Since it is only 1 of the 8 IP addresses; the other 7 remain free from blockages of any kind and the one running the TOR middle relay is setup in a manner in which I can use it normally (for the most part) and my traffic would just "blend in" with the normal tor traffic passing through it.
You might ask, what is the purpose of this? Well, if it is normal for a lot of TOR middle relay traffic to be passing through one of my IP's on a daily basis, plausible deniability becomes a real defense as checking DNS logs becomes a moot point as there are requests being routed 24/7/365.
Edit: https://hacky.solutions/blog/2020/06/06/operating-a-tor-rela...
This is an excellent, detailed, and in-depth guide of the process of going through running a TOR middle relay. The statistics provided and data presented are simply superb, Great read!
In addition, there is also this for those that do not want to go through the hassle: https://blog.cloudflare.com/welcome-hidden-resolver/
Cloudflare runs their own DNS Tor resolver.
[0] Even with GDPR and similar legislation all they need is a valid business reason and they can keep my PII.
You mean you had to currently be working there, rather than formerly? I thought this lawsuit was about people who had already left Zuru, but I may have misread the article.
(I don't know much about Tor, so am I missing something about 'middle relays' that such a site would want to allow them?)
Edit: oh is the point that you're not accessing the site using Tor, just from an IP addociated with Tor use?
Presumably most folks neither know or care about this distinction and just block all Tor related infrastructure outright, since some of the traffic coming through is malicious.
It's not illegal, but it's also not surprising when such folks are escorted out.
If it’s a company provided laptop then it’s a good idea to assume that every keystroke, DNS request, and network packet is fair game.
Laptops are cheap. There’s no reason to mix personal and corporate usage.
From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it.
You might also get a phone call (on your private phone) about a private medical matter while at work, but I would hope your employer couldn't use the CCTV audio they have in the office to decide to fire you based on that information (though I don't know if US laws actually protect workers in this case -- in Australia and basically all of Eastern Europe this would be insanely illegal on several levels).
> Laptops are cheap.
Not for everyone.
How often did that stop an employer?
>Commenting on the ruling, Pam Cowburn, the communications director at in London, said: “The European court’s ruling is welcome. In some workplaces, it may be necessary for emails to be monitored, but if employers are going to do so, they should make staff explicitly aware of it.”
>Despite finding that Bărbulescu’s rights under article 8 of the convention had been violated, the court declined to award him any compensation, saying the ruling was “sufficient just satisfaction”.
The largest example probably is the 2020 GDPR fine of 35 million euro for clothing retailer H&M for violating the privacy of their employees, despite the employees being informed of that.
In most EU countries, tracking company-owned hardware is explicitly okay, and where it's not mentioned in law there are judicates that make it OK.
As I said, even the government and its wholly/partially owned enterprises are doing it, and working as a contractor for the government here requires you to track usage of your employees' workplace computers too, so I can't see how it could be in any way illegal. Same thing with working for banks and insurance, and I bet there are more cases.
Don't know about other EU countries, but at least NL deviates significantly from the sketched scenario.
[1] https://blog.iusmentis.com/2017/11/22/wanneer-mogen-mailbox-...
Still cheaper then searching for a new job... without a current one.
(This probably doesn't work so well in the US.)
Wow
Don't use work computers to look at porn, your employers already know about it.
Basic human needs and rights only make sense in the context of the society in which said humans are a part of.
Homeless? Not a problem in nomadic tribes. Cities? Basic need / right.
Access to food services? Not a problem for the Buddhist monk. Cities? Basic need / right.
Electricity? Not a problem for the Amish. Cities? Basic need / right.
Internet? Perhaps not as established as the above, but definitely establishing itself very quickly in most cities.
Moreover, seeing the right to be paid for jerking off while at work as fundamental human right is really unhinged.
The way I look at it (and not saying it is the best way, just works for me) is that my public/professional person is my brand that the world sees and thinks of when I interact with them. Regardless whether that is big brother junior analyst in IT or a client CEO, I try to keep that consistent and inviting.
If on the weekend I want to only drink Soylent, trade crypto, and otherwise engage in fun but less inviting behaviors, I'll do that off company property.
It was actually kinda a joke with my friend when used to help him code. Leave something nasty open just for amusement.
One good reason is that porn sites are notoriously riddles with browser 0 days. To this day I get the odd Safari crash every other month.
Apparently nobody cares about anyone else's most basic needs like food (even our most vulnerable), I can't see how they'd care about someone else's need to jerk off.
But they were quite frank about allowing us to do what ever we want on the laptops providing we delivered positive outcomes for the business.
If this meant the laptops were used to browse porn at home or even during business hours (clearly not on the shop floor if you were in the office) or playing video games, it was fair game.
This employer also had _incredibly_ poor standards and culture for removing misogyny and bigotry, in fact it was one of the worst I've ever seen. Not saying causation = correlation or similar but an interesting data point nonetheless.
