Capture traffic and sue the f outta everything they do that‘s not covered by a contract.

Someone has to start stopping this madness and protect less informed people. We are all steering into a dark future. And i lose hope when i see all these smart programmers complaining but not stepping up.

> Capture traffic and sue the f outta everything they do that‘s not covered by a contract.

Whatever the app they would ask you to install would do probably is going to be allowed by its EULA (and I bet the EULA is also going to prohibit you from analyzing the app and whatever it does/communicates) and chances are you don't read it. And even if you do you most probably agree because you know all EULAs are brutal and there never is a button to object its specific part and continue.

What we need is legislation to recognize all the data and metadata about your PC, all its software, your home networks&devices and their usage a kind of personal data and apply the same rules GDPR applies to tracking cookies - giving you the right to continue without agreeing to be spied on.

EULA has nothing to do with this. Question is whether software installed by company you’re working for spies on you in ways you haven’t agreed to. If so, sue them, not the co that wrote the spyware.

EULAs are irrelevant if they go against the law. You don’t renounce all your rights because some law intern wrote in the EULA that you sold yourself into chattel slavery. And for those things you can give up (such as some of your data) you have to give explicit consent, clicking “I agree” under a 500 page unreadable legal document is not enough.

EULA is between the user and the vendor of the software, it isn't a agreement between the user and the users employer. Capturing traffic like that runs afoul of hacking laws.

The employer can just give you an executable and say you must install it. The executable would show you an EULA and require you to accept it.

That's a stretch.

Most companies don't want to spy on their employees' free time. They want to 1- make sure they are compliant with the law and their confidential stuff is secure and 2 - make sure that you are actually working for them when you say you are.

Installing something to listen to non-work related stuff serves neither of these goals, and would open them up to lawsuits and PR nightmares.

The people who decide the spyware must be installed are likely so far removed from the actual spyware and the people who admin it as to have no knowledge or understanding of the distinction.

Network segmentation with vlan is what I would do.

Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well.

(I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)

As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you

Mini-rant: people on hacker news frequently undervalue their knowledge and don't consider the things they know to be of much worth. A classic example of this is the "I can't see why dropbox is a thing, simply build a cloud file sync service - easy" post. This poster is running their own semi-professional router (pfsense) on whitebox hardware. I would not want to do that unless I already knew what I was doing or wanted to spend some time learning.

The type of network segmentation being discussed is not rocket science, but it's not trivial either. VLAN segmentation can have tricky edge cases that cause things to break in a non-obvious way, nothing that can't be worked around but for someone who "isn't well versed in networking" would probably be more than you're up for. Also keep in mind that you can't do this with most consumer networking gear becasue it's too complicated to setup and support without some experience and knowledge.

I'd not recommend VLAN segmentation unless you want to become someone who is more versed, which I don't oppose, but it's not a switch you can flip in 5 seconds and never think about it again.

I very much agree with this. I don't think that this is the solution for most home users/consultants working from home.

The more obvious solution would be to get a separate WiFi router and internet connection strictly for work purposes.

At that point you could also consider it a 100% home office expense and it may be tax deductible (talk to your accountant).

Can one use two internet connections from a single phone line?

Yes.

Sure. I didn't actually use a VLAN: I had a spare TP-Link router lying around, so I installed OpenWRT[1] on that and gave it a static IP on the home network side, then plugged it into my broadband provider's box. On the cloud side, I basically followed a guide, maybe [2] but I don't remember exactly. Once I had pfSense installed, I first set it up as an OpenVPN server.

I then went back and configured the OpenWRT box to create a WiFi hotspot and serve DHCP on a different subnet to that used by the home network. I configured an OpenVPN client tunnel from the router to pfSense, then set up a NAT ("masquerade") from the segregated network into the tunnel. I think I actually left a couple of ports open on the OpenWRT from the segregated network, but properly I should have firewalled them off so that the router was only accessible from the home network, since I doubt OpenWRT has been seriously pen tested by anyone. I'd probably also use Wireguard if I did it again.

