7 ms·

Never Use Glassdoor from Work

53 points by logn 12y ago

serve_yay 12y ago
Boy, I'm not sure lack of SSL is the reason you shouldn't do this!
- mikeash 12y ago
  One of the interesting tidbits of information that came out of the Lenovo spyware fiasco was that companies routinely MITM SSL traffic by installing their own certificates on company computers. Unless you own and fully control the hardware you use at work, you should just assume the company can see anything you do with it, regardless of how encrypted it looks.
  - deleted 12y ago
    [deleted]
  - daheza 12y ago
    My work does not even bother to install the certificate on the individual machines. I get unsigned cert errors all day long.
    - Noelkd 12y ago
      I would guess you use firefox which doesn't use the certs installed on the host machine by default, I also see unsigned cert errors all day long!
- newman314 12y ago
  General rule of thumb: NEVER conduct personal business on work equipment and vice versa.
  - johnward 12y ago
    I'm curious about this. What are the risks? I use my work device for everything. I can't afford to buy a laptop just for personal usage.
    - dijit 12y ago
      they can fire you for misuse of company property. check your contract. Undoubtedly they have a clause stating you must use your work device for the companies interest only.
      - sukilot 12y ago
        Mine explicitly does not. But I don't work on top-secret projects and I dont work for jerks.
        mdekkers 12y ago
        A lot of companies, especially smaller ones (like mine) will have a clause like that not to be jerks, but to protect themselves. We have a clause like this in our contract. Do I care if our devs spend time on Facebook, or whatever? Not really - I am interested in their output and productivity, and however they are comfortable in producing their output is fine by me. I did have an administrative employee recently that spent all her time on Facebook, and didn't produce any useful output at all, and clearly had to be let go - we tried to work with her to improve, but she just didn't care. Under the employment laws of the country where we operate, it is very hard to fire somebody. Performance related dismissals take forever, and are very expensive in terms of administrative, legal and opportunity costs. Larger companies can probably afford that, but small companies like ours cannot. Our choices are simple: Either spend a lot of time, money and effort in trying to get the person fired on the basis of insufficient performance, where the outcome isn't certain, and where we likely have to end up paying a few more months salary even if we are successful, or pull her up for provably excessive use of company computers during work time for private purposes, and fire her on the spot. Does that make us jerks? I don't think so.
    - caseysoftware 12y ago
- pseudonym 12y ago
  >Malicious or Stupid? Funny, for a second I couldn't tell if this was about Glassdoor itself or the people who browse it from work.
- serve_yay 12y ago
  Also, personally I wouldn't pay much mind to Glassdoor's rankings. I used to work for a company whose business is reporting on other companies. This place often seeks "best place to work in America" type accolades from the press. After making a deal to show Glassdoor data on their site, this company magically started topping the Glassdoor list of "best places to work" for its particular size group!
totalrobe 12y ago
Cloudfare has SSL even in their free accounts http://www.cloudflare.com/plans http://www.cloudflare.com/plans
- loosescrews 12y ago
  True, but it is only SNI. That won't work on Windows XP and Android 2.x. I suspect that the extra cost to get traditional SSL would be worth it for Glassdoor.
  - Someone1234 12y ago
    I agree with that as far as Glassdoor is concerned. However on a more general basis: I really am done caring about people still using Windows XP. I have a little sympathy for people still on Android 2.xx because those phones got sold way too long. But Windows XP hasn't been sold for almost ten years and has been EOL for more than a few. On this topic: Does Chrome for Android 2.xx support SNI?
    - rgbrenner 12y ago
      On this topic: Does Chrome for Android 2.xx support SNI? There is no Chrome for Android 2.x... Chrome requires android 4.0+.
    - wbkang 12y ago
      Chrome does not run on Android version below 4.0.
CHY872 12y ago
Right advice, wrong reason. Any moderate sized company will be aware that SSL makes it harder for their corporate traffic monitoring to work. They don't want SSL usage to render their monitoring software useless, so they install their own SSL root certs on machines, and relentlessly MITM all SSL traffic. In this case, how can SSL help? More to the point, the corporation generally has a right to monitor all computer usage you do on their machines - so posting disparaging comments about them on their own machines is a particularly dumb idea - not withstanding the Google Chrome 'Incognito Mode cannot protect you against people standing behind you' warning.
- adrianpike 12y ago
  What's an easy way to find out if they're doing this? Taking a look at the certs installed in my system, unless I see "BigCo MITM Cert", I don't have a ton of insight on what certs are and aren't supposed to be there. Also, I'm not 100% on where all certs would be found, and short of looking at the trust chain on each site I visit, I'm not actually sure how to know.
  - freehunter 12y ago
    I don't have a good answer to your question other than "assume they are". And that's the best answer in my opinion. It's not just installing a cert on your machine that can MITM your SSL connection. Proxy servers can often terminate SSL connections and re-sign them before delivering the content to you as well. Just assume your workplace has the ability to monitor all of your activity on your work-owned computer, because whether they do or do not watch you, the capability for them to watch you does exist.
    - adrianpike 12y ago
      I definitely agree on that being the best answer - it's a pretty silly game to start playing to try and pull one over on an employer. :) That said, I do wish there was a tool I could use to verify the cert authorities installed on a device I own or buy. On the far end of the spectrum, I've purchased a sketchy Android tablet once from AliBaba - that was rife with oddness. Also - wouldn't a proxy terminating & then re-signing show up as a different signing authority or cert, assuming they didn't have their own authority installed on my machine?
junto 12y ago
Golden rules to live by: Never use work computers for personal use, period. Your work contract more than likely specifically includes a clause. Been there, got the T-shirt, been escorted off the premises (for sending personal emails on work time), whilst working for large US corp. This was over 15 years ago when I was starting out and I learned a very valuable lesson. If you are a 'trouble maker' i.e. someone who asks too many undesirable questions or rocks the boat, then HR will find a way to fire you. Your work contract protects them and not you.
- colechristensen 12y ago
  The key isn't to have hard rules to live by. Know your employer. I, for example, have no interest in working for a company where casual personal communication would get a person fired.
  - junto 12y ago
    I thought I knew my employer at the time. I joined a progressive ground breaking (large) team. Bosses came and went. I was naïve.
    - makeitsuckless 12y ago
      Bosses don't even have to come and go. The existing bosses just have to be desperate enough. Surprisingly, this is especially true if the bosses are the original founders.
- caseysoftware 12y ago
  It goes beyond personal use. Odds are you signed an agreement that says "Anything I do using company resources is owned by the company."* So you have to be careful for any open source work, startup ideas, etc that you may have. Don't do it at work or on your work machine (even at home). * If your agreement says "everything you do is ours," it's already too late for you. I never sign those contracts.
- cloakandswagger 12y ago
crazycanuck 12y ago
Canary is an anonymous, secure alternative I've been working on. Check it out if you'd like: www.canaryapp.net
pythonistic 12y ago
I worked for a company (Overstock.com) that on more than one occasion, during company-wide townhalls, requested that employees use Glassdoor to review the company. The feedback was reviewed by senior management to look for places to improve.
inmyunix 12y ago
so, what about SMS on corporate phones? ... do I even want to know?
limeyx 12y ago
Darn it. Now my boss has probably tracked me reading an article about not reading glassdoor from the company network!

