do nothing if you make an online payment. But what happens if the proxy gets hacked and the attacker gets hold of your banking/personal logins/data? Who is most likely to discover the hack? Probably the same security guys who are managing the proxy. Will the security guys do the right thing and inform management that a hack occurred? Will the company also then do the right thing and inform all their employees that a hack occurred and now you might be missing some money? Will the company choose to hide behind the “acceptable use” policy to absolve itself from liability and say that it was you doing the wrong thing and stuck with the costs of your actions? At each layer beginning at the individual working in the security team, to the whole security team, to the company management team, to everyone working at the company, that the incentives are aligned to cover up such an incident rather than reveal it. The TLS inspection proxy is a bad system and worse still it’s a dangerous system in the hands of people who are not capable of providing and unbiased assessment of the risks they are exposing themselves and everyone else to, not to mention the company. It’s more than just financial risk, it’s the moral-hazard kinds of risk that really concern me because of the lack of transparency/understanding of its roll out, the incentives to cover up when something bad happens, and the lack of legal protections afterwards.

iamatworknow 10y ago
I very much agree with all of these points, which is why, as I told my HR rep, I won't use any personal websites on the work network at all since the HTTPS interception was turned on. It's been a gigantic pain in the ass doing things like checking my bank statements or whatever on my phone only, but I live with it. The only non strictly work related site I go to is this one, with this throwaway account/random password. On the topic of liability and owning up to a potential hack, I think my company would be transparent about it, based on a history of being transparent about many atypical things in the past. We're not public, never received any VC funding, and nobody has any equity stake in the company except for the owner, who himself goes over the entire company's income statement in front of all the employees once per year to let us know where all the money's coming from/going to. I do believe he would do whatever he could to make it right, because the buck stops with him and him alone. Clearly that's only a small comfort if our personal information is leaked, but I don't think in my case it would be covered up. I could certainly see that being the case in most corporate structures, though.

iamatworknow 10y ago

I very much agree with all of these points, which is why, as I told my HR rep, I won't use any personal websites on the work network at all since the HTTPS interception was turned on. It's been a gigantic pain in the ass doing things like checking my bank statements or whatever on my phone only, but I live with it. The only non strictly work related site I go to is this one, with this throwaway account/random password. On the topic of liability and owning up to a potential hack, I think my company would be transparent about it, based on a history of being transparent about many atypical things in the past. We're not public, never received any VC funding, and nobody has any equity stake in the company except for the owner, who himself goes over the entire company's income statement in front of all the employees once per year to let us know where all the money's coming from/going to. I do believe he would do whatever he could to make it right, because the buck stops with him and him alone. Clearly that's only a small comfort if our personal information is leaked, but I don't think in my case it would be covered up. I could certainly see that being the case in most corporate structures, though.