6 ms·

> That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy. The problem right

> That’s why I have personal property that the company isn’t able to access so I can conduct personal activities with some level of privacy. The problem right now is: due to Work from home, you basically have blurred the lines between the digital company and private assets. Either you have a company device; or even a personal device running this software in your private networks doing and telemetering you don’t know what. This especially bad for the folks who aren’t able to properly put those devices in a separate subnet and protect themselves.

prepend 6y ago
Or you have both. For example, I have work equipment and personal equipment on my same home desk. My home network blocks a lot of traffic, but I’d be really surprised if my personal device provided any telemetry to work.
ThrowawayR2 6y ago
> "due to Work from home, you basically have blurred the lines between the digital company and private assets" I have a separate work computer and home computer on my desk; the work computer is on a guest wi-fi network and cannot see local traffic. A decent wi-fi router with guest network capabilities is a trivial expense these days.
p1necone 6y ago
We just RDP into our in-office machines when we work from home.
- skeeter2020 6y ago
  From your personal machine? Do you ever check your email via a web interface on your own box? write a quick textfile or document? Log into a web app? It's really easy to let your work bleed into your personal machine...
  - p1necone 6y ago
    Sure, but the threat level of occasionally writing some notes on a personal box is nowhere near what it would be if I was writing code or connecting to production environments from it.
gonzo41 6y ago
Second laptop. I know it's expensive, but if your working from home, don't do it from your own computer. do it from a computer work provides. Or at least, create a second account called work and do everything from that. Also make the theme, colors and everything you can different so there's a context shift between the two activities.
- kerng 6y ago
  Good advise - I know people who got fired because all of a sudden during a zoom session on their personal device some content showed up that would not have been on a work computer.
- jdbernard 6y ago
  Same setup, except three laptops: personal, company-provided, client/project-provided. You would think it would be unmanageable and you'd be right we're it not for Synergy (https://symless.com/synergy https://symless.com/synergy). I've got two laptops docked and connected to external monitors. Synergy lets me use just one keyboard and mouse for all three at the same time. Makes it feel like they're just three adjacent screens on one PC. But because they're not I can maintain strict separation between personal and work, and between internal/corporate and client data. Then, like others have said, I have a fair amount of filtering on the network level.
  - sjy 6y ago
    I’ve thought about this but I assumed it would be too hard to get Synergy installed on employer or client-provided computers. It sounds like you’ve used this setup with multiple clients – is it normal in your field of work to get local admin rights on corporate devices?
    - maven29 6y ago
      https://answers.microsoft.com/en-us/windows/forum/windows_10-start/mouse-without-borders-mousewithoutborders/0523308d-3406-4273-b86e-bef28aa6b50d https://answers.microsoft.com/en-us/windows/forum/windows_10... Why not use the First party equivalent? Microsoft's Mouse Without Borders claims to do exactly this.
gigel82 6y ago
I wish there was a better solution to this. I tried creating a VM and joining that to the work "services" but HyperV, VirtualBox, etc. all add an audio delay making Teams unusable. Also tried Barrier and dedicating one monitor to work, but I still can't share/mix the audio so have 2 separate headsets. I know ideally I'd just use the work computer all the time when "working", but they're VPN-ing all traffic and I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic.
- tacticus 6y ago
  So my plan for the audio problem is to use a set of raspberry pis with USB-gadget stuff enabled to be a webcam & soundcard then running them as a usb device. The webcam is going to be an RTSP feed (with the microphone audio) from the main system to push it through and pulseaudios network side of things to do speaker\headphone out. it's a bit complex for what i need but it should work well.
- maccard 6y ago
  > I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic. Low friction answer to that is a personal smartphone. Bonus points because it works in the office too!
- varispeed 6y ago
  You could buy a small desktop mixer with two sends, so you could connect a microphone to it and choose which computer it will send voice to and also mix sound from both computers.
2rsf 6y ago
> separate subnet Why ? theoretically you have a point, but practically which company would spy on your network ? I totally understand, and agree to some degree, a company protecting its assets and tracking what their employees are doing but it's not the same as putting a general spyware.
- leipert 6y ago
  It’s not about that I don’t trust my company. I just don’t necessarily trust the software I need to use for a job. For example if it has some device management software, or some VPN clients or whatnot installed, this increases the attack surface. Also „leipert“-private might be boring for targeted attacks. But „leipert“-corporate might be interesting, if someone owns my private network OR my work computer, it might have an impact on the other.

prepend 6y ago

Or you have both. For example, I have work equipment and personal equipment on my same home desk. My home network blocks a lot of traffic, but I’d be really surprised if my personal device provided any telemetry to work.

