News for hackers. Stuff that matters.
Re:When you type realty.com into Safari it takes you to real... by ncmncm on Thursday June 25, 2020 @11:19PM (#23648334)
Please remind me not to work where you do.
Re:When you type realty.com into Safari it takes you to real... by dahart on Friday June 26, 2020 @12:05AM (#23648606)
How about a reminder to not work where you do?

Unless you’re running the company, and you’re the only employee, your work internet usage is being monitored and logged at some level. Believing otherwise is giving your employer a very generous benefit of the doubt, let’s say, but still probably naive. It’s worth understanding why all companies might be required by law to monitor, or short of that, be incentivized to monitor employee internet usage:

https://en.wikipedia.org/wiki/Respondeat_superior

https://www.spamtitan.com/web-filtering/liability-for-employ...

Re:When you type realty.com into Safari it takes you to real... by qhwudbebd on Friday June 26, 2020 @06:15AM (#23650409)
Disclosure: UK business owner and employer but no US employees. For us here at least, there’s no such requirement to betray the trust of our staff and spy on them, and we don’t do so. To be honest, the idea that anyone might consider this an acceptable behaviour never occurred to me. I’d like to think this is the norm but have no data either way.
Re:When you type realty.com into Safari it takes you to real... by dahart on Friday June 26, 2020 @11:13AM (#23652875)
The UK is definitely different than the US, and it looks to me like in the UK employees do have slightly higher expectations of privacy at work than in the US. However, some quick googling show me that UK employers are allowed to monitor employee internet usage in general.

When you say you don’t log or monitor usage, have you actively audited your company equipment and disabled all logging? Have you contacted your ISP and cloud providers to discuss what data they have? Aside from your company network equipment, it’s not easy to make sure you’re not “monitoring” from the employees perspective, if you provide company computers or phones, or any cloud services to your employees.

As a business owner, what would you do if you were contacted with a cease and desist letter from another company claiming your business domain was doing something illegal? What would you do if one of your employees told you another employee was doing something illegal at work and the employee denied it?

I do find your language interesting, especially as a business owner. Using the words ‘betray’, ‘trust’, and ‘spy’, seems like a very one-sided view of the situation, and one that comes with some assumptions. In the US, most employment contracts, and employee trainings, will disclose the fact that company equipment is monitored for aggregate or individual behavior, and it is stated and agreed to that the equipment is for work use, not personal use. Because employees are notified and they actively agree to use work equipment for only work reasons, there is no “spying” or “betraying of trust” taking place. Trust goes both ways as well, and when an employee agrees to use work equipment only for work, and then turn around a browse Facebook while getting paid, or download porn from the work domain, the employees have not just betrayed the company trust, but have also broken their explicit agreements.

https://www.lexology.com/library/detail.aspx?g=0818e4d9-ee76...

https://www.spamtitan.com/web-filtering/liability-for-employ...

Re:When you type realty.com into Safari it takes you to real... by freehunter on Friday June 26, 2020 @08:52PM (#23658610)
Look up PCI-DSS, or Payment Card Industry Data Security Standard. It absolutely applies to the UK and absolutely requires centralized logging and review of those logs.

Centralized logging and review is the norm and I do have data to say that. You are wrong.

Re:When you type realty.com into Safari it takes you to real... by ncmncm on Friday June 26, 2020 @05:25AM (#23650179)
Nobody at my employer has time to waste on logging, never mind reviewing my internet usage. If they did, it would be unappealing just for wasting time on crap, all creepiness aside.

Now, of course, most of it never gets near the office.

Re:When you type realty.com into Safari it takes you to real... by reaperducer on Friday June 26, 2020 @11:22AM (#23652993)
Nobody at my employer has time to waste on logging, never mind reviewing my internet usage

Which is why there are dozens and dozens of companies to which this sort of thing is outsourced, either explicitly, or as part of some generic security "suite."

Re:When you type realty.com into Safari it takes you to real... by freehunter on Friday June 26, 2020 @08:46PM (#23658586)
Unless you work for an absolutely tiny company that outsources all of its financial operations, you’re absolutely wrong. If you have an info sec team, they’re monitoring you. If you don’t have an info sec team and you’re not at an absolutely tiny company, like others have said there is a third party monitoring you.

Payment Card Industry (PCI) and Sarbanes-Oxley (SOX) regulations both require centralized logging and review of those logs for audit reasons.

Basically if your company provides health insurance or processes payments, your activity on all corporate machines are being aggregated and monitored. Even GDPR has a loophole for information security monitoring.

Re:When you type realty.com into Safari it takes you to real... by dahart on Friday June 26, 2020 @10:57AM (#23652673)
Nobody anywhere has time to waste on logging, and nobody really wants to review employee internet usage. That doesn’t mean it isn’t taking place. What makes you so certain it isn’t happening to you? Logging doesn’t take time, it’s automated, and nobody has to actively review internet usage, it can happen as needed when either some automated alarm goes off or when your company is contacted by another company or an ISP or the government regarding internet usage. Your GP comment above feels quite flippant, and makes me suspect you might not be aware of the realities of running a company, and may be lacking imagination for the kinds of things IT teams anywhere have to do just to set up a network and provide internet access to you, not to mention establish security rules, create QOS tables, and deal with real-world employee behavior. A lot of corporate routers and other network appliances do some level of logging by default.

Maybe you work for a tiny startup that hasn’t started logging your usage yet, but pretty much all non-small companies in the US have to have automated monitoring of usage for liability reasons (I guess you didn’t actually read my links). Many companies need to know how much time employees spend on Facebook while at work in the aggregate, and while finding that out might seem creepy, what’s also creepy is employees being on Facebook while they’re getting paid to work. Even if you don’t, some people have problems with this and spend a lot of time on Facebook, or other sites, while getting paid to supposedly work. Internet usage monitoring is often the result of employee complaints to management about other employees.

One company I worked at received legal threats from a media conglomerate because of torrent sharing of new release movies. Turns out the employee was just downloading porn because the work internet connection was much higher bandwidth than his home connection, and a hidden bot in the software he was using was doing other illegal torrent activity. The company didn’t figure it out immediately because they weren’t creepily actively reviewing internet connections, but between the logs that were there and some sleuthing, they figured out who the employee was. My company didn’t give a crap about the porn (though told the employee please never do that at work) but the movies being shared could have been millions of dollars in damage.

If you are at a small company that isn’t monitoring yet, and your company grows, it will happen to you eventually. Otherwise, if you’re not at a small company, chances are high that you already are being logged and don’t know it. In any case, there’s no good reason to pass judgement on HN users who work for companies that do this; it’s ubiquitous and there is no clear cut line on where monitoring begins, and more importantly no reasonable expectation of privacy while at work in the US, except in the bathroom.

Aside from all that, your ISP and the backbone providers and the ISPs of every site you visit is - 100% chance - monitoring connections. The majority of commercial sites on the internet are gathering analytics. Facebook and Google are watching everything they possibly can. Your employer monitoring may be the least of your problems, as long as you’re not surfing all day at work.