Never do anything on work machines/networks you don’t want to have to explain to hr/legal.
Also do some really weird things that are innocuous so the HR lady looks at you weird from now on.
Examples please?
deleted by creator
Reload every five seconds the global doomsday countdown clock.
You sick €%#¥! /s
Absolutely. Everyone could use that reminder
Sr. Systems Admin here. IT does not give 2 shits about what you browse UNLESS something is reported or something trips our Alerts (has to be something major like Child Porn).
We don’t sit there and actively monitor and watch what you are browsing. We investigate when something is reported by a worker or an Alert/Filter gets tripped
HR also doesn’t know unless we tell them.
Yeah, but the it’s a good rule anyway, for some of the same reasons as the “Don’t put it in an email if you wouldn’t want it read aloud in a deposition” rule.
Some companies try to be incredibly controlling
Depends on the company size and the people above IT. Sometimes the boss is a chode and demands everyone be supervised like children constantly.
That’s still inline with what they said.
deleted by creator
Probably for audit/investigation reasons.
IT generally doesn’t care (doesn’t want to care) but you still shouldn’t do personal stuff on work machines/profiles.
Second. I once had a staff member come to me all embarrassed because someone sent a dick pick via some dating app while they was on our corporate wifi. I was like, “I promise we don’t care”.
I mean, its HTTPS right?
Https is no match for work monitoring: pre-installed software, certs.
That only applies to work devices. If you’re using your personal device, they would be able to see traffic to/from a dating website but not the actual content.
Pre installed certs would be a huge vulnerability
Uh no? Most organizations use preinstaed certs. They are usually baked into the Windows image for deployment… They are what allow a corporate device to connect to WiFi networks without a password.
I’m not sure what you’re saying? Those certs log to somewhere and in my experience HR is nowhere near technically literate enough to monitor and track that stuff.
Usually a manager asks a sysadmin to watch someone’s stuff, then the sysadmin and manager tell HR what they find.
We had a contractor spending 90% of his day on reddit who got fired. Hr wouldn’t have been able to pull this info since they don’t have access to the system that tracks it
All of the “privacy experts” in this sub wouldn’t know a certificate if it bit them in the ass. Most don’t even know of VPNs outside of the “privacy” services hawked by YouTubers.
Certificates can be used to authenticate machines to wired or wireless. This is true. They are much easier to maintain at scale than pre-shared key, especially when you run an internal CA and can issue or revoke them easily/automatically, and when you run a domain and can push out additional trusted root CAs to endpoints.
And if you have either an internal CA or a domain (ideally both), it’s very simple to have your firewall or web filter perform man-in-the-middle “attacks”. Most everything nowadays can handle TLS1.2 and many are starting to support TLS1.3. They essentially break open the traffic for inspection and re-sign it with a certificate that your system trusts so there is no error to the user. Some sites and apps have a hard time with this because of HSTS and pinning, but that’s a bit of a tangent.
I say “attacks” in quotes because they own the hardware and they own the time of the person using it.
Anyways, don’t do anything on a work computer you wouldn’t want your boss to know about. We usually aren’t actively watching the traffic, but some things are hard to ignore, and sometimes the CEO just wants to know who else has a diaper fetish for “official reasons”.
RADIUS doesn’t depend on preinstalled certs. But I wouldn’t use Windows anwyay.
if you don’t have your personal browsing using a private profile of a secondary browser which you know you can delete, you are doing it wrong.
Yeah, I can still see that activity. You’re still doing it wrong.
Personal device not on corporate network or you’re doing it wrong.
Sure but people see that you are on the phone while the IT people don’t really care what you do and by bosses aren’t checking those logs so idc. it’s about being discreet on some layers.
If I were at home I wouldn’t need to do anything to hide it since I would use my pc but since I’m in the office I have to get creative.
Also, 5hisbpost was 7 days old :)
As an IT administrator, if your org has GPOs controlling if you can delete your browsing history or not, there is no chance you will be able to install a second browser without admin credentials.
I can confirm there are places where that is possible.
Also as long as they do not whitelist executables, you could use a portable version of a browser.
And you would still get caught on the company device trusting company CAs, thus enabling them to decrypt all your traffic.
Use a personal device on a personal network for personal stuff.
I was talking about the history on device, of course I agree: never expect privacy on a device controlled by someone else.
That might not be enough. I could monitor that on all the devices I manage, if I need to. There are tools to dump browsing info as it’s being committed, or it’s easy to pipe all the traffic from your machine through a VPN to a firewall I manage with a trusted cert injection into your device and inspect the traffic in transit. If you don’t want your employer to see what your up to, don’t use their infrastructure.
Well, yeah, if I worked at home I would use my personal computer for personal things and the workstation for work, it would be pristine. But alas, in the office there’s so much time I can spend pretending that I’m working because I finished my tasks before I implode.
Some risks are necessary :)
It’s not really about IT not knowing, but about being discreet enough that your boss doesn’t see your personal accounts logged in or even worse, to have two chrome profiles, both with obscure names, press the wrong one and to share the screen of saved tabs with Facebook, Instagram, pornhub… Yeah I’ve seen those bookmarks.
