undefined | Better HN

0 pointsSilhouette4y ago0 comments

Basic TLS is sufficient to stop your employer from MITM'ing your personal email session as long as you control what certificates your machine trust.

Which, on almost any employer-issued device on a large corporate network today, you won't.

Personal stuff goes on personal devices with personal connectivity and uses personal accounts with personal security. Work stuff goes on work devices with work connectivity and uses work accounts with work security. Contaminating either with the other is just a recipe for bad things happening, often for both the employer and the employee.

0 comments

staticassertion4y ago

By contrast, I'm typing on a work computer right now. We deploy no special certificates to attempt to MITM traffic, nor will we ever.

I'm using a Chromebook, which allows me to run multiple users at the same time, each with their own profiles. Each user has their own encryption keys for their hard drive. We have no corporate network, no VPN, and instead rely on attestation for authorization.

I prefer to use this device for personal use because I know how safe it is.

Thorrez4y ago

Yep. Pinning doesn't protect you, using a personal device protects you.

You mention needing to use personal connectivity. I don't think that's necessary. HTTPS should protect you from malicious networks.

SilhouetteOP4y ago

HTTPS should protect you from malicious networks.

Yes, but on the kind of network we're talking about, you probably won't be able to make an outbound HTTPS connection at all if you're not going via the required security infrastructure with an appropriate corporate-issued cert.

j / k navigate · click thread line to collapse