9 ms·

If you sign into a personal Google account on a new Chrome profile on a managed laptop, can they get access to your entire Google account (drive, emails, etc.)

If you sign into a personal Google account on a new Chrome profile on a managed laptop, can they get access to your entire Google account (drive, emails, etc.) remotely? Can they use an auth token or something to automate the process of downloading all your data? If so, is this legal?

koolba 4y ago
> If so, is this legal? If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. Laptops are cheap. There’s no reason to mix personal and corporate usage.
- cyphar 4y ago
  > If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. You might also get a phone call (on your private phone) about a private medical matter while at work, but I would hope your employer couldn't use the CCTV audio they have in the office to decide to fire you based on that information (though I don't know if US laws actually protect workers in this case -- in Australia and basically all of Eastern Europe this would be insanely illegal on several levels). > Laptops are cheap. Not for everyone.
  - chii 4y ago
  - krageon 4y ago
    If you live in a civilised country, it is illegal.
  - coldtea 4y ago
    >From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. How often did that stop an employer?
    - cyphar 4y ago
      I don't know if this is the case in the US, but in Australia it's very easy (and relatively cheap) to take your employer to tribunal over violations of employment laws (if it was very clear-cut or severe violation you could even make a complaint to the relevant regulator which could launch an action on your behalf). Something being illegal means if they did do it, you'd be owed compensation.
  - justsomehnguy 4y ago
    > Not for everyone. Still cheaper then searching for a new job... without a current one.
    - eertami 4y ago
      Disagree, with the money I would be awarded from my employer for their breaking of both employment and privacy laws I think I could easily purchase a new laptop - and also fund a few months of vacation while searching for the next job. (This probably doesn't work so well in the US.)
  - sofixa 4y ago
    At least in the EU, it's illegal yes - https://www.theguardian.com/law/2017/sep/05/romanian-chat-messages-read-by-employer-had-privacy-breached-court-rules https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...
    - criley2 4y ago
      From the article: The only thing they did wrong was not more explicitly mention the monitoring. So it wasn't illegal to monitor communications, rather it was illegal to fire someone for using their work account for private communication without sufficiently warning them. All they have to do is make you sign some document on day 1 and they're covered. Also they were not awarded any damages or anything, so it's not like you'd get a payday after being fired. >Commenting on the ruling, Pam Cowburn, the communications director at in London, said: “The European court’s ruling is welcome. In some workplaces, it may be necessary for emails to be monitored, but if employers are going to do so, they should make staff explicitly aware of it.” >Despite finding that Bărbulescu’s rights under article 8 of the convention had been violated, the court declined to award him any compensation, saying the ruling was “sufficient just satisfaction”.
    - EUROCARE 4y ago
      It's definitely NOT illegal in EU if the user is appropriately informed, usually in your employment contract you sign a clause about that. Even the government does it to their employees.
      - PeterisP 4y ago
        No, there have been all kinds cases of enforcement action in EU where the user was informed but the employer could not justify the violation of privacy; in general EU law and especially in privacy law it's quite frequent that some explicit "consent" clause in employment contracts (essentially, if it's a standard clause in all agreements and "take it or leave it") is treated as not representing true consent and void. The largest example probably is the 2020 GDPR fine of 35 million euro for clothing retailer H&M for violating the privacy of their employees, despite the employees being informed of that.
- alasdair_ 4y ago
  This is an interesting question post-pandemic where the network the laptop is using may be an employees home network, especially if there is some kind of active scanning involved.
  - MadsRC 4y ago
    This is a real problem, especially for InfoSec tools. Many EDR tools, such as MS Defender for Endpoint (or whatever it’s called these days) and Crowdstrike Falcon, include functionality that will scan your local network for devices in order to discover unmanaged devices… It’s a nightmare from a privacy point, but its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network?
