4 ms·

At my work, clearing browser history is a red flag for audit. Their idea on the policy is anything you do on your work machine is work-related and the company h

At my work, clearing browser history is a red flag for audit. Their idea on the policy is anything you do on your work machine is work-related and the company has the right to see that history. If you want privacy, use your own device. And while that’s not my policy, I’ve worked in security long enough to know... anything you do on your work computers is already being watched by the security team. Web proxies and log aggregation go a long way, especially with web proxies being able to decrypt SSL traffic on-the-fly.

ncmncm 6y ago
Please remind me not to work where you do.
- dahart 6y ago
  How about a reminder to not work where you do? Unless you’re running the company, and you’re the only employee, your work internet usage is being monitored and logged at some level. Believing otherwise is giving your employer a very generous benefit of the doubt, let’s say, but still probably naive. It’s worth understanding why all companies might be required by law to monitor, or short of that, be incentivized to monitor employee internet usage: https://en.wikipedia.org/wiki/Respondeat_superior https://en.wikipedia.org/wiki/Respondeat_superior https://www.spamtitan.com/web-filtering/liability-for-employee-internet-usage/ https://www.spamtitan.com/web-filtering/liability-for-employ...
  - ncmncm 6y ago
    Nobody at my employer has time to waste on logging, never mind reviewing my internet usage. If they did, it would be unappealing just for wasting time on crap, all creepiness aside. Now, of course, most of it never gets near the office.
    - dahart 6y ago
      Nobody anywhere has time to waste on logging, and nobody really wants to review employee internet usage. That doesn’t mean it isn’t taking place. What makes you so certain it isn’t happening to you? Logging doesn’t take time, it’s automated, and nobody has to actively review internet usage, it can happen as needed when either some automated alarm goes off or when your company is contacted by another company or an ISP or the government regarding internet usage. Your GP comment above feels quite flippant, and makes me suspect you might not be aware of the realities of running a company, and may be lacking imagination for the kinds of things IT teams anywhere have to do just to set up a network and provide internet access to you, not to mention establish security rules, create QOS tables, and deal with real-world employee behavior. A lot of corporate routers and other network appliances do some level of logging by default. Maybe you work for a tiny startup that hasn’t started logging your usage yet, but pretty much all non-small companies in the US have to have automated monitoring of usage for liability reasons (I guess you didn’t actually read my links). Many companies need to know how much time employees spend on Facebook while at work in the aggregate, and while finding that out might seem creepy, what’s also creepy is employees being on Facebook while they’re getting paid to work. Even if you don’t, some people have problems with this and spend a lot of time on Facebook, or other sites, while getting paid to supposedly work. Internet usage monitoring is often the result of employee complaints to management about other employees. One company I worked at received legal threats from a media conglomerate because of torrent sharing of new release movies. Turns out the employee was just downloading porn because the work internet connection was much higher bandwidth than his home connection, and a hidden bot in the software he was using was doing other illegal torrent activity. The company didn’t figure it out immediately because they weren’t creepily actively reviewing internet connections, but between the logs that were there and some sleuthing, they figured out who the employee was. My company didn’t give a crap about the porn (though told the employee please never do that at work) but the movies being shared could have been millions of dollars in damage. If you are at a small company that isn’t monitoring yet, and your company grows, it will happen to you eventually. Otherwise, if you’re not at a small company, chances are high that you already are being logged and don’t know it. In any case, there’s no good reason to pass judgement on HN users who work for companies that do this; it’s ubiquitous and there is no clear cut line on where monitoring begins, and more importantly no reasonable expectation of privacy while at work in the US, except in the bathroom. Aside from all that, your ISP and the backbone providers and the ISPs of every site you visit is - 100% chance - monitoring connections. The majority of commercial sites on the internet are gathering analytics. Facebook and Google are watching everything they possibly can. Your employer monitoring may be the least of your problems, as long as you’re not surfing all day at work.
    - reaperducer 6y ago
      Nobody at my employer has time to waste on logging, never mind reviewing my internet usage Which is why there are dozens and dozens of companies to which this sort of thing is outsourced, either explicitly, or as part of some generic security "suite."
