Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bossware is a big legal risk

kolide.com

Post reply on HN
Print view View original

51–60 of 227 posts

Re: Bossware is a big legal risk

#51

Post by apimade »

CoastalCoder wrote: post #7

I was surprised (perhaps I shouldn't have been) to encounter bossware-like surveilance in an interview process . About 6 months ago I was interviewing with InterSystems, a company that does healthcare software. Only when I signed in for the online coding interview did I learn that they required I have a webcam on myself the whole time. I don't like using coarse language. But it was the first time I struggled to not u…

Cybersecurity nerd here, have talked to many platform and financial company CISO’s, security teams and recruiters over the past few years.

Fake interviewees are pretty rampant. We’re getting to the point where presenting yourself in-person to a government representative, agency or a private attestation company will be part of the onboarding process. At this point it looks like it’ll be iris scans.

In the US it’s even an issue in-person with H1B’s where they get interviewed and hired online, then someone else shows up.

Also the fact that insider threats are almost never budgeted for, and so many companies blanket-approve access to systems like logging systems, customer support systems, source code, etc - means attackers don’t even need to get hired into a very important role to get the data they want.

Re: Bossware is a big legal risk

#52

Post by ryandrake »

Havoc wrote: post #11

Never seen anything like this IRL despite working at various major companies. Hell the other day I explained to my rather senior boss that the yellow teams icon means away from desk. Work is me trading my time for money, and I can begrudgingly accept some level of monitoring. That's after all what a boss is - they supervise aka monitor. However the blurrying of boundaries really irks me. This is part of the reason wh…

Yep, my policy is to never "cross the streams." Work stays on work-provided (and controlled) devices and personal stays on personal devices, and never the twain shall meet. I work remotely, so I even go so far as to ensure all my work-provided devices are on their own VLAN which is isolated from the rest of my network and only have limited Internet connectivity. I don't really understand people who use work devices for personal (sometimes VERY personal) tasks, or even worse vice-versa: Bring Your Own Device for work tasks.

Re: Bossware is a big legal risk

#53

Post by hi-v-rocknroll »

halfcat wrote: post #44

Having run this kind of thing for customers over the years, my takeaway is that every place that wanted this was a completely toxic and paranoid work environment. Except for one. This place that seemed to have a reasonable use case. They dealt with very sensitive legal cases involving children, and they wanted an audit trail to ensure sensitive media was handled according to their policy.

Yep. The need signals a lack of trust within an org, and perhaps a management attitude of infantilism and/or a lack of professionalism amongst workers. There is no quick-fix technology solution to business culture dysfunction.

Re: Bossware is a big legal risk

#54

Post by kyleee »

davely wrote: post #22
woleium wrote: post #4

Earlier quoted context omitted.

Just assume it does

No kidding! We have some ridiculous timeout on our work machines that triggers the screensaver after 2 minutes of idle time (we can’t change this). After it’s triggered, you need to enter your password to unlock (company mandated, 10 chars minimum, no repeating chars, at least 1 upper and 1 lower case char, at least 1 special symbol, change every 90 days, can't be too similar to last 10(!) passwords). Okay, this is a…

I found nosleep.page a while back here, wonder if it would work for you?

Re: Bossware is a big legal risk

#55

Post by davely »

GauntletWizard wrote: post #40
davely wrote: post #22

Earlier quoted context omitted.

No kidding! We have some ridiculous timeout on our work machines that triggers the screensaver after 2 minutes of idle time (we can’t change this). After it’s triggered, you need to enter your password to unlock (company mandated, 10 chars minimum, no repeating chars, at least 1 upper and 1 lower case char, at least 1 special symbol, change every 90 days, can't be too similar to last 10(!) passwords). Okay, this is a…

You are the user I fear most; clever enough the be dangerous and aware of the bullshit. If you were really smart you would lobby your IT department to change the ridiculously short timeout, and protest by not working when it locks on you during normal pauses.

Hah. I'd like to think there's nothing to fear from me as a user.