    - oarsinsync 4y ago
      > its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network? Trivially, from the simplistic (check IPs and router MACs / SSID in use) to the marginally more advanced (deploy an agent that is only reachable from the corporate network) to determine if the tool should even be running in the first place.
  - soraminazuki 4y ago
    Every home router should make it easy for people to create separate VLANs for work to protect against this.
    - pyinstallwoes 4y ago
      VLAN's aren't security. No way to force respecting the protocol.
      - JonChesterfield 4y ago
        Tag on the switch port?
- ls15 4y ago
  > If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. In the USA and other countries with subpar privacy laws.
  - lazide 4y ago
    Which countries don’t allow a company to monitor activity on company equipment and company networks during company time?
    - MadsRC 4y ago
      IIRC Danish law states that work email may be used for private purposes and that anything clearly labeled as private is to be considered such. For example, by moving email to a folder called “private”. For the employer to open/read such communication would be highly illegal, akin to opening others private snail mail. I do believe that this also extends to corporate issued phones and computers. Especially since you’re automatically taxed for “private use” of such equipment when assigned.
      - lazide 4y ago
        That doesn’t apply at all here?
        stareatgoats 4y ago
        > here I think you need to specify "here" to get an answer to that question.
        lazide 4y ago
        The thread we are in about companies monitoring people accessing Glassdoor and penalizing them in various ways for using it to say things the company doesn’t consider flattering. That has nothing to do with putting private email in a private folder on the company mail server, near as I can tell, and nothing in that statement would address the statement about companies monitoring use of company equipment and network etc. Since they’d need to know even in the private email case what they folder names were, for instance, to know there even WAS private email.
- pronlover723 4y ago
  Surprisingly I was at a party in SF with a bunch of Apple employees. Somehow some topic came up and I was like "I don't do anything personal on my company laptop. I especially don't look at porn". All 6 of them said they used their company laptops and phones to look at porn all the time. Wow
  - heavyset_go 4y ago
    I've heard some pretty simultaneously funny and Orwellian stories about this, mostly about people being fired for looking at porn using work laptops and the specific porn they were looking at. Don't use work computers to look at porn, your employers already know about it.
    - dzhiurgis 4y ago
      - frostedflakes 4y ago
        I'm as sex positive as they come but even I think it'd be pretty dumb to have pornhub pop up while you're sharing your screen in a meeting or something
        dzhiurgis 4y ago
        About as dumb as having model train collector site up, or reddit or hn or whatever... It was actually kinda a joke with my friend when used to help him code. Leave something nasty open just for amusement. One good reason is that porn sites are notoriously riddles with browser 0 days. To this day I get the odd Safari crash every other month.
      - analognoise 4y ago
        We've decided to structure society such that some people starve, and we consider that acceptable. There are even children who are "food insecure". Apparently nobody cares about anyone else's most basic needs like food (even our most vulnerable), I can't see how they'd care about someone else's need to jerk off.
- pyuser583 4y ago
  None of my employers pay for Spotify.
- metadat 4y ago
  I don't want to work somewhere where this would ever be an issue. More than happy to leave if they pull this kind of personal invasion (yeah, it's their property, but still- basic human decency dictates: don't do it). Your advice is still sound.
- EricE 4y ago
  >There’s no reason to mix personal and corporate usage. Exactly! I'm always amazed at people who do ANYTHING personal on corporate resources, especially in this day and age. Even when personal computers were rare and cost thousands of dollars I still didn't do jack shit on work computers, no matter how tempting or "acceptable use" it was.
mike_d 4y ago
It will depend on your employee handbook, but generally any data you produce on a company laptop belongs to the company. Anything in the browser cache is fair game.
happyopossum 4y ago
Not specifically through Chrome (managed chrome does not give your employer access to incognito or personal profile data), but if it's a company owned and issued laptop you should assume they have other ways of capturing all activity on the device.