    - freehunter 6y ago
      Unless you work for an absolutely tiny company that outsources all of its financial operations, you’re absolutely wrong. If you have an info sec team, they’re monitoring you. If you don’t have an info sec team and you’re not at an absolutely tiny company, like others have said there is a third party monitoring you. Payment Card Industry (PCI) and Sarbanes-Oxley (SOX) regulations both require centralized logging and review of those logs for audit reasons. Basically if your company provides health insurance or processes payments, your activity on all corporate machines are being aggregated and monitored. Even GDPR has a loophole for information security monitoring.
  - qhwudbebd 6y ago
    Disclosure: UK business owner and employer but no US employees. For us here at least, there’s no such requirement to betray the trust of our staff and spy on them, and we don’t do so. To be honest, the idea that anyone might consider this an acceptable behaviour never occurred to me. I’d like to think this is the norm but have no data either way.
    - dahart 6y ago
      The UK is definitely different than the US, and it looks to me like in the UK employees do have slightly higher expectations of privacy at work than in the US. However, some quick googling show me that UK employers are allowed to monitor employee internet usage in general. When you say you don’t log or monitor usage, have you actively audited your company equipment and disabled all logging? Have you contacted your ISP and cloud providers to discuss what data they have? Aside from your company network equipment, it’s not easy to make sure you’re not “monitoring” from the employees perspective, if you provide company computers or phones, or any cloud services to your employees. As a business owner, what would you do if you were contacted with a cease and desist letter from another company claiming your business domain was doing something illegal? What would you do if one of your employees told you another employee was doing something illegal at work and the employee denied it? I do find your language interesting, especially as a business owner. Using the words ‘betray’, ‘trust’, and ‘spy’, seems like a very one-sided view of the situation, and one that comes with some assumptions. In the US, most employment contracts, and employee trainings, will disclose the fact that company equipment is monitored for aggregate or individual behavior, and it is stated and agreed to that the equipment is for work use, not personal use. Because employees are notified and they actively agree to use work equipment for only work reasons, there is no “spying” or “betraying of trust” taking place. Trust goes both ways as well, and when an employee agrees to use work equipment only for work, and then turn around a browse Facebook while getting paid, or download porn from the work domain, the employees have not just betrayed the company trust, but have also broken their explicit agreements. https://www.lexology.com/library/detail.aspx?g=0818e4d9-ee76-4afa-8e72-8ea27ed5acf2 https://www.lexology.com/library/detail.aspx?g=0818e4d9-ee76... https://www.spamtitan.com/web-filtering/liability-for-employee-internet-usage/ https://www.spamtitan.com/web-filtering/liability-for-employ...
    - 6y ago
saagarjha 6y ago
> Their idea on the policy is anything you do on your work machine is work-related and the company has the right to see that history. If you want privacy, use your own device. These lines are often blurred (practically–not legally) with BYOD and people doing things like using their personal devices on company Wi-Fi networks.
- reaperducer 6y ago
  My company's BYOD policy is that you have to load the company's management software onto your personal hardware, and then if you leave the company, they wipe the device remotely, including all of your personal data. I think it's draconian, but plenty of people signed up for the program. I prefer to keep my home and work gear isolated from one another. I don't even have them on the same ISP.
  - saagarjha 6y ago
    Yeah, that sounds pretty bad and precisely the kind of thing I don't like at all. The carte blanche that companies have over anything that has been anywhere near anything of theirs is really annoying and not really practical for most people, and kind of stupid of you stop to think about it. Why can't we have company data in a thing where you can wipe just that? If I come to work and bring a personal device, they can supposedly search it. But what am I really supposed to do, leave my phone and watch at home and drop off the face of the earth during that time period? I understand that corporate security is a thing and all but some of this is just something that needs to actually consider practicality :/
    - freehunter 6y ago
      They’re not searching your watch or phone unless you’ve connected them to the corporate WiFi and/or accessed corporate information using those devices. The devices they care about are ones used to access internal data. So no, don’t leave your phone and watch at home. Just don’t connect them to Wifi at work or your work email/calendar. Make your company provide you a corporate phone if they want you to answer email on your phone.