Look, I get why some of these policies are in place -- a bunch of it stems from locking down our systems and protecting critical data due to various Sarbanes-Oxley requirements. Plus, sometimes smart people do dumb things, and it leads to bad things (e.g, see the LinkedIn incident) [1].

But man, oh man, is it annoying! Especially if I'm in my own home, with no one around, and I otherwise get my work done.

[1] https://darknetdiaries.com/transcript/86/

Re: Bossware is a big legal risk

#56

Post by kyleee »

jonathankoren wrote: post #19
exabrial wrote: post #9

The reasons given are pretty much a nothingburger and standard compliance items you should be doing anyway! I am trying to figure out what exactly is the problem people have though: you're literally on a company asset, being paid by the company, you've signed copyright away, you're aware their is no expectation of privacy. Use your cell phone or your home computer for home business, work during company hours, doesn't…

You want to know how the Overton window shifted from workers as humans, to workers as property? Look at laws around the telephone. If you have a telephone on your desk, it is illegal for your employer to secretly listen into those calls. However, if you send an email, you employer has every right to secretly read them. The only difference is, emails don’t exist in the 30s, but telephones did.

I always ponder from this perspective as well, think about the strength of laws regarding physical mail as well. Most of those privacy/tampering laws should have been applied to email from the get go.

Re: Bossware is a big legal risk

#57

Post by paxys »

Everyone replying with "what's the big deal?" is showing their tech privilege. You may not have to deal with intrusive monitoring, but warehouse workers are increasingly being made to wear ankle bracelets so every movement of theirs can be monitored and stack ranked. Workers in WFH "gig" jobs are made to install always-on keyloggers and other monitoring software on their personal computers and phones (which are required for the job). Companies take photos/videos of them in their homes every few minutes throughout the day. Plenty of jobs require you to hand your social media passwords to your employer. There is an entire class of companies that specialize in all of this.

Not everyone is able to say "no" to all this and still make rent next month. I'm happy the government is finally stepping in.

Re: Bossware is a big legal risk

#58

Post by klntsky »

CoastalCoder wrote: post #7

I was surprised (perhaps I shouldn't have been) to encounter bossware-like surveilance in an interview process . About 6 months ago I was interviewing with InterSystems, a company that does healthcare software. Only when I signed in for the online coding interview did I learn that they required I have a webcam on myself the whole time. I don't like using coarse language. But it was the first time I struggled to not u…

Unfortunately this is a requirement nowadays. Scammers learned how to generate realistic CVs and they organize people to pass online interviews for them. After getting the job, they do nothing, get their salary for the first billing period, and leave.

Re: Bossware is a big legal risk

#59

Post by surfingdino »

CoastalCoder wrote: post #7

I was surprised (perhaps I shouldn't have been) to encounter bossware-like surveilance in an interview process . About 6 months ago I was interviewing with InterSystems, a company that does healthcare software. Only when I signed in for the online coding interview did I learn that they required I have a webcam on myself the whole time. I don't like using coarse language. But it was the first time I struggled to not u…

I was asked to be recorded answering three stupid questions like "what motivates you?", "why do you want to work here?" etc. before attending a multi-stage interview. I never got invited to that interview, and I did wonder if I could take them to court, because my CV showed me as good fit for the job (literally ticked all the boxes), but they clearly rejected me based on the video. (In case you wonder why I thought I was a good fit, I can tell you that I built the tech they were implementing.

Re: Bossware is a big legal risk

#60

Post by JanisErdmanis »

paxys wrote: post #57

Everyone replying with "what's the big deal?" is showing their tech privilege. You may not have to deal with intrusive monitoring, but warehouse workers are increasingly being made to wear ankle bracelets so every movement of theirs can be monitored and stack ranked. Workers in WFH "gig" jobs are made to install always-on keyloggers and other monitoring software on their personal computers and phones (which are requi…

> Plenty of jobs require you to hand your social media passwords to your employer.

Can you elaborate with examples or references?

Post reply on HN