53 points by logn 12y ago

serve_yay 12y ago

Boy, I'm not sure lack of SSL is the reason you shouldn't do this!

mikeash 12y ago
One of the interesting tidbits of information that came out of the Lenovo spyware fiasco was that companies routinely MITM SSL traffic by installing their own certificates on company computers. Unless you own and fully control the hardware you use at work, you should just assume the company can see anything you do with it, regardless of how encrypted it looks.
- deleted 12y ago
  [deleted]
- daheza 12y ago
  My work does not even bother to install the certificate on the individual machines. I get unsigned cert errors all day long.
  - Noelkd 12y ago
    I would guess you use firefox which doesn't use the certs installed on the host machine by default, I also see unsigned cert errors all day long!
newman314 12y ago
General rule of thumb: NEVER conduct personal business on work equipment and vice versa.
- johnward 12y ago
  I'm curious about this. What are the risks? I use my work device for everything. I can't afford to buy a laptop just for personal usage.
  - dijit 12y ago
    they can fire you for misuse of company property. check your contract. Undoubtedly they have a clause stating you must use your work device for the companies interest only.
    - sukilot 12y ago
      Mine explicitly does not. But I don't work on top-secret projects and I dont work for jerks.
      - mdekkers 12y ago
        A lot of companies, especially smaller ones (like mine) will have a clause like that not to be jerks, but to protect themselves. We have a clause like this in our contract. Do I care if our devs spend time on Facebook, or whatever? Not really - I am interested in their output and productivity, and however they are comfortable in producing their output is fine by me. I did have an administrative employee recently that spent all her time on Facebook, and didn't produce any useful output at all, and clearly had to be let go - we tried to work with her to improve, but she just didn't care. Under the employment laws of the country where we operate, it is very hard to fire somebody. Performance related dismissals take forever, and are very expensive in terms of administrative, legal and opportunity costs. Larger companies can probably afford that, but small companies like ours cannot. Our choices are simple: Either spend a lot of time, money and effort in trying to get the person fired on the basis of insufficient performance, where the outcome isn't certain, and where we likely have to end up paying a few more months salary even if we are successful, or pull her up for provably excessive use of company computers during work time for private purposes, and fire her on the spot. Does that make us jerks? I don't think so.
  - caseysoftware 12y ago
pseudonym 12y ago
>Malicious or Stupid? Funny, for a second I couldn't tell if this was about Glassdoor itself or the people who browse it from work.
serve_yay 12y ago
Also, personally I wouldn't pay much mind to Glassdoor's rankings. I used to work for a company whose business is reporting on other companies. This place often seeks "best place to work in America" type accolades from the press. After making a deal to show Glassdoor data on their site, this company magically started topping the Glassdoor list of "best places to work" for its particular size group!