It’s… Wtf… If you’re going to be that deranged, at the very least be discreet… Sigh.
Some risks are necessary :)
No, it’s zero-trust all the way down!
not really about IT not knowing
All true, and I’m sure your IT doesn’t care as long as you’re not taking stupid risks
If you’re going to be that deranged, at the very least be discreet
…
I’ve seen things you people wouldn’t believe… a folder full of photos of a sales rep’s feet taken under the table at a meeting… a bookmarked playlist of adult baby porn labelled “Potential Suppliers”… I watched a modded BitTorrent client try to fake VLAN tags for unrestricted Internet access. All those moments will be lost in time, like that expensive label printer from my locked desk drawer… time to get another coffee…
your work sees all your browser history
Possibly, if they’ve bothered to configure their machines that way. And only on the browsers they’ve configured that way and only on their machines.
Also, please don’t assume that your work operates the same way as everyone else’s work.
I’m not on the IT team but have elevated permissions. I can dial into any of my subordinates computers “invisibility” I might add, and watch their screen. I can copy data remotely. It’ll take me a few minutes to grab an image of their computer “for backup” reasons, restore it on another computer, and then safely view their history.
By invisibility, I still leave log traces on their computer.
I’m not going to, because wtf. But I totally do have that power.
We have that capability but dont really have the time or need for it. having said that, it only takes one rouge employee to mess it up for everyone else.
it only takes one rouge employee
What about a pink employee?
Sir, that is not an employee. That is a pig.
They were tickled?
They see and scan all traffic, even what doesn’t go through the browser.
No one should use work laptops other than for work
Yeah. Nobody competent is checking your browser history on your PC.
Until HR needs to dig up a reason to justify firing you.
But my state is at will employment only, so they don’t need a reason.
They still won’t be looking at your PC. They’ll look at the network logs.
Removed by mod
you don’t know shit about my work fuck you!
Well, since I am IT, I am not about go to snitch on myself.
deleted by creator
Most just monitor your browsing through the Antivirus.
Since they don’t want you visiting porn or malware websites on the corporate network, for good reasons.
Forget chrome management. Any IT shop worth their salt is protecting their egress with a proxy, explicitly or transparently set.
Don’t browse the net on your employer’s network or devices. Use your phone. Get on 4G/5G.
deleted by creator
I’m in the process of convincing my management to switch to Linux. The most important thing to them is having a way to remotely delete the pc in case it’s stolen. Does someone know of a solution in Linux for that?
Kind of yeah, the rest of the working world uses Windows for good reasons.
deleted by creator
Legacy software with incredible backwards compatibility, exponetially more software options, user familiarity, pretty much everything that active directory provides from user management to group policies, the list goes on.
Im a linux guy, but the thought of rolling out even the most user friendly linux distro gives me nightmares.
deleted by creator
Aren’t they? Changing a legacy app can take years to do the needed research, approval, procurement, and implementation. “Because my IT guy doesn’t like Windows” is a terrible reason to undergo that process.
The same with retraining users on a whole new OS. You’ll spend hours over the course of months answering “where did my C:\ drive go?”. That’s a lot of time you’ll never get back.
Active Directory provides a lot of tools that are familiar to senior techs and easy enough for junior techs to figure out. I might prefer how Salt Stack works but I don’t have time to train dozens of fellow techs.
Linux is cool for a number of reasons, but it isn’t a magic easy button and a wise admin doesn’t swap out fundamental parts of his tech stack without careful consideration.
I’m on Ubuntu at work! The only employee on Linux at a tech company of >150 people! (Where are my Linux nerds?)
I’m in a company that uses Microsoft stuff, but I use a lot of fedora and Linux mint in VMs. The latter is based off Ubuntu at least!
It’s actually kind of nice to be able to save the state of my VM since forced restarts are so infrequent.
deleted by creator
I’m using it, as well as my boss!
Oh no, my employer might find out I’m looking for other jobs after being overloaded for a year and a half and constantly having my concerns/feedback/process improvement initiatives brushed aside.
I have been hinting to my manager for 6-9 months that he needs to move part of my workload elsewhere so that I can focus and actually achieve something. To think, all it took was for me to tell him straight that I was unhappy and unfulfilled to the point that I was considering resigning. Suddenly he’s all apologies and let’s make changes because you’re kind of vital and we don’t want to lose you.
And I was fired for it. Depends on the market demand I suppose, some industries there is no denying your worth, in others you’re disposable.
I love the fact that firing me what the person you’re answering mentioned is illegal here.
Peace of mind.
Yeah pretty outrageous, I soon found out employment rights in Ontario Canada are practically useless. I had no idea, I thought I had some basic protections, it’s almost nothing.
Shot, i regularly browse jobs websites even though Im not looking to change jobs again soon. Just to keep them guessing.
My work has a 100% mandatory vpn and mitm proxy for ssl scanning. I just use parsec to view my laptop from my desktop and browse what I want on my actual personal computer
My work has a 100% mandatory vpn and mitm proxy for ssl scanning
These are worse than useless. They are anti safety. If this box or its private keys get compromised ALL tls traffic of all employees is immediately plaintext.