I think that the periodic checks were set up because a subordinate of the manager's had seen the porn on the machine, and had gone to HR.
In the USA and other countries with subpar privacy laws.
https://www.grcworldforums.com/business/can-employers-legall...
It is very hard to see the Workplace Relations Commission (WRC - the body which handles workplace disputes) accepting that identifying a user on Glassdoor would meet the test of being necessary, legitimate, or proportional. This is particularly true as the WRC has previously found that monitoring internet usage for example for pornography is not proportionate where the employer has the option instead to block such sites and make a policy against their access.
Of course, an unscrupulous employer could also use surreptitious surveillance and find another reason to let the employee go, although firing an employee in Ireland is notoriously difficult short of gross negligence.
The US is more "employer-friendly" if you like, and much less complicated to fire employees (boo!) compared to Europe - yes. But generally not categorically different when it comes to the right of employers to snoop on their employees, which people here might want to be aware of.
Understatement of the year.
For the employer to open/read such communication would be highly illegal, akin to opening others private snail mail.
I do believe that this also extends to corporate issued phones and computers. Especially since you’re automatically taxed for “private use” of such equipment when assigned.
so you get charged a tax when an employer gives you equipment required for work? What happens if you can't afford that tax then?
This feels very wrong - taxing someone for a potential benefit when it is not proven that such benefit exists.
The vast majority of people prefer to also use the car privately, and pay the tax (which is reasonable, if taxation is reasonable).
Cars that keep rotating between drivers are not subject to that (but exact record keeping of driver and trip required to avoid tax)
Similarly, employer provided phone subscription is assumed to be partly private use (50% of monthly subscription cost considered a a taxable benefit iirc), not sure what hoops you need to jump through to prove it is not private use at all. (But phone plans are cheap - excellent domestic plans are $10 or so)
Obviously this only happens when the equipment you get can plausibly be used for personal purposes. Such as a company car.
> What happens if you can't afford that tax then?
That's extremely unlikely.
I think you need to specify "here" to get an answer to that question.
That has nothing to do with putting private email in a private folder on the company mail server, near as I can tell, and nothing in that statement would address the statement about companies monitoring use of company equipment and network etc.
Since they’d need to know even in the private email case what they folder names were, for instance, to know there even WAS private email.
People have legitimate expectations of privacy in the office and/or during working time.
Employment means selling your skills and effort, not becoming a servant or a slave in a feudal society.
Additionally, having delicate information in the hands of the company in general or sysadm/security engineers create a ton of liabilities.
There has to be a balance between security needs, corporate surveillance, privacy and worker rights.
That requires them to use tools which can easily let them know, for instance, what websites someone is visiting, and what executables are executing on the machine, what devices are being accessed and when, etc.
It’s pretty fundamental. An individual looking to secure their machine would need to do the same thing.
If a company abuses that to spy on every waking moment of an employee, that is obviously abusive (barring cases of investigating legitimate suspected abuse by the employee I guess?). But you’d need to somehow codify in law the line, and I haven’t see anyone having any success here so far.
I have seen employees steal massive amounts of trade secrets, secretly steal customers from employers, run porn sites from company equipment, etc.
I’ve also seen employees so creepy stuff like stalking customers, stalking other employees, harassing other employees using this tech too.
Personally, I’ve always kept employer laptops and stuff closed and off when not used, and try to segregate personal and work equipment, but that’s been more to avoid something embarrassing coming up during a presentation or the like.
People could be making backhanded deals on their phones or they could be having an urgent confidential conversation with their doctor or spouse. Should the company record and review phone calls?
People could be stalking customers/coworkers or making deals in the bathroom. Or they could be using it for more personal purposes. Should the bathrooms have CCTV with audio?
People could be selling company data in the company parking lot, in the mall or at home near/using the company laptop/phone that is permitted to be used for personal reasons, or just mandated to be near them, or they could do the same thing without presence or use of any company equipment. Where do you draw the line, and at what point is it even sufficient to prevent losing information etc.?
Do you trust your employees? All trust can be abused, yet how can the company function if they don't trust their employees at all?
Imagine I were to die in the office in some embarrasing way, on company time, in full view of company CCTV, do they have the right to upload the video to YouTube to make money from it?
What if they record audio of me at home, can they publish it? Can they show it to anyone at the company?
What if audio is recorded outside of compaby time by a company laptop thats had its lid closed? What if it's recording 24/7?
Are they allowed to snoop on traffic of my home network? If I have a home camera thats not password protected, can they help themselves to that Video?
If my network drive has no password, is it okay if they help themselves to those files?
I can't think of which law stops a company sharing a video of your death - presymably they own the copyright
Even more restrictive countries like Germany are fine with this.
Your advice is still sound.