totalrobe 12y ago

Cloudfare has SSL even in their free accounts http://www.cloudflare.com/plans http://www.cloudflare.com/plans

loosescrews 12y ago
True, but it is only SNI. That won't work on Windows XP and Android 2.x. I suspect that the extra cost to get traditional SSL would be worth it for Glassdoor.
- Someone1234 12y ago
  I agree with that as far as Glassdoor is concerned. However on a more general basis: I really am done caring about people still using Windows XP. I have a little sympathy for people still on Android 2.xx because those phones got sold way too long. But Windows XP hasn't been sold for almost ten years and has been EOL for more than a few. On this topic: Does Chrome for Android 2.xx support SNI?
  - rgbrenner 12y ago
    On this topic: Does Chrome for Android 2.xx support SNI? There is no Chrome for Android 2.x... Chrome requires android 4.0+.
  - wbkang 12y ago
    Chrome does not run on Android version below 4.0.

CHY872 12y ago

Right advice, wrong reason. Any moderate sized company will be aware that SSL makes it harder for their corporate traffic monitoring to work. They don't want SSL usage to render their monitoring software useless, so they install their own SSL root certs on machines, and relentlessly MITM all SSL traffic. In this case, how can SSL help? More to the point, the corporation generally has a right to monitor all computer usage you do on their machines - so posting disparaging comments about them on their own machines is a particularly dumb idea - not withstanding the Google Chrome 'Incognito Mode cannot protect you against people standing behind you' warning.

adrianpike 12y ago
What's an easy way to find out if they're doing this? Taking a look at the certs installed in my system, unless I see "BigCo MITM Cert", I don't have a ton of insight on what certs are and aren't supposed to be there. Also, I'm not 100% on where all certs would be found, and short of looking at the trust chain on each site I visit, I'm not actually sure how to know.
- freehunter 12y ago
  I don't have a good answer to your question other than "assume they are". And that's the best answer in my opinion. It's not just installing a cert on your machine that can MITM your SSL connection. Proxy servers can often terminate SSL connections and re-sign them before delivering the content to you as well. Just assume your workplace has the ability to monitor all of your activity on your work-owned computer, because whether they do or do not watch you, the capability for them to watch you does exist.
  - adrianpike 12y ago
    I definitely agree on that being the best answer - it's a pretty silly game to start playing to try and pull one over on an employer. :) That said, I do wish there was a tool I could use to verify the cert authorities installed on a device I own or buy. On the far end of the spectrum, I've purchased a sketchy Android tablet once from AliBaba - that was rife with oddness. Also - wouldn't a proxy terminating & then re-signing show up as a different signing authority or cert, assuming they didn't have their own authority installed on my machine?

junto 12y ago

Golden rules to live by: Never use work computers for personal use, period. Your work contract more than likely specifically includes a clause. Been there, got the T-shirt, been escorted off the premises (for sending personal emails on work time), whilst working for large US corp. This was over 15 years ago when I was starting out and I learned a very valuable lesson. If you are a 'trouble maker' i.e. someone who asks too many undesirable questions or rocks the boat, then HR will find a way to fire you. Your work contract protects them and not you.

colechristensen 12y ago
The key isn't to have hard rules to live by. Know your employer. I, for example, have no interest in working for a company where casual personal communication would get a person fired.
- junto 12y ago
  I thought I knew my employer at the time. I joined a progressive ground breaking (large) team. Bosses came and went. I was naïve.
  - makeitsuckless 12y ago
    Bosses don't even have to come and go. The existing bosses just have to be desperate enough. Surprisingly, this is especially true if the bosses are the original founders.
caseysoftware 12y ago
It goes beyond personal use. Odds are you signed an agreement that says "Anything I do using company resources is owned by the company."* So you have to be careful for any open source work, startup ideas, etc that you may have. Don't do it at work or on your work machine (even at home). * If your agreement says "everything you do is ours," it's already too late for you. I never sign those contracts.
cloakandswagger 12y ago

crazycanuck 12y ago

Canary is an anonymous, secure alternative I've been working on. Check it out if you'd like: www.canaryapp.net

pythonistic 12y ago

I worked for a company (Overstock.com) that on more than one occasion, during company-wide townhalls, requested that employees use Glassdoor to review the company. The feedback was reviewed by senior management to look for places to improve.

inmyunix 12y ago

so, what about SMS on corporate phones? ... do I even want to know?

limeyx 12y ago

Darn it. Now my boss has probably tracked me reading an article about not reading glassdoor from the company network!