5 ms·

It all feels so very fragile. You are one forgetful moment from me seeing an alert for impossible travel.

jobs_throwaway 4y ago
And then what? If you care more about compliance than the employee, you fire them and they do the same thing somewhere else a month later.
- jeffwask 4y ago
  And... you don't think there are companies and leadership teams that think this way.
  - jobs_throwaway 4y ago
    there surely are, I just don't think its a big deal for any competent employee
gruez 4y ago
Yes, of course. You'd want to claim that you're in the same state/country but live 200 miles away from company offices.
Nextgrid 4y ago
If you set up your entire home network to tunnel back via the VPN, it's basically bulletproof. The failure mode would be "no connection", not a leak via the local, non-VPN'd connection. You can even maintain an actual air gap between the 2 networks with one device that handles the tunneling and exposes an ethernet port that's only ever bridged to the VPN interface, and the normal router's WAN port connected to that. I have such a setup - the local connections at the end-user sites are inexpensive consumer-grade connections (because they are cheaper and quicker to set up than a proper leased-line which has months of lead time, and you're not going to convince small restaurants/coffee shops that they need to spend 500 bucks/month for a leased line to serve public Wi-Fi) with various bullshit such as filtering, dynamic IP, etc - but the network hardware tunnels back to my infrastructure and abstracts away all the intermediary connections, giving them a "clean" Ethernet port. As a bonus, it can tolerate intermediary connections failing without dropping in-flight TCP connections, since those run over the tunnel rather than the raw interfaces which have gone down.
- ev1 4y ago
  There is a difference if it is your own vs corporate hardware: MDM can enable wifi remotely, then do a location scan against wifi networks nearby (ostensibly this is for theft purposes)
  - Nextgrid 4y ago
    If you really want to do this and fool wireless location, I wonder if a client running at the "real" location can run something like airodump-ng and send the received (B|E)SSIDs to the remote end where a fake AP spoofs them. You don't actually need to break any crypto to do this, simply broadcast the same networks with the same security parameters (even if the key itself is different). Signal strength will be an issue but it's probably still good enough to fool the system into returning an inconclusive result. Tampering with the wireless card to prevent it from receiving anything is also a solution.

And then what? If you care more about compliance than the employee, you fire them and they do the same thing somewhere else a month later.

jeffwask 4y ago
And... you don't think there are companies and leadership teams that think this way.
- jobs_throwaway 4y ago
  there surely are, I just don't think its a big deal for any competent employee

gruez 4y ago

Yes, of course. You'd want to claim that you're in the same state/country but live 200 miles away from company offices.

Nextgrid 4y ago

If you set up your entire home network to tunnel back via the VPN, it's basically bulletproof. The failure mode would be "no connection", not a leak via the local, non-VPN'd connection. You can even maintain an actual air gap between the 2 networks with one device that handles the tunneling and exposes an ethernet port that's only ever bridged to the VPN interface, and the normal router's WAN port connected to that. I have such a setup - the local connections at the end-user sites are inexpensive consumer-grade connections (because they are cheaper and quicker to set up than a proper leased-line which has months of lead time, and you're not going to convince small restaurants/coffee shops that they need to spend 500 bucks/month for a leased line to serve public Wi-Fi) with various bullshit such as filtering, dynamic IP, etc - but the network hardware tunnels back to my infrastructure and abstracts away all the intermediary connections, giving them a "clean" Ethernet port. As a bonus, it can tolerate intermediary connections failing without dropping in-flight TCP connections, since those run over the tunnel rather than the raw interfaces which have gone down.

ev1 4y ago
There is a difference if it is your own vs corporate hardware: MDM can enable wifi remotely, then do a location scan against wifi networks nearby (ostensibly this is for theft purposes)
- Nextgrid 4y ago
  If you really want to do this and fool wireless location, I wonder if a client running at the "real" location can run something like airodump-ng and send the received (B|E)SSIDs to the remote end where a fake AP spoofs them. You don't actually need to break any crypto to do this, simply broadcast the same networks with the same security parameters (even if the key itself is different). Signal strength will be an issue but it's probably still good enough to fool the system into returning an inconclusive result. Tampering with the wireless card to prevent it from receiving anything is also a solution.