4 ms·

I’ve seen my school’s firewall logs and the experience scared me. Something really clicked when I saw a log with my name on it. It showed everything I’d been

I’ve seen my school’s firewall logs and the experience scared me. Something really clicked when I saw a log with my name on it. It showed everything I’d been doing and it was right in front of me and also someone else: the IT tech with whom I was working. I was getting help debugging something (package manager barfing on the org’s wildcard MITM SSL cert) and the inanity of the tech scrolling through everything I’d done that day in such detail was spine chilling. Deep packet inspection put everything from command line args to Google search terms at their fingertips. It felt grubby. My org requires that I install their SSL cert which made the logs more detailed than Brown’s. That’s certainly a pretty high level of creepiness. But even without SSL DPI when the org has control over the network and at least one website using your identity then it’s trivial to correlate the application layer userid all the way down to your network access, including AP location. If they outsource to Gmail or Outlook there’s usually still an org controlled single sign on that captures your identity. I love the accessible way in which this report is written. While it’s specific to Brown it summarizes the generic surveillance patterns of many employers and education orgs. We all know these programs exist but it’s not until one experiences them first hand that one realizes how desperately creepy they are.

pcdoodle 6y ago
What bugs me is the seemingly high influx of users on HN that are accepting of such behavior. The propaganda is real.
- gorgoiler 6y ago
  I cashed out and left the Bay Area many years ago. I currently work in a small college town doing something I love (teaching CS in a private school) and live in the nearby countryside. My school runs its IT department like it’s the 1990s from buildings constructed in the 1890s. That should give a frame of reference as to the progressiveness and pace of change I can reasonably expect. It’s salaried but I treat the job like a contracting gig: I provide my own equipment and network connection. It helps me sleep at night.
astrobe_ 6y ago
Buildings equipped with an access control system makes it easy to track where users are. That's even a feature ; for instance when an emergency evacuation happens (e.g. fire alarm), the system can tell you if there's still someone in there (assuming the fire has not destroyed parts of the system). Although one should assume nowadays that a public network is the same thing as a public street, and that using the LAN of a school is the same thing as walking on its campus, it is indeed disturbing that some people within those org (and the org itself) have some of the possibilities as police has - except that police would need a judge and a mandate in some cases. So as always there are pros and cons. Good uses and evil uses. In Europe, GDPR laws mandate that not every admin or user of the system have access to this type of data, and that's a good start IMO.
- sokoloff 6y ago
  Access control without mantraps doesn’t give you a clear list of who’s inside in an emergency. Tailgating is the norm for such systems, so the best you can answer is “what’s the subset of people who might be inside?” With both type 1 and type 2 errors.
  - astrobe_ 6y ago
    Mantraps or similar significantly slowdown the flow, which is an inconvenience. Only big buildings or plants with strict security/safety constrains invest in multiple mantraps at entrances. Anything else - or even proper poorly done mantraps that can be gamed - are imperfect it is understood that this feature of the access control system is a support feature, not a guarantee. As I mentioned, a disaster can compromise the working of the system directly, and people may forcefully bypass restrictions (e.g. get out by windows), so you are correct that it only tells who might still be inside. However coupled with other features (e.g. marking users that are on vacation and therefore who are not allowed to be there) can also tell you who cannot be inside.
nlitened 6y ago
How common is for orgs to require installation of their own certificates? That’s more creepy than video cameras installed in toilets.
- gorgoiler 6y ago
  I imagine it is common when tech isn’t the primary business function and BYOD is permitted (or required.)
- benhurmarcel 6y ago
  Most companies just include that certificate into the machine they provide to you.
- raxxorrax 6y ago
  It is established industry practice at this point. It is necessary to identify malicious downloads, which are hidden due to https. This surveillance grade is certainly creepy and should be strongly regulated in my opinion.

pcdoodle 6y ago

What bugs me is the seemingly high influx of users on HN that are accepting of such behavior. The propaganda is real.

gorgoiler 6y ago
I cashed out and left the Bay Area many years ago. I currently work in a small college town doing something I love (teaching CS in a private school) and live in the nearby countryside. My school runs its IT department like it’s the 1990s from buildings constructed in the 1890s. That should give a frame of reference as to the progressiveness and pace of change I can reasonably expect. It’s salaried but I treat the job like a contracting gig: I provide my own equipment and network connection. It helps me sleep at night.

astrobe_ 6y ago

Buildings equipped with an access control system makes it easy to track where users are. That's even a feature ; for instance when an emergency evacuation happens (e.g. fire alarm), the system can tell you if there's still someone in there (assuming the fire has not destroyed parts of the system). Although one should assume nowadays that a public network is the same thing as a public street, and that using the LAN of a school is the same thing as walking on its campus, it is indeed disturbing that some people within those org (and the org itself) have some of the possibilities as police has - except that police would need a judge and a mandate in some cases. So as always there are pros and cons. Good uses and evil uses. In Europe, GDPR laws mandate that not every admin or user of the system have access to this type of data, and that's a good start IMO.

sokoloff 6y ago
Access control without mantraps doesn’t give you a clear list of who’s inside in an emergency. Tailgating is the norm for such systems, so the best you can answer is “what’s the subset of people who might be inside?” With both type 1 and type 2 errors.
- astrobe_ 6y ago
  Mantraps or similar significantly slowdown the flow, which is an inconvenience. Only big buildings or plants with strict security/safety constrains invest in multiple mantraps at entrances. Anything else - or even proper poorly done mantraps that can be gamed - are imperfect it is understood that this feature of the access control system is a support feature, not a guarantee. As I mentioned, a disaster can compromise the working of the system directly, and people may forcefully bypass restrictions (e.g. get out by windows), so you are correct that it only tells who might still be inside. However coupled with other features (e.g. marking users that are on vacation and therefore who are not allowed to be there) can also tell you who cannot be inside.

nlitened 6y ago

How common is for orgs to require installation of their own certificates? That’s more creepy than video cameras installed in toilets.

gorgoiler 6y ago
I imagine it is common when tech isn’t the primary business function and BYOD is permitted (or required.)
benhurmarcel 6y ago
Most companies just include that certificate into the machine they provide to you.
raxxorrax 6y ago
It is established industry practice at this point. It is necessary to identify malicious downloads, which are hidden due to https. This surveillance grade is certainly creepy and should be strongly regulated in my opinion.