Ask HN: My client want an agent on my laptop. Is this the new normal? • Hacker News Board

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#371

Post by blihp » Fri, Dec 17, 2021, 5:20 PM UTC

gnfargbl wrote: post #45

If you are a freelancer then your contract should allow you to do work for others. In which case, your response to this client has to be "Sorry, but my business laptop potentially has data from other clients on it. I can't let you install this monitoring agent without violating my contractual confidentially agreement with those other clients. I always maintain client confidentiality and will do the same for you. If y…

Keeping their software segregated is sound advice, but as they are your client there are a couple of other ways I'd offer to handle it:

1) Keep all software related to work for their company segregated inside a VM. Then you can install whatever they require without interfering with your main system or potentially exposing data for other clients.

2) If they want a separate physical system, tell them you would be happy to provide it for a fee: an upfront fee for the cost of the system and an ongoing fee for maintenance of it. Be sure to mark everything up as you don't work for free.

Since you're not an employee, you really shouldn't be asking them to provide hardware as (in the U.S., at least) this could create tax problems.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#372

Post by nathias » Fri, Dec 17, 2021, 5:20 PM UTC

No, tell them this is not acceptable and don't do it. If you do or try to find some excuse it will only further this type of behavior.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#373

Post by swagasaurus-rex » Fri, Dec 17, 2021, 5:20 PM UTC

mandelbrotwurst wrote: post #369

selfhoster11 wrote: post #211

Earlier quoted context omitted.

Arguably, the new laptop being difficult to procure is a feature, not a bug. It serves as a deterrent to installing that agent, if it's easier to just make an exception.

It also creates friction for the client, making it less likely that you get paid.

Wouldn't the source of the friction be them asking to install spyware on your personal machine?

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#374

Post by gnfargbl » Fri, Dec 17, 2021, 5:23 PM UTC

lambdaba wrote: post #240

gnfargbl wrote: post #62

Earlier quoted context omitted.

Yep, exactly. I used to put client devices on a segregated network and tunnel their traffic out to pfSense running on a cheap cloud box somewhere. Worked well. (I should say that intentional monitoring of my private comms was never a concern for me when I freelanced, but I was somewhat worried about infections in my clients' devices moving laterally to my home network.)

As someone who isn't well versed in networking could you describe your setup in overview? Like, what software/hardware, etc.? Thank you

Sure. I didn't actually use a VLAN: I had a spare TP-Link router lying around, so I installed OpenWRT[1] on that and gave it a static IP on the home network side, then plugged it into my broadband provider's box. On the cloud side, I basically followed a guide, maybe [2] but I don't remember exactly. Once I had pfSense installed, I first set it up as an OpenVPN server.

I then went back and configured the OpenWRT box to create a WiFi hotspot and serve DHCP on a different subnet to that used by the home network. I configured an OpenVPN client tunnel from the router to pfSense, then set up a NAT ("masquerade") from the segregated network into the tunnel. I think I actually left a couple of ports open on the OpenWRT from the segregated network, but properly I should have firewalled them off so that the router was only accessible from the home network, since I doubt OpenWRT has been seriously pen tested by anyone. I'd probably also use Wireguard if I did it again.

The above config worked, but the CPU on the TP-Link was too underpowered to get more than a few Mbit/sec throughput. Since I didn't particularly care about having a VPN (I was going to throw this traffic on the internet anyway), I messed around and managed to change the tunnel type to L2TP. L2TP pretty much just takes the packet you give it and adds a UDP header for routing, so that approach gave me full bandwidth. I think I had to mess around a bit more getting MTUs set correctly to account for the L2TP header, and maybe had some trouble with auto-restarting the tunnel on failure.

One of the (flagged) responses to my original comment was "Who the fuck has the time to do that?" I actually think that is a fair comment. This all took a day or two to set up and debug, it isn't something that the casual user is going to do and, to be honest, I probably wouldn't have done it either except that I wanted to play with pfSense.

I'd do it again, though -- it was fun.

[1] https://openwrt.org/

[2] https://silasthomas.medium.com/how-to-import-a-pfsense-firew...

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#375

Post by dboreham » Fri, Dec 17, 2021, 5:23 PM UTC

> for all employees of your company

As a contractor, you are not an employee so not covered.

Basically you get to choose what to do, and in my experience this is not normal, although companies often do have IT requirements for systems that will have access to sensitive information, so the concept in general is not unusual.

