4 ms·
> Same for the MITM ssl proxy stuff. If I logon to my personal banking website while at work, and my employer MITM's that connection to snoop, have they genuin
by grecy 6y ago
> Same for the MITM ssl proxy stuff.
If I logon to my personal banking website while at work, and my employer MITM's that connection to snoop, have they genuinely not broken any law?
- prepend 6y agoSadly, not in the states I’ve worked. There’s a login banner on work machines letting them see everything. Fortunately, my org doesn’t actually mitm bank sites. I tried looking for cases where this was tried and haven’t found any. I would like to see this prosecuted as it seems wrong.
- fnord123 6y agoIt depends on which country you're in.
- marcinzm 6y agoI'm sure somewhere in the many legal documents you signed to start the job (given to you after you've already resigned from your previous job, of course) you give them the right to do so.
- mikro2nd 6y agoThe law is the law: You cannot contract with another party to "allow" either one of you to break the law.
- SkyPuncher 6y agoIf you're doing it on a company machine, haven't you implicitly given you permission to see that data? You don't have privacy on company equipment.
- PeterisP 6y ago"You don't have privacy on company equipment." is true (AFAIK) in USA, but false in a number of other countries e.g. Germany; so this depends on where you live/work. In general, in Europe you can't contract away most of your privacy rights, so it's not even worth looking at your job contract because you signing "I allow the company to do X" does not necessarily mean that the company is allowed to do X.
- amlozano 6y agoI've often wondered the same thing, but about personal health information and educational information (HIPPA, FERPA). If you intercept that data and store it, transmit it or even just allow real time access to it are you suddenly on the hook for all that those laws require?
- adolph 6y agoI confirmed that at a company town hall once and I asked if that makes that system a hack target. The CISO didn’t seem to understand the vulnerability, as if it were inconceivable that their infrastructure would be targeted to take advantage of their position as mitm.
- 2rsf 6y agoObviously it depends on what country you are in, but in a few examples I know of it is perfectly legal for them to do that. You don't want to be tracked ? use you own device and network.