The above config worked, but the CPU on the TP-Link was too underpowered to get more than a few Mbit/sec throughput. Since I didn't particularly care about having a VPN (I was going to throw this traffic on the internet anyway), I messed around and managed to change the tunnel type to L2TP. L2TP pretty much just takes the packet you give it and adds a UDP header for routing, so that approach gave me full bandwidth. I think I had to mess around a bit more getting MTUs set correctly to account for the L2TP header, and maybe had some trouble with auto-restarting the tunnel on failure.

One of the (flagged) responses to my original comment was "Who the fuck has the time to do that?" I actually think that is a fair comment. This all took a day or two to set up and debug, it isn't something that the casual user is going to do and, to be honest, I probably wouldn't have done it either except that I wanted to play with pfSense.

I'd do it again, though -- it was fun.

[1] https://openwrt.org/

[2] https://silasthomas.medium.com/how-to-import-a-pfsense-firew...

Thank you! Though I agree with the sibling comments that it's probably not something to dabble in unless you're pretty confortable with this... May I ask, is this somewhat in your area of expertise, what kind of development do you do (supposing you're a developer?). Sorry if too inquisitive, just curious :).

I think you should dabble in it! This stuff isn't magic, it's just a bit esoteric in places. That makes it a great (and valuable) skill to learn.

I do cyber/data stuff, often on the network-y end.

This is what I do for a variety of different things:

  - $CORP devices are on a VLAN + Wifi that has access to the internet, but no other internal networks
  - Internal network for file servers/printers and the like
  - Personal device network, think laptops/phones/tablets that are mine, can reach internal network
  - IoT network - Think sensors/robot vacuums/"smart devices"
  - Guest network, for well visitors to my home
  - AirPlay network, has all my Apple devices on it to allow for music to be airplay'ed to TV's/HomePods, can be reached from internal/personal/guest network

Now I also understand that I am outlier, I am running a fully segmented, firewall, traffic inspected/logged home network with small business or even large business network gear, with FreeBSD as the router/firewall with a managed switch/WAP platform from TP-Link.

This is not something the average home user or consultant is going to setup/configure/manage and I don't expect it either.

The worry that the $CORP device will be abused to "validate the security of the network its connected to" is very much a possibility. Most corporations have no desire to do so, and endpoint protection is their primary goal, and they don't need to scan your home network to do so, it is all local to the device. It's about protecting the integrity of the device, not the rest of the network around it.

Which TP-Link switch do you use?

I use the Omada SDN business line-up.

> And they will install a trojan

They WILL

> which would eavesdrop your talks

That absolutely WILL - use the microphone and listen to everything being said (why not the camera too and watch everthing?)

> scan your home network and analyze its traffic.

That absolutely WILL - do all this stuff

I mean if this is definately going to happen, then the company can go ahead and cut an 8 figure cheque straight away. Which company and where do I sign up?

> why not the camera too and watch everthing

Because who doesn't have a lid/sticker over their webcam yet?

I have also kill-switched the built-in mic in the BIOS set-up but I'm not sure how secure this is. I would prefer there to be no built-in microphones in any hardware (except phones) at all. Sadly every modern laptop is equipped with a mic.

Most mics have mediocre sensitivity. Stick a blob of blu-tack or similar cohesive putty on it, take it off when you want to use the mic. Test by making recordings -- some machines have two or three mics.

That's one plus point for desktops and nettops with no-frills motherboards. No mic, no speakers, no bluetooth, no wifi.

If this is really the kind of things this company would do… why are you working for them?

Because people need money to pay bills. And it's a sad fact that companies who do shady shit tend to have more money. Simply because they outcompete companies who don't, all else being equal.

Tugging against this evolutionary pressure is really hard, not only for individuals but also on the society level.

"Just quit LOL!" is a commendable act of grassroots activism, but not everyone is able (or willing) to afford such luxury.

> If this is really the kind of things this company would do…

Because, until last week they didn't.

Now I have to figure out if I'm just an unreasonable, stubborn old guy, or if this requirement is out of band.

Tell them to provide you with a Virtual Desktop or a dedicated Laptop..never install Spyware on your own machine.