Exactly! I'm always amazed at people who do ANYTHING personal on corporate resources, especially in this day and age. Even when personal computers were rare and cost thousands of dollars I still didn't do jack shit on work computers, no matter how tempting or "acceptable use" it was.
It’s a nightmare from a privacy point, but its also a problem for the InfoSec tools… How do they distinguish between an unmanaged private device on a private network or a unmanaged device on a corporate network?
Trivially, from the simplistic (check IPs and router MACs / SSID in use) to the marginally more advanced (deploy an agent that is only reachable from the corporate network) to determine if the tool should even be running in the first place.
E.g. tag the port on the switch, run a cable to the device so that it doesn't know there's a vlan involved, block routing between vlans. As far as I can tell that's probably good but might not be.
I manage a company's google workspace, and we don't have managed browsers or devices, and no one has ever asked to have that capability.
Or the first case when some shared credentials get compromised probably from an infected computer and now you need to find which of the 80 laptops is the infected one.
Or the first time employee converts his laptop into a wifi access point for the office girl upstairs and unknowingly lets her inside your companies private network.
Of course, there are workarounds and better practices for every example. You can solve it without admin access to laptops and network request logging. But company property is not anonymous either with or without full admin access - so why jump trough the hoops to not have it?
I never understood people who use their work/school machines to do stuff that could hurt their employer/school. Or even just to cause them potential problems.
But of course, the other way around is true imo: I won't use my personal devices for work - but that's mostly to prevent me from giving free extra work time to my employer.
Edit: yikes, people.
(SV reference)
Be smart kids. Do your employer bashing at the public library.
If you care at all if your company would see it, _don't_ do it anywhere near their hardware.
Any email provided to Glassdoor should be a burner on a service that is not one of the majors (no gmail) also set up with Tor browser, specifically for Glassdoor (and used for no other purpose).
Finally, the text that is posted should be somewhat disguised if possible, with altered vocabulary, atypical slang, and distinctly different grammar and sentence structure. Any facts that can reveal identity should be removed.
Under no circumstances should a native Android/iOS app be used to post or access any such review.
It sounds like we will have examples soon of what happens without these precautions.
I imagine that many reviews will be coming off Glassdoor's site rather soon.
https://www.google.com/search?q=Glassdoor+Alert:+Employer+Le...
-Steidle
-legatum
-Medspira
-Media Consulta
-Keller, Fishback & Jackson
-ABG Accessories
-Echelon Environmental
-Admiral Markets
-canidae
-Discovery Clinical Trials
-kraken
-zuru
-bw legal
-kurland
-SynapseFI
https://help.glassdoor.com/s/article/Glassdoor-Alerts-Badge-...
Based on the wording on this page you have to be pretty flagrant to get a warning sign attached to your company.
- Oct 12, 2022 "They fired Bobby!!! Bobby's been working with us for 10 years and they fired him overnight?? Told you that place is bonkers!"
- Oct 14, 2022 "Mona's down, I repeat Mona's down!! This is a sinking ship! Do not attempt to join this place!!!"
Meanwhile in the C-suite's office.
"Seriously, who is this guy?"
Have everyone's siblings read all the reviews and see if anyone recognized it?
(the non-trivial possibility they'll get the wrong person isn't going to stop fingers being pointed)
“We are deeply disappointed in the Court’s decision, which was effectively decided under New Zealand law.”The place was a toxic personality cult around the owner/manager, and I left a Glassdoor review saying as much. Someone at the company found it within a couple months, and then overnight several current employees had posted glowing reviews refuting mine. Certainly we wouldn't expect a personality cult to launch an Internet brigade to protect the boss' ego.
* psyops: running/scurrying in your periphery
mentioning personal things from your personal/sex life yesterday, but addressed to others
compliment you for bad work, berate for good work
silent treatment
throwing out your performant code and replacing it with trash
employees one after each other, one by one turn against you, trying to give you the impression you are going insane... imagine you talk with someone on a daily basis and then all of a sudden he refuses to interact with you or gives you looks and avoiding you
slamming doors
doing borderline insane things before you, like getting elbow deep in the toilet then smiling at you
pretend face to face that nothing happened
"oldworld" things
etc etc
This oppressive system must be burned down, nuked big time.
Is this supposed to be a moral obligation? I'd be careful about putting moral obligations on other people.
At some point in the gig, one of their clients went to them asking them if it was possible to de-anonymize someone glassdoor review since someone still-employed worked with them. They then went to me to see if I could do it for them. They didn't clarifywhy they went to me, but I legitimately think they wanted me to "hack" glassdoor. I told them in no uncertain terms that I wouldn't do it and they backed off.
A bit later they fired the employee.. I didn't hear how they found the person, but it really spoke to the lengths that some organizations will go to burn down the lives of those who speak up.
Use this google search to find more companies that do it: