6 ms·

Every modern identity platform tells you where your users are logging in from. Hiding it won't work for long if your company isn't in the stone ages.

gruez 4y ago
That can be bypassed by using a residential/LTE VPN. They're not as easy to get a hold of as regular VPNs, but if tens of thousands of dollars on the line I think tech workers can manage.
- Temporary_31337 4y ago
  Or you know just having a small room with a server rented that you ssh or vpn through. I think by the time an employer gets into such arms war with the employees, it’s time to have a hard look in the mirror and see where the CEO is working from. I found that a little surprising and upsetting about CloudFlare for example. The CTO is working from a beach town in Portugal but regular employees are bound to a physical office. And this is 100% ‘cloud’ company where all your work is logging in remotely anyway.
  - NovemberWhiskey 4y ago
    What's upsetting about an employer and employee agreeing on a working arrangement? If you want to work from a beach town in Portugal, negotiate it.
    - pessimizer 4y ago
      For some people that seems like negotiating an agreement with your employer about changing your hairstyle, or buying a new tv.
      - NovemberWhiskey 4y ago
        Then find an employer who thinks the same way. If you agree to work for a company that says "your place of employment is X" then you'd better be OK with that. Anything is just rationalization.
    - pzh 4y ago
      If you ask your employer to work from Lisbon as opposed to SF, you'll likely get a 3x-5x reduction in total compensation. I doubt Cloudflare (or any other) CEO's compensation will get the same readjustment for cost of living if he moves from the SF office to the Lisbon office.
  - jgrahamc 4y ago
    I found that a little surprising and upsetting about CloudFlare for example. The CTO is working from a beach town in Portugal but regular employees are bound to a physical office. Well, that's a pile of shit and completely false. Everything about that is false. I'm in Lisbon not some "beach town" (unless you're counting the capital of Portugal as a beach town). Employees have a huge amount of flexibility on using the Lisbon office or not. And this is 100% ‘cloud’ company where all your work is logging in remotely anyway. Not so sure about that. First meeting I have tomorrow morning is in person with member of the team in Portugal in the office. It's true that I have a lot of video calls, but not really a surprise given that Cloudflare has offices all over the world. We have more than 200 employees in Portugal and I'd guess around 40 in the office at any one time.
    - mdrzn 4y ago
      Do you have an HN Alert about "Cloudflare" appearing in comments?
      - jgrahamc 4y ago
        Yes. I have my own mechanism for various things on HN and I get emailed about comments.
    - disgruntledphd2 4y ago
      To be fair, Lisbon is both the capital of Portugal and also sortof a beach town.
      - jgrahamc 4y ago
        Yeah but we have more than 200 employees here. It's not like I'm all alone!
        zen_1 4y ago
        Nah, this must all be an elaborate ruse to distract us from the armies of cloudflare devs chained to their laptops in some desert.
- thwawaywfh3958 4y ago
  I’ve seen people go so far as to rent a SF apartment and setup a vpn to claim location based pay.
- jeffwask 4y ago
  It all feels so very fragile. You are one forgetful moment from me seeing an alert for impossible travel.
  - jobs_throwaway 4y ago
    And then what? If you care more about compliance than the employee, you fire them and they do the same thing somewhere else a month later.
    - jeffwask 4y ago
      And... you don't think there are companies and leadership teams that think this way.
      - jobs_throwaway 4y ago
        there surely are, I just don't think its a big deal for any competent employee
  - gruez 4y ago
    Yes, of course. You'd want to claim that you're in the same state/country but live 200 miles away from company offices.
  - Nextgrid 4y ago