Any company that buys one of these appliances from mcafee or whatever is asking for it (losing most/all their secrets)
That sort of thing is required for a lot of enterprise certifications. When you do work for government, healthcare, banking, etc. stupid “security” is mandatory for checking off compliance requirements. Not that any of it has to be in any way effective…
when breaking the internet and end-to-end encryption are part of any kind of “enterprise certification” that certification is worthless (or worse) and probably some kind of chinese or russian (or the CIA or whoever, certainly not your friend) psyop. Only a mindless idiot would implement it.
Oh I 1000% agree. But you try to convince my opsec colleagues
Don’t forget the agents they install that take screenshots every 10 seconds!
Luckily my work hasn’t disabled the remote desktop application protocol. So I do the same, but without parsec.
Can’t install parsec on the work computer, and the web app displays a black screen.
So only watch mainstream porn on work computers, got it.
I’ve always assumed work will be looking at the browser history. Anyone who assumes they won’t is an idiot.
Softcore is expressly permitted in the IT policy.
Those IT guys need to get off as well you know.
Your work can also read your private Slack messages. You have been warned.
I was the slack admin. We could not see private messages of clients. We could see company wide channels.
They can see it. I know because someone had an HR investigation happening and they showed me screenshots of his Slack conversations.
If it was a screenshot then they didn’t get it from slack. They have spyware that takes screenshots.
Obviously if they install malware that records keystrokes or the screen then they can see what you type and what’s on your screen.
But slack doesn’t let admins export private chats
Then they must have been able to capture his whole screen. Idk how they’d do that days later, but they had a screenshot of a private conversation in slack. Maybe he had already set off some flags before then and they were watching him or something.
If I remember correctly you have to pay extra to be able to access private messages. Maybe you didn’t have this option enabled?
It actually depends on what tier of Slack license the company uses. Private is a black hole for anything short of Enterprise Grid, unless they reset your password and login as you, obviously doable but not at all subtle.
Are they really called private messages? They should just be direct messages
Anyone know exactly what they could see if you’re on a personal device but work-wifi?
Every URL visited minimum unless you are going to an encrypted VPN outside their network first, then they will still see the network traffic to that vpn . I Know someone that got caught redditing on work wifi. granted they also had their device name set to use their name in it… so some of that is on them
Not every URL, just every domain.
That’ll also depend on whether you’re on a personal device that’s using DoH (DNS over HTTPS). Which most phones do by default now. If you haven’t disabled that then they’ll only know IP addresses which are often not actually owned by or even unique to specific websites these days.
Usually the websites and apps you use, but not what specific page you visit and it’s content.
If you for example visit https://en.wikipedia.org/wiki/Labor_unions_in_the_United_States they could see that you visited https://en.wikipedia.org/ but nothing more.
This is assuming that the website is encrypted (it starts with https://, not http://), which nowadays luckily most websites are. Otherwise they can see the specific page, it’s content and most likely also all information you input on that page.
I see, thanks
My work runs MITM with corporate certificates, so they can see everything no matter whether it’s encrypted or not. If you don’t accept the certificates to let them monitor, you can’t browse.
Therefore, I just don’t use it.
WTF?
Depending on the nature of the work and security protocols it isn’t the WTF. When you’re working, on your work device, on the work network, there is zero assumption of privacy (and there really shouldn’t be). The company wants to maintain it’s security and so it is ensuring it is aware of things happening on its network.
It’s not necessary for everyone everywhere but it has valid use case that isn’t some mega shady weird thing.
Is that for the VPN, or actually all wifi connections? Not sure how it would be possible for wifi
Corporate networks (especially those utilizing MITM) block vpn access altogether.
You can’t reach your vpn server, falling back to plain un-tunneled https. Then instead of dns retuning the true ip, it returns a local corporate ip; you connect to that with https and it serves you a cert generated on the fly for that particular domain signed by a root cert your browser already trusts. Your browser sees nothing wrong and transmits via that compromised connection.
You can usually check for this by connecting via mobile data, taking a screenshot of the cert details, then doing the same on work wifi and compare.
If the cert details change on wifi, your traffic is being intercepted, decrypted, read/logged, then re-encrypted and passed to the server you’re trying to reach.
I was talking about work VPN, the thing I connect to every morning to access work’s internal services.
I don’t see how a 3rd party device connecting to wifi can have https MITM. Otherwise many wifi out there would do it and steal your info.
deleted by creator
Can you link to something with more info on how it works? I know how certs work and CAs but not how some random wifi network can hijack that whole trust system. It sounds like it would defeat the whole purpose of https. Thanks in advance.
I never browse personal stuff on a company device. That’s what phones are for. I also don’t connect to company Wi-Fi on any personal device, because my company makes me sign in with my company’s credentials. This should be common sense.
Smart. Everyone reading this thread who cares about privacy and separation of work and personal life should follow your lead.
This is why my phone will never join the company wifi.
You could join using a vpn on your phone.
The few I tried back in the day were blocked at my company.
