8 ms·

If it’s a managed corporate laptop that uses Chrome, then they could remotely check the browser history, likely directly to the review itself.

nhooyr 4y ago
Are you sure this is possible? I thought managed google accounts didn't allow admins to access browsing or any other history.
- emmelaich 4y ago
  If they have managed Google accounts they probably have admin on your device as well.
  - not-so-jerry 4y ago
    To belay paranoia, this is not always the case. I manage a company's google workspace, and we don't have managed browsers or devices, and no one has ever asked to have that capability.
    - mike_d 4y ago
      I am going to guess you don't have any security or compliance folks.
    - enkrs 4y ago
      Until the first case when an employee sends death threats from your company laptop and you need to provide the data to the police to help in investigation. Or the first case when some shared credentials get compromised probably from an infected computer and now you need to find which of the 80 laptops is the infected one. Or the first time employee converts his laptop into a wifi access point for the office girl upstairs and unknowingly lets her inside your companies private network. Of course, there are workarounds and better practices for every example. You can solve it without admin access to laptops and network request logging. But company property is not anonymous either with or without full admin access - so why jump trough the hoops to not have it?
- deleted 4y ago
  [deleted]
babyshake 4y ago
If you sign into a personal Google account on a new Chrome profile on a managed laptop, can they get access to your entire Google account (drive, emails, etc.) remotely? Can they use an auth token or something to automate the process of downloading all your data? If so, is this legal?
- koolba 4y ago
  > If so, is this legal? If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. Laptops are cheap. There’s no reason to mix personal and corporate usage.
  - cyphar 4y ago
    > If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. You might also get a phone call (on your private phone) about a private medical matter while at work, but I would hope your employer couldn't use the CCTV audio they have in the office to decide to fire you based on that information (though I don't know if US laws actually protect workers in this case -- in Australia and basically all of Eastern Europe this would be insanely illegal on several levels). > Laptops are cheap. Not for everyone.
    - chii 4y ago
    - krageon 4y ago
      If you live in a civilised country, it is illegal.
    - coldtea 4y ago
      >From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. How often did that stop an employer?
HyperSane 4y ago
I have actually done exactly that, copy over the sqlite broswer history sqlite database and run a query to generate a browsing history report.
- seanp2k2 4y ago
  I understand that this is all technically possible, but how do you feel about the morality of it?
  - HyperSane 4y ago
fulafel 4y ago
Do you mean Chrome has some special support for this, or is this the same as for any other browser (where the adversary could copy the history db file)?

nhooyr 4y ago

Are you sure this is possible? I thought managed google accounts didn't allow admins to access browsing or any other history.

emmelaich 4y ago
If they have managed Google accounts they probably have admin on your device as well.
- not-so-jerry 4y ago
  To belay paranoia, this is not always the case. I manage a company's google workspace, and we don't have managed browsers or devices, and no one has ever asked to have that capability.
  - mike_d 4y ago
    I am going to guess you don't have any security or compliance folks.
  - enkrs 4y ago
    Until the first case when an employee sends death threats from your company laptop and you need to provide the data to the police to help in investigation. Or the first case when some shared credentials get compromised probably from an infected computer and now you need to find which of the 80 laptops is the infected one. Or the first time employee converts his laptop into a wifi access point for the office girl upstairs and unknowingly lets her inside your companies private network. Of course, there are workarounds and better practices for every example. You can solve it without admin access to laptops and network request logging. But company property is not anonymous either with or without full admin access - so why jump trough the hoops to not have it?
deleted 4y ago
[deleted]

babyshake 4y ago

If you sign into a personal Google account on a new Chrome profile on a managed laptop, can they get access to your entire Google account (drive, emails, etc.) remotely? Can they use an auth token or something to automate the process of downloading all your data? If so, is this legal?

koolba 4y ago
> If so, is this legal? If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. Laptops are cheap. There’s no reason to mix personal and corporate usage.
- cyphar 4y ago
  > If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. You might also get a phone call (on your private phone) about a private medical matter while at work, but I would hope your employer couldn't use the CCTV audio they have in the office to decide to fire you based on that information (though I don't know if US laws actually protect workers in this case -- in Australia and basically all of Eastern Europe this would be insanely illegal on several levels). > Laptops are cheap. Not for everyone.
  - chii 4y ago
  - krageon 4y ago
    If you live in a civilised country, it is illegal.
  - coldtea 4y ago
    >From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. How often did that stop an employer?

HyperSane 4y ago

I have actually done exactly that, copy over the sqlite broswer history sqlite database and run a query to generate a browsing history report.

seanp2k2 4y ago
I understand that this is all technically possible, but how do you feel about the morality of it?
- HyperSane 4y ago

fulafel 4y ago

Do you mean Chrome has some special support for this, or is this the same as for any other browser (where the adversary could copy the history db file)?