koolba 4y ago

> If so, is this legal? If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. Laptops are cheap. There’s no reason to mix personal and corporate usage.

cyphar 4y ago
> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. You might also get a phone call (on your private phone) about a private medical matter while at work, but I would hope your employer couldn't use the CCTV audio they have in the office to decide to fire you based on that information (though I don't know if US laws actually protect workers in this case -- in Australia and basically all of Eastern Europe this would be insanely illegal on several levels). > Laptops are cheap. Not for everyone.
- chii 4y ago
- krageon 4y ago
  If you live in a civilised country, it is illegal.
- coldtea 4y ago
  >From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it. How often did that stop an employer?
  - cyphar 4y ago
    I don't know if this is the case in the US, but in Australia it's very easy (and relatively cheap) to take your employer to tribunal over violations of employment laws (if it was very clear-cut or severe violation you could even make a complaint to the relevant regulator which could launch an action on your behalf). Something being illegal means if they did do it, you'd be owed compensation.
- justsomehnguy 4y ago
  > Not for everyone. Still cheaper then searching for a new job... without a current one.
  - eertami 4y ago
    Disagree, with the money I would be awarded from my employer for their breaking of both employment and privacy laws I think I could easily purchase a new laptop - and also fund a few months of vacation while searching for the next job. (This probably doesn't work so well in the US.)
- sofixa 4y ago
  At least in the EU, it's illegal yes - https://www.theguardian.com/law/2017/sep/05/romanian-chat-messages-read-by-employer-had-privacy-breached-court-rules https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...
  - criley2 4y ago
    From the article: The only thing they did wrong was not more explicitly mention the monitoring. So it wasn't illegal to monitor communications, rather it was illegal to fire someone for using their work account for private communication without sufficiently warning them. All they have to do is make you sign some document on day 1 and they're covered. Also they were not awarded any damages or anything, so it's not like you'd get a payday after being fired. >Commenting on the ruling, Pam Cowburn, the communications director at in London, said: “The European court’s ruling is welcome. In some workplaces, it may be necessary for emails to be monitored, but if employers are going to do so, they should make staff explicitly aware of it.” >Despite finding that Bărbulescu’s rights under article 8 of the convention had been violated, the court declined to award him any compensation, saying the ruling was “sufficient just satisfaction”.
  - EUROCARE 4y ago
    It's definitely NOT illegal in EU if the user is appropriately informed, usually in your employment contract you sign a clause about that. Even the government does it to their employees.
    - PeterisP 4y ago
      No, there have been all kinds cases of enforcement action in EU where the user was informed but the employer could not justify the violation of privacy; in general EU law and especially in privacy law it's quite frequent that some explicit "consent" clause in employment contracts (essentially, if it's a standard clause in all agreements and "take it or leave it") is treated as not representing true consent and void. The largest example probably is the 2020 GDPR fine of 35 million euro for clothing retailer H&M for violating the privacy of their employees, despite the employees being informed of that.
alasdair_ 4y ago
This is an interesting question post-pandemic where the network the laptop is using may be an employees home network, especially if there is some kind of active scanning involved.
- MadsRC 4y ago
  This is a real problem, especially for InfoSec tools. Many EDR tools, such as MS Defender for Endpoint (or whatever it’s called these days) and Crowdstrike Falcon, include functionality that will scan your local network for devices in order to discover unmanaged devices… It’s a nightmare from a privacy point, but its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network?
  - oarsinsync 4y ago
    > its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network? Trivially, from the simplistic (check IPs and router MACs / SSID in use) to the marginally more advanced (deploy an agent that is only reachable from the corporate network) to determine if the tool should even be running in the first place.
- soraminazuki 4y ago
  Every home router should make it easy for people to create separate VLANs for work to protect against this.
  - pyinstallwoes 4y ago
    VLAN's aren't security. No way to force respecting the protocol.
    - JonChesterfield 4y ago
      Tag on the switch port?
ls15 4y ago
> If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game. In the USA and other countries with subpar privacy laws.
- lazide 4y ago
  Which countries don’t allow a company to monitor activity on company equipment and company networks during company time?
  - MadsRC 4y ago
    IIRC Danish law states that work email may be used for private purposes and that anything clearly labeled as private is to be considered such. For example, by moving email to a folder called “private”. For the employer to open/read such communication would be highly illegal, akin to opening others private snail mail. I do believe that this also extends to corporate issued phones and computers. Especially since you’re automatically taxed for “private use” of such equipment when assigned.
    - lazide 4y ago
      That doesn’t apply at all here?
      - stareatgoats 4y ago
        > here I think you need to specify "here" to get an answer to that question.
        lazide 4y ago
        The thread we are in about companies monitoring people accessing Glassdoor and penalizing them in various ways for using it to say things the company doesn’t consider flattering. That has nothing to do with putting private email in a private folder on the company mail server, near as I can tell, and nothing in that statement would address the statement about companies monitoring use of company equipment and network etc. Since they’d need to know even in the private email case what they folder names were, for instance, to know there even WAS private email.
pronlover723 4y ago
Surprisingly I was at a party in SF with a bunch of Apple employees. Somehow some topic came up and I was like "I don't do anything personal on my company laptop. I especially don't look at porn". All 6 of them said they used their company laptops and phones to look at porn all the time. Wow
- heavyset_go 4y ago
  I've heard some pretty simultaneously funny and Orwellian stories about this, mostly about people being fired for looking at porn using work laptops and the specific porn they were looking at. Don't use work computers to look at porn, your employers already know about it.
  - dzhiurgis 4y ago
    - frostedflakes 4y ago
      I'm as sex positive as they come but even I think it'd be pretty dumb to have pornhub pop up while you're sharing your screen in a meeting or something
      - dzhiurgis 4y ago
        About as dumb as having model train collector site up, or reddit or hn or whatever... It was actually kinda a joke with my friend when used to help him code. Leave something nasty open just for amusement. One good reason is that porn sites are notoriously riddles with browser 0 days. To this day I get the odd Safari crash every other month.
    - analognoise 4y ago
      We've decided to structure society such that some people starve, and we consider that acceptable. There are even children who are "food insecure". Apparently nobody cares about anyone else's most basic needs like food (even our most vulnerable), I can't see how they'd care about someone else's need to jerk off.
pyuser583 4y ago
None of my employers pay for Spotify.
metadat 4y ago
I don't want to work somewhere where this would ever be an issue. More than happy to leave if they pull this kind of personal invasion (yeah, it's their property, but still- basic human decency dictates: don't do it). Your advice is still sound.
EricE 4y ago
>There’s no reason to mix personal and corporate usage. Exactly! I'm always amazed at people who do ANYTHING personal on corporate resources, especially in this day and age. Even when personal computers were rare and cost thousands of dollars I still didn't do jack shit on work computers, no matter how tempting or "acceptable use" it was.

mike_d 4y ago

It will depend on your employee handbook, but generally any data you produce on a company laptop belongs to the company. Anything in the browser cache is fair game.

happyopossum 4y ago

Not specifically through Chrome (managed chrome does not give your employer access to incognito or personal profile data), but if it's a company owned and issued laptop you should assume they have other ways of capturing all activity on the device.