ThrowawayR2 6y ago

> "due to Work from home, you basically have blurred the lines between the digital company and private assets" I have a separate work computer and home computer on my desk; the work computer is on a guest wi-fi network and cannot see local traffic. A decent wi-fi router with guest network capabilities is a trivial expense these days.

p1necone 6y ago

We just RDP into our in-office machines when we work from home.

skeeter2020 6y ago
From your personal machine? Do you ever check your email via a web interface on your own box? write a quick textfile or document? Log into a web app? It's really easy to let your work bleed into your personal machine...
- p1necone 6y ago
  Sure, but the threat level of occasionally writing some notes on a personal box is nowhere near what it would be if I was writing code or connecting to production environments from it.

gonzo41 6y ago

Second laptop. I know it's expensive, but if your working from home, don't do it from your own computer. do it from a computer work provides. Or at least, create a second account called work and do everything from that. Also make the theme, colors and everything you can different so there's a context shift between the two activities.

kerng 6y ago
Good advise - I know people who got fired because all of a sudden during a zoom session on their personal device some content showed up that would not have been on a work computer.
jdbernard 6y ago
Same setup, except three laptops: personal, company-provided, client/project-provided. You would think it would be unmanageable and you'd be right we're it not for Synergy (https://symless.com/synergy https://symless.com/synergy). I've got two laptops docked and connected to external monitors. Synergy lets me use just one keyboard and mouse for all three at the same time. Makes it feel like they're just three adjacent screens on one PC. But because they're not I can maintain strict separation between personal and work, and between internal/corporate and client data. Then, like others have said, I have a fair amount of filtering on the network level.
- sjy 6y ago
  I’ve thought about this but I assumed it would be too hard to get Synergy installed on employer or client-provided computers. It sounds like you’ve used this setup with multiple clients – is it normal in your field of work to get local admin rights on corporate devices?
  - maven29 6y ago
    https://answers.microsoft.com/en-us/windows/forum/windows_10-start/mouse-without-borders-mousewithoutborders/0523308d-3406-4273-b86e-bef28aa6b50d https://answers.microsoft.com/en-us/windows/forum/windows_10... Why not use the First party equivalent? Microsoft's Mouse Without Borders claims to do exactly this.

gigel82 6y ago

I wish there was a better solution to this. I tried creating a VM and joining that to the work "services" but HyperV, VirtualBox, etc. all add an audio delay making Teams unusable. Also tried Barrier and dedicating one monitor to work, but I still can't share/mix the audio so have 2 separate headsets. I know ideally I'd just use the work computer all the time when "working", but they're VPN-ing all traffic and I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic.

tacticus 6y ago
So my plan for the audio problem is to use a set of raspberry pis with USB-gadget stuff enabled to be a webcam & soundcard then running them as a usb device. The webcam is going to be an RTSP feed (with the microphone audio) from the main system to push it through and pulseaudios network side of things to do speaker\headphone out. it's a bit complex for what i need but it should work well.
maccard 6y ago
> I occasionally need to read a private email, or do some browsing and would prefer they don't see that traffic. Low friction answer to that is a personal smartphone. Bonus points because it works in the office too!
varispeed 6y ago
You could buy a small desktop mixer with two sends, so you could connect a microphone to it and choose which computer it will send voice to and also mix sound from both computers.

2rsf 6y ago

> separate subnet Why ? theoretically you have a point, but practically which company would spy on your network ? I totally understand, and agree to some degree, a company protecting its assets and tracking what their employees are doing but it's not the same as putting a general spyware.

leipert 6y ago
It’s not about that I don’t trust my company. I just don’t necessarily trust the software I need to use for a job. For example if it has some device management software, or some VPN clients or whatnot installed, this increases the attack surface. Also „leipert“-private might be boring for targeted attacks. But „leipert“-corporate might be interesting, if someone owns my private network OR my work computer, it might have an impact on the other.