    If you set up your entire home network to tunnel back via the VPN, it's basically bulletproof. The failure mode would be "no connection", not a leak via the local, non-VPN'd connection. You can even maintain an actual air gap between the 2 networks with one device that handles the tunneling and exposes an ethernet port that's only ever bridged to the VPN interface, and the normal router's WAN port connected to that. I have such a setup - the local connections at the end-user sites are inexpensive consumer-grade connections (because they are cheaper and quicker to set up than a proper leased-line which has months of lead time, and you're not going to convince small restaurants/coffee shops that they need to spend 500 bucks/month for a leased line to serve public Wi-Fi) with various bullshit such as filtering, dynamic IP, etc - but the network hardware tunnels back to my infrastructure and abstracts away all the intermediary connections, giving them a "clean" Ethernet port. As a bonus, it can tolerate intermediary connections failing without dropping in-flight TCP connections, since those run over the tunnel rather than the raw interfaces which have gone down.
- pessimizer 4y ago
  Or you can set up a personal VPN at your apartment. Just tell your AirBnB not to touch the computer in the closet.
- izacus 4y ago
  Which then turns this kind of adventure into deliberate (tax and other) fraud with all the consequences that might entail.
  - asdff 4y ago
    People in tech have already been doing stuff like working three jobs at once for decades. Sometimes these people will comment on here how they do all this juggling in their careers and keep each employer blind to the other. It's old hat that the tech worker will develop a way to squeeze more money out of their employers. Should be expected at this point.
justmestanding 4y ago
You would have to be in the stone ages not to heard of VPNs or believe that the origin IP is correct. But maybe I like that you exist. I've helped a few remote workers with this setup. Always a stable VPN - be careful some of the low cost ones - any lifetime bullshit deals - anything listed on stacksocial - anything less $5/m - they change their IP registrations so even if you are connected to SF one day it shows correctly the next the day it shows Pakistan - use something like Mullvad or better yet Tailscale exit node from a stable VPN provider in your specified location of working - heck just setup tailscale on raspberry PI at your parents/friends. Modify route tables so you never hit the web unless connected via VPN, easy on some Asus routers. Adjust the time and TZ on your PC to place of registered work time,that web based homebrew HR system could be doing something crafty . Deep latency hacks - use RDP from place of registered work
throwaway09223 4y ago
It's not a matter of hiding. Companies do not want to know. I guarantee that in many (likely the vast majority) of these cases someone in management is aware and is pursuing a don't ask don't tell policy because they don't want to deal with the fallout. It's extremely common to work while on a visitor's visa in another country, for example. I bet there is not a single manager reading this comment who has not had one of their employees send work emails while traveling internationally on a visitor's visa. I have several friends who are doing the digital nomad thing, working all over the world while ostensibly traveling on visas that prohibit work. If they officially asked HR, HR would be forced to officially tell them to not work. But they're never going to ask, and their direct managers are never going to report the situation. I know of several situations as well where the employee moved. The company response is pretty much universally "you can't do it so please don't tell us about it because if it's ever put in writing we have to act on it"
- justmestanding 4y ago
- kube-system 4y ago
  Sending an email on vacation is one thing. Setting up residency is something else entirely.
  - sfvegandude 4y ago
    Not to the country you’re visiting. I had to attest to the German government that I would not send any emails or write any reports on my recent work trip there. Else, I needed a work permit.
    - kube-system 4y ago
      I was careful not to say it was allowable to send emails on vacation from anywhere. Because, as you illustrate, it isn’t. I am saying that magnitude of the problem will be significantly more if you lie about residency.
  - 4y ago
an1sotropy 4y ago
The article details the levels of active deception that one of these covertly-overseas employees has gone through, involving virtual environments and VPNs. The rare employees that are this determined are probably more determined than a compliance officer.
- ciabattabread 4y ago
  I don’t understand why “Matt” would talk to the press if he truly wanted to keep his deception secret. Because once he gets caught and narc’d on by his employer for obtaining a visa under fraudulent pretenses, with this article as evidence, his travel options are gonna get limited.