I like others idea of getting them to spring for a dedicated computer. You just have to make it palatable to their accounting department. Maybe lease a laptop and expense the payments or something. If you have an accountant, I'd consider asking them for suggestions on "good ways" on how to make your client pay for your laptop.

In my case, I just outright said "hey, you guys I really want you to be my client but I'm gonna need a new laptop". So we bought a new laptop as part of the contract.

Presumably the client will terminate your contract with them if you don't comply. So you don't actually have to install the agent until the day that they terminate the contract which is also the day that you no longer have to install the agent.

It is out of band. Refuse or this becomes normal.

That's why you tape off cameras and stick a needle in condenser mics on any new laptop.

Don't they use MEMS microphones nowadays? (https://en.wikipedia.org/wiki/Microelectromechanical_systems) Either way, solid advice!

Learn a thing every day I guess. Nonetheless, is inconsequential to task at hand if you apply the "Rosemary Kennedy" method to the laptobotomy: activate the mic, jam that needle in the hole and wiggle it around until the girl can no longer sing, no activity is detected on the vu-meters and nothing is played back in the recording.

You have audio-video input sensors on all sort of programable devices nowadays, even some TVs can be turned into two way communication devices. That's a nice 1984ish vibe to ruin your late night matrimonial TV browsing.

sticking a needle in a MEMS microphone is just as effective, you just have to [find the damn thing, and] push the needle all the way through!

If brute force isn't working, you're just not using enough of it yet.

Where are these IT depts that have all this unlimited time and resources to spy on their employees?

Sure you might get a bad actor voyeur, but as a matter of policy, companies just don't care what you're doing at home as long as their security interests are protected.

Don't put a work laptop on your internal home network!

I have a separate network for work machines at home, which goes straight to Internet and can't route in or out of my actual home network which is behind its own firewall.

Go to your router's settings and create a separate wifi for just these work situations. Connect client hardware to that wifi only. This keeps them out of your LAN. If your router can't do this, get a better router.

You keep your work laptop in your home network? Tut tut.

If I couldn't trust my company on my home network, why would I work for them?

> If I couldn't trust my company on my home network, why would I work for them?

Your employer isn't your friend.

It might be an awesome company to work for perhaps, but it's still a company (unless you work for like a 2 person startup). A company subject to audits and regulations and all kinds of other pressures (some of them actually valid, though many are theater) to monitor and control data and flows on their hardware.

You don't want those monitors etc on your personal data and network which has nothing to do with work.

So, keep them separate is the best possible advice.

Yes my company monitors the network at work and on my work computer, as they must do so.

But they are not allowed to scan my home network and other devices, and they have no reason to break the law. I trust them to not do that more than half of the devices running on my home network.

Many of these technologies have been built in the assumption of a world where they run in the company LAN.

No reason to trust, better to isolate.

My employers laptop is in a separate VLAN. What makes you sure that no-one else than the employer has access to it. This laptop has Windows 10 installed for example. And a shit-ton of McAfee crap. I would trust my employer but not the many companies who have a foothold on the machine as well because my employer is too cheap to install decent stuff on it.

I work frim home ... pandemic and all that. What else am I supposed to do?

VLAN is the obvious and most cost-effective mitigation

Not really. VLAN provides segmentation, but it does not provide any mechanisms to limit access to other vlans in your network - which are most likely routed by your router. You will need to add some L3 filtering (acls/iptables/whatever) to isolate segments.

That's only true if use of VLAN tags is controlled by hosts; if you use a smart switch to assign VLANs to ports it's pretty much as-if you have multiple, physically separated networks.

You'd still need the router to tag/untag those VLAN's and allow traffic to flow. So if the router does VLAN tagging but just routes between the different network segments you haven't fixed anything.

You'd also need a firewall, and to configure it correctly.

All nice, but now you need managed switches and stuff plus some amount of unbillable time to configure it all and fix it when it breaks. Might be worth it if your bill rate accommodates it though.

Segmenting your broadcast domains doesn't help much if traffic is routed freely between them.

Sounds like a great approach. Any recommendations for such a switch for WFH?