7 ms·

I would add: do not use corporate "guest" wifi for your personal devices. Your employer is monitoring what you do on this network and may be man-in-the-middle-i

I would add: do not use corporate "guest" wifi for your personal devices. Your employer is monitoring what you do on this network and may be man-in-the-middle-ing your SSL connections. If your corporate instructions for using the "guest" wifi include registering devices and adding trusted certificates, your device usage is being monitored and associated with you personally and your SSL connections are probably getting MITM'd.

gattilorenz 5y ago
IANAL but this is might be illegal outside the US (for sure in Italy, probably in most of Europe) and can't be used as a reason for firing employees
- GekkePrutser 5y ago
  The company I work for does this in all countries including all European ones. Even in Germany, Italy, France... Which have strong privacy laws. So I'm pretty sure it's allowed as we're too big to not have this checked by legal.
  - gattilorenz 5y ago
    The fact that it's done doesn't mean it's allowed (and this is very true in Italy, unfortunately). Monitoring the connection of an employee (which is different from blocking certain domains) is possible under certain conditions, but always at the individual level and when there is a reasonable suspicion that the employee might be misbehaving: https://www.laleggepertutti.it/507663_controllo-navigazione-internet-dipendenti https://www.laleggepertutti.it/507663_controllo-navigazione-...
  - ThePadawan 5y ago
    > So I'm pretty sure it's allowed as we're too big to not have this checked by legal. You mean your big enough that legal answered "In the unlikely event that an employee knows their rights, we can afford to get sued"? I second that this is immensely illegal in Germany.
quietbritishjim 5y ago
> do not use corporate "guest" wifi for your personal devices. Your employer is monitoring what you do on this network and may be man-in-the-middle-ing your SSL connections. Unless I'm missing something, this is not possible (unless you install a certificate root supplied by your employer) because any man-in-the-image attempt would be flagged as a failed certificate authentication. Indeed, that's exactly why certificate chains tied to domain names exist.
- daggersandscars 5y ago
  Thank you for the clarification. I knew it was possible if you installed a work-provided certificate. I was not sure it was possible without one.
  - GekkePrutser 5y ago
    It's not possible with SSL/TLS. But there are ways to downgrade to http in some cases. All the corporate inspection tools I know don't use this by the way. Many of these corporate inspection tools seem to leave traffic on nonstandard ports alone by the way, just saying ;)
- nikau 5y ago
  correct its not. They can however look at your DNS queries, and even if you use encrypted DNS they can still inspect the certificates of sites you are going to to figure out what the domain is. In the past it was possible to quickly swap the physical sata hard disk on some laptops to segregate work/personal use, but that's no longer viable with modern laptops. On the plus side carrying 2 modern laptops weighs the same as one oldshool laptop and they use the same usb-c charger...
  - Scoundreller 5y ago
    > as one oldshool laptop and they use the same usb-c charger Be careful with this. My MacBook Air will charge off anything, including a 5V battery bank. My Dell won’t charge off anything less than 18V over USB-C. Got caught in a bind once when I brought my “slow” charger thinking that would be fine for light use on a trip away. It was not.

gattilorenz 5y ago

IANAL but this is might be illegal outside the US (for sure in Italy, probably in most of Europe) and can't be used as a reason for firing employees

GekkePrutser 5y ago
The company I work for does this in all countries including all European ones. Even in Germany, Italy, France... Which have strong privacy laws. So I'm pretty sure it's allowed as we're too big to not have this checked by legal.
- gattilorenz 5y ago
  The fact that it's done doesn't mean it's allowed (and this is very true in Italy, unfortunately). Monitoring the connection of an employee (which is different from blocking certain domains) is possible under certain conditions, but always at the individual level and when there is a reasonable suspicion that the employee might be misbehaving: https://www.laleggepertutti.it/507663_controllo-navigazione-internet-dipendenti https://www.laleggepertutti.it/507663_controllo-navigazione-...
- ThePadawan 5y ago
  > So I'm pretty sure it's allowed as we're too big to not have this checked by legal. You mean your big enough that legal answered "In the unlikely event that an employee knows their rights, we can afford to get sued"? I second that this is immensely illegal in Germany.

quietbritishjim 5y ago

> do not use corporate "guest" wifi for your personal devices. Your employer is monitoring what you do on this network and may be man-in-the-middle-ing your SSL connections. Unless I'm missing something, this is not possible (unless you install a certificate root supplied by your employer) because any man-in-the-image attempt would be flagged as a failed certificate authentication. Indeed, that's exactly why certificate chains tied to domain names exist.

daggersandscars 5y ago
Thank you for the clarification. I knew it was possible if you installed a work-provided certificate. I was not sure it was possible without one.
- GekkePrutser 5y ago
  It's not possible with SSL/TLS. But there are ways to downgrade to http in some cases. All the corporate inspection tools I know don't use this by the way. Many of these corporate inspection tools seem to leave traffic on nonstandard ports alone by the way, just saying ;)
nikau 5y ago
correct its not. They can however look at your DNS queries, and even if you use encrypted DNS they can still inspect the certificates of sites you are going to to figure out what the domain is. In the past it was possible to quickly swap the physical sata hard disk on some laptops to segregate work/personal use, but that's no longer viable with modern laptops. On the plus side carrying 2 modern laptops weighs the same as one oldshool laptop and they use the same usb-c charger...
- Scoundreller 5y ago
  > as one oldshool laptop and they use the same usb-c charger Be careful with this. My MacBook Air will charge off anything, including a 5V battery bank. My Dell won’t charge off anything less than 18V over USB-C. Got caught in a bind once when I brought my “slow” charger thinking that would be fine for light use on a trip away. It was not.