gruez 4y ago

That can be bypassed by using a residential/LTE VPN. They're not as easy to get a hold of as regular VPNs, but if tens of thousands of dollars on the line I think tech workers can manage.

Temporary_31337 4y ago
Or you know just having a small room with a server rented that you ssh or vpn through. I think by the time an employer gets into such arms war with the employees, it’s time to have a hard look in the mirror and see where the CEO is working from. I found that a little surprising and upsetting about CloudFlare for example. The CTO is working from a beach town in Portugal but regular employees are bound to a physical office. And this is 100% ‘cloud’ company where all your work is logging in remotely anyway.
- NovemberWhiskey 4y ago
  What's upsetting about an employer and employee agreeing on a working arrangement? If you want to work from a beach town in Portugal, negotiate it.
  - pessimizer 4y ago
    For some people that seems like negotiating an agreement with your employer about changing your hairstyle, or buying a new tv.
    - NovemberWhiskey 4y ago
      Then find an employer who thinks the same way. If you agree to work for a company that says "your place of employment is X" then you'd better be OK with that. Anything is just rationalization.
  - pzh 4y ago
    If you ask your employer to work from Lisbon as opposed to SF, you'll likely get a 3x-5x reduction in total compensation. I doubt Cloudflare (or any other) CEO's compensation will get the same readjustment for cost of living if he moves from the SF office to the Lisbon office.
- jgrahamc 4y ago
  I found that a little surprising and upsetting about CloudFlare for example. The CTO is working from a beach town in Portugal but regular employees are bound to a physical office. Well, that's a pile of shit and completely false. Everything about that is false. I'm in Lisbon not some "beach town" (unless you're counting the capital of Portugal as a beach town). Employees have a huge amount of flexibility on using the Lisbon office or not. And this is 100% ‘cloud’ company where all your work is logging in remotely anyway. Not so sure about that. First meeting I have tomorrow morning is in person with member of the team in Portugal in the office. It's true that I have a lot of video calls, but not really a surprise given that Cloudflare has offices all over the world. We have more than 200 employees in Portugal and I'd guess around 40 in the office at any one time.
  - mdrzn 4y ago
    Do you have an HN Alert about "Cloudflare" appearing in comments?
    - jgrahamc 4y ago
      Yes. I have my own mechanism for various things on HN and I get emailed about comments.
  - disgruntledphd2 4y ago
    To be fair, Lisbon is both the capital of Portugal and also sortof a beach town.
    - jgrahamc 4y ago
      Yeah but we have more than 200 employees here. It's not like I'm all alone!
      - zen_1 4y ago
        Nah, this must all be an elaborate ruse to distract us from the armies of cloudflare devs chained to their laptops in some desert.
thwawaywfh3958 4y ago
I’ve seen people go so far as to rent a SF apartment and setup a vpn to claim location based pay.
jeffwask 4y ago
It all feels so very fragile. You are one forgetful moment from me seeing an alert for impossible travel.
- jobs_throwaway 4y ago
  And then what? If you care more about compliance than the employee, you fire them and they do the same thing somewhere else a month later.
  - jeffwask 4y ago
    And... you don't think there are companies and leadership teams that think this way.
    - jobs_throwaway 4y ago
      there surely are, I just don't think its a big deal for any competent employee
- gruez 4y ago
  Yes, of course. You'd want to claim that you're in the same state/country but live 200 miles away from company offices.
- Nextgrid 4y ago
  If you set up your entire home network to tunnel back via the VPN, it's basically bulletproof. The failure mode would be "no connection", not a leak via the local, non-VPN'd connection. You can even maintain an actual air gap between the 2 networks with one device that handles the tunneling and exposes an ethernet port that's only ever bridged to the VPN interface, and the normal router's WAN port connected to that. I have such a setup - the local connections at the end-user sites are inexpensive consumer-grade connections (because they are cheaper and quicker to set up than a proper leased-line which has months of lead time, and you're not going to convince small restaurants/coffee shops that they need to spend 500 bucks/month for a leased line to serve public Wi-Fi) with various bullshit such as filtering, dynamic IP, etc - but the network hardware tunnels back to my infrastructure and abstracts away all the intermediary connections, giving them a "clean" Ethernet port. As a bonus, it can tolerate intermediary connections failing without dropping in-flight TCP connections, since those run over the tunnel rather than the raw interfaces which have gone down.
pessimizer 4y ago
Or you can set up a personal VPN at your apartment. Just tell your AirBnB not to touch the computer in the closet.
izacus 4y ago
Which then turns this kind of adventure into deliberate (tax and other) fraud with all the consequences that might entail.
- asdff 4y ago
  People in tech have already been doing stuff like working three jobs at once for decades. Sometimes these people will comment on here how they do all this juggling in their careers and keep each employer blind to the other. It's old hat that the tech worker will develop a way to squeeze more money out of their employers. Should be expected at this point.

justmestanding 4y ago

You would have to be in the stone ages not to heard of VPNs or believe that the origin IP is correct. But maybe I like that you exist. I've helped a few remote workers with this setup. Always a stable VPN - be careful some of the low cost ones - any lifetime bullshit deals - anything listed on stacksocial - anything less $5/m - they change their IP registrations so even if you are connected to SF one day it shows correctly the next the day it shows Pakistan - use something like Mullvad or better yet Tailscale exit node from a stable VPN provider in your specified location of working - heck just setup tailscale on raspberry PI at your parents/friends. Modify route tables so you never hit the web unless connected via VPN, easy on some Asus routers. Adjust the time and TZ on your PC to place of registered work time,that web based homebrew HR system could be doing something crafty . Deep latency hacks - use RDP from place of registered work

throwaway09223 4y ago

It's not a matter of hiding. Companies do not want to know. I guarantee that in many (likely the vast majority) of these cases someone in management is aware and is pursuing a don't ask don't tell policy because they don't want to deal with the fallout. It's extremely common to work while on a visitor's visa in another country, for example. I bet there is not a single manager reading this comment who has not had one of their employees send work emails while traveling internationally on a visitor's visa. I have several friends who are doing the digital nomad thing, working all over the world while ostensibly traveling on visas that prohibit work. If they officially asked HR, HR would be forced to officially tell them to not work. But they're never going to ask, and their direct managers are never going to report the situation. I know of several situations as well where the employee moved. The company response is pretty much universally "you can't do it so please don't tell us about it because if it's ever put in writing we have to act on it"

justmestanding 4y ago
kube-system 4y ago
Sending an email on vacation is one thing. Setting up residency is something else entirely.
- sfvegandude 4y ago
  Not to the country you’re visiting. I had to attest to the German government that I would not send any emails or write any reports on my recent work trip there. Else, I needed a work permit.
  - kube-system 4y ago
    I was careful not to say it was allowable to send emails on vacation from anywhere. Because, as you illustrate, it isn’t. I am saying that magnitude of the problem will be significantly more if you lie about residency.
- 4y ago

an1sotropy 4y ago

The article details the levels of active deception that one of these covertly-overseas employees has gone through, involving virtual environments and VPNs. The rare employees that are this determined are probably more determined than a compliance officer.

ciabattabread 4y ago
I don’t understand why “Matt” would talk to the press if he truly wanted to keep his deception secret. Because once he gets caught and narc’d on by his employer for obtaining a visa under fraudulent pretenses, with this article as evidence, his travel options are gonna get limited.