6 ms·

Doesn't have to be a big Corp. Monitoring of screen activity, keystrokes, email/messaging communications, personal email/accounts via mitm, webcam, etc was done

Doesn't have to be a big Corp. Monitoring of screen activity, keystrokes, email/messaging communications, personal email/accounts via mitm, webcam, etc was done by my last employer. Management used it to play politics. Even learned from IT some managers used it to read the CEOs emails between them and their SO.

logifail 3y ago
> Monitoring of screen activity, keystrokes, email/messaging communications, personal email/accounts via mitm, webcam, etc was done by my last employer Honestly, why would one go anywhere near one's personal email account - or indeed one's personal anything - from any device owned or controlled by someone else, barring a complete emergency?
- blitzar 3y ago
  Most employees, most of the time ... In the old times people used their work email for everything - browse the ashleymadison leak from way back and you will likely find people registered using their @jpmorgan work email. https://www.marketwatch.com/story/these-bankers-used-their-work-emails-on-ashley-madison-2015-08-19 https://www.marketwatch.com/story/these-bankers-used-their-w...
- School-Cotton 3y ago
  Some combination of (1) I have no reason to suspect it’s being monitored, and (2) the amount it bothers me if in fact it is is minimal.
- deleted 3y ago
  [deleted]
hammock 3y ago
> personal email/accounts via mitm This one is the most out there for me. How common is that?
- simiones 3y ago
  It's pretty common for corporate networks to have MITM devices snooping on all traffic by default (usually exceptions are made for known medical sites and for high-bandwidth traffic like YT). This is a big enough use-case that special provisions were made for it in TLS 1.3.
  - hammock 3y ago
    Even if you’re not on the company vpn?
    - haspok 3y ago
      If you are using hardware provided by the firm, you ARE on the VPN. If not, network is blocked (as are all private hardware items like pen drives, for obvious reasons).
      - hammock 3y ago
        That’s not always the case
    - simiones 3y ago
      Normally not, but: to make the MITM work, your PC is pre-configured to trust the company's certificate authority as a trusted root. This is not a per-connection setting, it's a global setting in your browser(s) & OS. So, IF they have a technical way to intercept your traffic even if not connected to the VPN, this will keep working. Of course, in some other cases, a client proxy is configured instead of/in addition to a VPN, in which case obviously all your traffic will be sent to this proxy before reaching the internet.
- haspok 3y ago
  Very common in these circles (banking), and in most places it is even forbidden to log in to your private accounts from a company network. The popular options (eg. gmail, social media) are obviously blocked. This makes sense on multiple levels, for example stops you just uploading internal documents to your private account... Mitm is done via the proxy, which has its own SSL certificate, using company CA, so anything you send or receive is obviously captured and repackaged by the proxy. One more reason not to do anything related to your private life on company systems. TBH it is not that big a deal in this age of tablets and mobile phones and mobile subscriptions. A bit more annoying is the blocking of Stackoverflow, for example (you can read stuff, but you can't post / ask), for this reason internal QA sites exist, with more or less success. And by far the most annoying thing is that you cannot post to HN, well, at least it is not univserally blocked, otherwise you wouldn't be reading this post now... :)

logifail 3y ago

> Monitoring of screen activity, keystrokes, email/messaging communications, personal email/accounts via mitm, webcam, etc was done by my last employer Honestly, why would one go anywhere near one's personal email account - or indeed one's personal anything - from any device owned or controlled by someone else, barring a complete emergency?

blitzar 3y ago
Most employees, most of the time ... In the old times people used their work email for everything - browse the ashleymadison leak from way back and you will likely find people registered using their @jpmorgan work email. https://www.marketwatch.com/story/these-bankers-used-their-work-emails-on-ashley-madison-2015-08-19 https://www.marketwatch.com/story/these-bankers-used-their-w...
School-Cotton 3y ago
Some combination of (1) I have no reason to suspect it’s being monitored, and (2) the amount it bothers me if in fact it is is minimal.
deleted 3y ago
[deleted]

hammock 3y ago

> personal email/accounts via mitm This one is the most out there for me. How common is that?

simiones 3y ago
It's pretty common for corporate networks to have MITM devices snooping on all traffic by default (usually exceptions are made for known medical sites and for high-bandwidth traffic like YT). This is a big enough use-case that special provisions were made for it in TLS 1.3.
- hammock 3y ago
  Even if you’re not on the company vpn?
  - haspok 3y ago
    If you are using hardware provided by the firm, you ARE on the VPN. If not, network is blocked (as are all private hardware items like pen drives, for obvious reasons).
    - hammock 3y ago
      That’s not always the case
  - simiones 3y ago
    Normally not, but: to make the MITM work, your PC is pre-configured to trust the company's certificate authority as a trusted root. This is not a per-connection setting, it's a global setting in your browser(s) & OS. So, IF they have a technical way to intercept your traffic even if not connected to the VPN, this will keep working. Of course, in some other cases, a client proxy is configured instead of/in addition to a VPN, in which case obviously all your traffic will be sent to this proxy before reaching the internet.
haspok 3y ago
Very common in these circles (banking), and in most places it is even forbidden to log in to your private accounts from a company network. The popular options (eg. gmail, social media) are obviously blocked. This makes sense on multiple levels, for example stops you just uploading internal documents to your private account... Mitm is done via the proxy, which has its own SSL certificate, using company CA, so anything you send or receive is obviously captured and repackaged by the proxy. One more reason not to do anything related to your private life on company systems. TBH it is not that big a deal in this age of tablets and mobile phones and mobile subscriptions. A bit more annoying is the blocking of Stackoverflow, for example (you can read stuff, but you can't post / ask), for this reason internal QA sites exist, with more or less success. And by far the most annoying thing is that you cannot post to HN, well, at least it is not univserally blocked, otherwise you wouldn't be reading this post now... :)