Slashdot Mirror
Ask Slashdot: What's Your Take On HTTPS Snooping?
First time accepted submitter jez9999 writes "I recently worked for a relatively large company that imposed so-called transparent HTTPS proxying on their network. In practice, what this means is that they allow you to use HTTPS through their network, but it must be proxied through their server and their server must be trusted as a root CA. They were using the Cisco IronPort device to do this. The "transparency" seems to come from the fact that they tend to install their root CA into Internet Explorer's certificate store, so IE won't actually warn you that your HTTPS traffic may be being snooped on (nor will any other browser that uses IE's cert store, like Chrome). Is this a reasonable policy? Is it worth leaving a job over? Should it even be legal? It seems to me rather mad to go to huge effort to create a secure channel of communication for important data like online banking, transactions, and passwords, and then to just effectively hand over the keys to your employer. Or am I overreacting?"
It's a good idea to not access personal bank account from company computers anyway.
Data leakage can be done a myriad of other ways. And by the time you actually have analyzed the data (if anyone even looks at the reports after 2 weeks) the damage has already been done.
Custom electronics and digital signage for your business: www.evcircuits.com
You have zero expectation of privacy at work.
Since about 8 million people have said this now, I think the counterpoint needs to be stated.
You are correct, it IS their network and their rules, but that doesn't mean that it's a good idea for them to be a dick about it. I've worked for several large (over 100,000 employee) companies, and several medium sized (1000-5000) companies, and in every case, it was made clear that we were explicitly permitted to use work computers for minor or occasional personal use such as banking or email, but were expected not to abuse the privilege.
IT and programming type jobs are creative in nature. Sometimes it helps to walk away from a difficult problem for a few minutes to let your mind clear. It was always expected that you get your job done, but trying to enforce that every single moment you're sitting there you must also be working is just crazy. That's not how people are. It's much better to build an environment of mutual respect. That was understood in every job I've held.
Now, if you sit around for hours a day surfing the web, yeah, that's a problem and needs to be dealt with by your management. But if you log into some account to check your 401K for 5 minutes once a day? Getting all up in your face about that is going to be counterproductive; it'll make employees unhappy, and in being unhappy, they will be less productive and more inclined to get up in the company's face.
So you're technically right, but in any sense of wisely running a company, you're not. But of course, many companies are not run wisely...
60+ hour work weeks.
I think the important point to take home is that while there are ways to get around these transparent proxies that they cannot ultimately defeat, it is surely going to be logged and likely set off an alarm bell somewhere that you're tunneling garbage or seemingly-random data. Ultimately, the result of a proxied SSL session should be lots of recognizable text, maybe some graphics, and possibly email attachments. If what they see is something else, then it's clear someone is trying to rig the system.
You're on company property using their resources, they're free to kick you out once they see you're trying to hide information from them.
Of course, if the point is to STOP all leaks, then obviously they cannot do that as your method would allow you to leak information before you can be stopped. But you will be flagged.
it is COMPLETELY reasonable to not do anything personal on the internet while you're at work
It is also completely reasonable to not do anything work-related on your own time. Or during your lunch break. But in order to be explicit maybe it's a good idea to also specify the exact amount and duration of toilet breaks. Wouldn't want to anger our corporate overlords, now would we?
Or, alternatively, all parties concerned behave like adults. The boss only calls after hours if it is really important and trusts the employee not to goof off all the time, and in return the employee enjoys a modicum of trust and freedom without going too far.
People replying to my sig annoy me. That's why I change it all the time.
seriously, the sense of entitlement is a little annoying
I know right. I drives me crazy that the company thinks its entitled to encroach on my personal time. My boss call me at home on my day off... who the fuck does he think he is? Or expect me to reply to an email or check voice messages?
And that policy of showing up 10 minutes early? If they want the day to start 10 minutes early then they can pay me for that 10 minutes, and at over time rates to boot.
Seriously, the sense of entitlement some companies have is a little annoying.
If I'm expected to deal with their shit on my time, they can accomodate me dealing with some of my shit on their time.
Mutual respect is where its at.
I think you misunderstand the GP's point. You're using your employer's resources and on the clock, so you really shouldn't be doing things your employer wouldn't endorse, or at least approve of. What you do on your own time is damn well your own business, but what you do at work isn't.
Bullshit. There are laws against companies doing things like installing hidden cameras in the employee restrooms. This is the technological equivalent and should be just as illegal. I don't mind monitoring data flow. Although I think blocking things such as Gmail is stupid, at least the company is being up front about what they're doing.
But transparent SSL interception is deliberately posing to someone that they are communicating via a private channel when in fact they are not. It's just as egregious as telling employees, "You can change clothes in here, there aren't any cameras," when in fact there are and they're recording. It should be illegal, period.
This is the shit that criminals do, and any company that engages in this behavior should be thought of exactly in that light.
I hope you are not doing this in the UK... Its a breach of both the Data Protection Act and the Human Rights Act.
And whilst we (I work for a very large bank in the UK) block email and (lots) of other sites, just accessing (or attempting to) would not be a HR matter. e.g. we block youtube, and the amount of IT sites that include embedded links to videos (that are then blocked by the proxy server) are insane. Its hardly someones fault that it "looks like" they were trying to access a blocked site, when they didn't even know it was embedded in the webpage they meant to access. Same goes for twitter links, Facebook like links etc.
We are strongly regulated and log lots of things, but I would be concerned by your words of things like "fair game" etc. If it was found that IT (or anyone) looked through a users web history, or emails / phone calls etc without permission from HR, Legal and Director level management, that person would be handed over on a plate to the police.
We have someone at work that takes an 30 minutes (no exaggeration) to wash her hands both before and after using the toilet. This person will then call the tech department because she is not competent enough at her job of 20+ years to handle FTP uploads.
I'm not sure how that's relevant to this article, but just because someone can't use FTP doesn't make them useless. Our payroll supervisor calls IT for help to do her rare FTP transfers, yet she's very good at her job. When we were looking at a new payroll system, during the demo (and her first exposure to the system), she pointed out that their tax calculations were wrong. The company argued that it was not, but 90 minutes later after a conference call with a payroll specialist and engineer at the company, they found out that they had indeed set up their test system incorrectly, but no one ever noticed.
FTP isn't a critical job skill for many positions, and even though it's trivial for many Slashdot readers, it's not always trivial to the rest of the world. (i.e. "Why can't I use FTPS, the website says I need sFTP, isn't that the same?" "How do I use Passive mode?" "Binary mode - whats that?")
If personal use of company resources is a problem, it will show up in the employee's performance. If the employee's performance is not impacted, then why the fuck does it matter?
Do you think the company didn't know who you were communicating with?
Do you think they didn't have the ability to listen in without you knowing?
Of course they had those abilities, and some people did get fired over making personal calls.
I'm sure employers could, but I find it hard to believe that such routine monitoring would have been accepted for the above reasons. And were the employees fired because of the snooping on their phone calls, or because the employees became lax in their duties as a result of making personal phone calls? Actually, I'm not even sure how one could go about proving either side, since given the entire bloody planet I'm sure we could each find hundreds of cases to support our side.
Stop whining about a perk. You get them on their terms.
Careful, that's dangerously close to "you are not a starving kid in Africa, therefore you have no right to complain" thinking.
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-