For me, the fact that this isn't purely about security (e.g. it's not some agent that comes from Cisco or some legit vendor only interested in security), I'd say no. But it depends how hungry you are for work. Since software developers are hard to find, I'd expect you can find work from other clients that don't have this requirement.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#376

Post by mmarq » Fri, Dec 17, 2021, 5:23 PM UTC

qwerty456127 wrote: post #145

endofreach wrote: post #61

Earlier quoted context omitted.

Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Someone has to start stopping this madness and protect less informed people. We are all steering into a dark future. And i lose hope when i see all these smart programmers complaining but not stepping up.

> Capture traffic and sue the f outta everything they do that‘s not covered by a contract. Whatever the app they would ask you to install would do probably is going to be allowed by its EULA (and I bet the EULA is also going to prohibit you from analyzing the app and whatever it does/communicates) and chances are you don't read it. And even if you do you most probably agree because you know all EULAs are brutal and t…

EULAs are irrelevant if they go against the law. You don’t renounce all your rights because some law intern wrote in the EULA that you sold yourself into chattel slavery. And for those things you can give up (such as some of your data) you have to give explicit consent, clicking “I agree” under a 500 page unreadable legal document is not enough.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#377

Post by iainctduncan » Fri, Dec 17, 2021, 5:24 PM UTC

This is second hand, because I've never worked for them, but my friend who worked for cisco was given a laptop that he only did cisco work on and couldn't use for anything else. I'd ask for that. Then they can have whatever the hell they want on it.

I've been a contractor on and off for almost 20 years, and no way would I let someone insist on an agent. The most they can ask for is a VPN client.

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#378

Post by neonnomad » Fri, Dec 17, 2021, 5:25 PM UTC

ww520 wrote: post #17

It's not normal. Ask them if they and Drata are willing to be on the hook for all your potential bank breach in the future, as they are key-logging your online banking access. Ask them if they can put up a surety bond or insurance for any of your financial loss due to breach of privacy.

The Drata agent is a lightweight osquery agent that is read only that reads things like - screen saver timeout, auto-updates turned on, is AV software installed, etc. We collect that data to show the device is compliant with the companies policies and the compliance frameworks they have agreed to. The company this person contracts with requires the agent be installed to monitor compliance for all devices, employee and contractor. Most companies these days require devices meet xyz requirements around patching, av/edr, etc. if they hold company data.

It never "key logs" anything or collects any of that type of information.

Our agent has been third party security validated and we are happy to share the report with any prospect/customer as well as the configuration.

Source: Work for Drata as the CISO

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#379

Post by neonnomad » Fri, Dec 17, 2021, 5:30 PM UTC

shaicoleman wrote: post #112

A monitoring agent is used on platforms such as UpWork, where you often deal with untrusted contractors for hourly contracts. That is a part of the contract that both sides need to agree on before starting any work. The screenshots can then be as part of the dispute resolution process, and can also protect the contractor in case of disputes from unscrupulous companies. The agent captures screenshots every few minutes…

Just to be clear the Drata agent never captures screenshots of the desktop or anything of the sort. It is a lightweight osquery agent that reads system information like patching, screen lock, firewall status, etc. We collect that information for security/compliance purposes so companies can ensure they are meeting their internal controls as well as formal compliance frameworks such as SOC2.

We are happy to share our security validation report of the agent as well as the configuration with any prospects/customer.

Source: I am the Drata CISO

Re: Ask HN: My client want an agent on my laptop. Is this the new normal?

#380

Post by ganoushoreilly » Fri, Dec 17, 2021, 5:31 PM UTC

everforward wrote: post #321

byron4242 wrote: post #163

Earlier quoted context omitted.

It's a widespread practice that companies provide laptops to contractors to compartmentalize the way they interact with the company's IT. But I'm really quite opposed to it. At one point I had 3 sets of machines: Two different 14" laptops from two different clients and my own machines. At some point you simply run out of space on your desk and end up constantly either working on screens that are too small (14" really…

I think there are absolutely a list of things that I don't want the company doing on my hardware, but I'm okay with on their hardware. Off the top of my head, remote wipes/resets make sense. Frankly, I prefer the company has that option, just in case I lose my work laptop. Encryption should cover it, but I'll take the backup. Compliance agents also have a legitimate reason to exist, but I don't want them on my person…

This is really the thing people miss. It's a company laptop first and foremost and the right to privacy goes away.

The amount of compromising content we've seen and or found on investigations is mind blowing. No one needs that on a work computer. Keep your private life private from your employer.