ncmncm 6y ago

Please remind me not to work where you do.

dahart 6y ago
How about a reminder to not work where you do? Unless you’re running the company, and you’re the only employee, your work internet usage is being monitored and logged at some level. Believing otherwise is giving your employer a very generous benefit of the doubt, let’s say, but still probably naive. It’s worth understanding why all companies might be required by law to monitor, or short of that, be incentivized to monitor employee internet usage: https://en.wikipedia.org/wiki/Respondeat_superior https://en.wikipedia.org/wiki/Respondeat_superior https://www.spamtitan.com/web-filtering/liability-for-employee-internet-usage/ https://www.spamtitan.com/web-filtering/liability-for-employ...
- ncmncm 6y ago
  Nobody at my employer has time to waste on logging, never mind reviewing my internet usage. If they did, it would be unappealing just for wasting time on crap, all creepiness aside. Now, of course, most of it never gets near the office.
  - dahart 6y ago
    Nobody anywhere has time to waste on logging, and nobody really wants to review employee internet usage. That doesn’t mean it isn’t taking place. What makes you so certain it isn’t happening to you? Logging doesn’t take time, it’s automated, and nobody has to actively review internet usage, it can happen as needed when either some automated alarm goes off or when your company is contacted by another company or an ISP or the government regarding internet usage. Your GP comment above feels quite flippant, and makes me suspect you might not be aware of the realities of running a company, and may be lacking imagination for the kinds of things IT teams anywhere have to do just to set up a network and provide internet access to you, not to mention establish security rules, create QOS tables, and deal with real-world employee behavior. A lot of corporate routers and other network appliances do some level of logging by default. Maybe you work for a tiny startup that hasn’t started logging your usage yet, but pretty much all non-small companies in the US have to have automated monitoring of usage for liability reasons (I guess you didn’t actually read my links). Many companies need to know how much time employees spend on Facebook while at work in the aggregate, and while finding that out might seem creepy, what’s also creepy is employees being on Facebook while they’re getting paid to work. Even if you don’t, some people have problems with this and spend a lot of time on Facebook, or other sites, while getting paid to supposedly work. Internet usage monitoring is often the result of employee complaints to management about other employees. One company I worked at received legal threats from a media conglomerate because of torrent sharing of new release movies. Turns out the employee was just downloading porn because the work internet connection was much higher bandwidth than his home connection, and a hidden bot in the software he was using was doing other illegal torrent activity. The company didn’t figure it out immediately because they weren’t creepily actively reviewing internet connections, but between the logs that were there and some sleuthing, they figured out who the employee was. My company didn’t give a crap about the porn (though told the employee please never do that at work) but the movies being shared could have been millions of dollars in damage. If you are at a small company that isn’t monitoring yet, and your company grows, it will happen to you eventually. Otherwise, if you’re not at a small company, chances are high that you already are being logged and don’t know it. In any case, there’s no good reason to pass judgement on HN users who work for companies that do this; it’s ubiquitous and there is no clear cut line on where monitoring begins, and more importantly no reasonable expectation of privacy while at work in the US, except in the bathroom. Aside from all that, your ISP and the backbone providers and the ISPs of every site you visit is - 100% chance - monitoring connections. The majority of commercial sites on the internet are gathering analytics. Facebook and Google are watching everything they possibly can. Your employer monitoring may be the least of your problems, as long as you’re not surfing all day at work.
  - reaperducer 6y ago
    Nobody at my employer has time to waste on logging, never mind reviewing my internet usage Which is why there are dozens and dozens of companies to which this sort of thing is outsourced, either explicitly, or as part of some generic security "suite."
  - freehunter 6y ago
    Unless you work for an absolutely tiny company that outsources all of its financial operations, you’re absolutely wrong. If you have an info sec team, they’re monitoring you. If you don’t have an info sec team and you’re not at an absolutely tiny company, like others have said there is a third party monitoring you. Payment Card Industry (PCI) and Sarbanes-Oxley (SOX) regulations both require centralized logging and review of those logs for audit reasons. Basically if your company provides health insurance or processes payments, your activity on all corporate machines are being aggregated and monitored. Even GDPR has a loophole for information security monitoring.
- qhwudbebd 6y ago
  Disclosure: UK business owner and employer but no US employees. For us here at least, there’s no such requirement to betray the trust of our staff and spy on them, and we don’t do so. To be honest, the idea that anyone might consider this an acceptable behaviour never occurred to me. I’d like to think this is the norm but have no data either way.
  - dahart 6y ago
    The UK is definitely different than the US, and it looks to me like in the UK employees do have slightly higher expectations of privacy at work than in the US. However, some quick googling show me that UK employers are allowed to monitor employee internet usage in general. When you say you don’t log or monitor usage, have you actively audited your company equipment and disabled all logging? Have you contacted your ISP and cloud providers to discuss what data they have? Aside from your company network equipment, it’s not easy to make sure you’re not “monitoring” from the employees perspective, if you provide company computers or phones, or any cloud services to your employees. As a business owner, what would you do if you were contacted with a cease and desist letter from another company claiming your business domain was doing something illegal? What would you do if one of your employees told you another employee was doing something illegal at work and the employee denied it? I do find your language interesting, especially as a business owner. Using the words ‘betray’, ‘trust’, and ‘spy’, seems like a very one-sided view of the situation, and one that comes with some assumptions. In the US, most employment contracts, and employee trainings, will disclose the fact that company equipment is monitored for aggregate or individual behavior, and it is stated and agreed to that the equipment is for work use, not personal use. Because employees are notified and they actively agree to use work equipment for only work reasons, there is no “spying” or “betraying of trust” taking place. Trust goes both ways as well, and when an employee agrees to use work equipment only for work, and then turn around a browse Facebook while getting paid, or download porn from the work domain, the employees have not just betrayed the company trust, but have also broken their explicit agreements. https://www.lexology.com/library/detail.aspx?g=0818e4d9-ee76-4afa-8e72-8ea27ed5acf2 https://www.lexology.com/library/detail.aspx?g=0818e4d9-ee76... https://www.spamtitan.com/web-filtering/liability-for-employee-internet-usage/ https://www.spamtitan.com/web-filtering/liability-for-employ...
  - 6y ago

saagarjha 6y ago

> Their idea on the policy is anything you do on your work machine is work-related and the company has the right to see that history. If you want privacy, use your own device. These lines are often blurred (practically–not legally) with BYOD and people doing things like using their personal devices on company Wi-Fi networks.

reaperducer 6y ago
My company's BYOD policy is that you have to load the company's management software onto your personal hardware, and then if you leave the company, they wipe the device remotely, including all of your personal data. I think it's draconian, but plenty of people signed up for the program. I prefer to keep my home and work gear isolated from one another. I don't even have them on the same ISP.
- saagarjha 6y ago
  Yeah, that sounds pretty bad and precisely the kind of thing I don't like at all. The carte blanche that companies have over anything that has been anywhere near anything of theirs is really annoying and not really practical for most people, and kind of stupid of you stop to think about it. Why can't we have company data in a thing where you can wipe just that? If I come to work and bring a personal device, they can supposedly search it. But what am I really supposed to do, leave my phone and watch at home and drop off the face of the earth during that time period? I understand that corporate security is a thing and all but some of this is just something that needs to actually consider practicality :/
  - freehunter 6y ago
    They’re not searching your watch or phone unless you’ve connected them to the corporate WiFi and/or accessed corporate information using those devices. The devices they care about are ones used to access internal data. So no, don’t leave your phone and watch at home. Just don’t connect them to Wifi at work or your work email/calendar. Make your company provide you a corporate phone if they want you to answer email on your phone.