Yep, thats corporate monitoring software for you. Everyones got it, if you dont see it, assume its there. If the PC is not yours and or built with your own hands, assume its bugged or key logged. This goes for school PCs as well for the youngins, this is not to make people paranoid, just manage expectations on privacy. If you didnt make it, assume its recorded.
Worked at Google and can confirm if you typed your password into a non org website you were flagged and asked to reset your PW. The problem is some of the training websites Google used and were Google branded were apparently non org websites. But it shows they are looking for “certain key strokes”
My employer does the same over a proxy. Luckily it can’t breach HTTPS, but it was annoying to set all my APs and router and switches and other network nodes to HTTPS just because the damn thing would block the site the moment I sent my password in cleartext to a local device…
Larger companies that monitor for corporate passwords being entered on third-party sites usually use a browser extension that’s force-installed using Chrome Enterprise. That’s especially the case if they mandate the usage of Chrome.
It’s what I’ve experienced at FAANG companies. MitM isn’t used and would break certificate pinning on sites (including internal tools) that use both certificate pinning and HSTS. The Chromium source code has a list of domains that are hard-coded to only accept particular root certificates.
I don’t MitM sites that are know to break. I also don’t decrypt healthcare or banking sites. In most cases you wouldn’t know it’s happening unless you look at the cert issuer.
HSTS says it must be encrypted but a proxy will create two connections and look at it clear in the middle. On the other hand cert pinning says it must be a specific cert that breaks the site if decryption is used. Apple is big on doing that for a lot of their site and apps.
To me that means Amazon can and will monitor every keystroke of every employee.
Yep, thats corporate monitoring software for you. Everyones got it, if you dont see it, assume its there. If the PC is not yours and or built with your own hands, assume its bugged or key logged. This goes for school PCs as well for the youngins, this is not to make people paranoid, just manage expectations on privacy. If you didnt make it, assume its recorded.
Worked at Google and can confirm if you typed your password into a non org website you were flagged and asked to reset your PW. The problem is some of the training websites Google used and were Google branded were apparently non org websites. But it shows they are looking for “certain key strokes”
My employer does the same over a proxy. Luckily it can’t breach HTTPS, but it was annoying to set all my APs and router and switches and other network nodes to HTTPS just because the damn thing would block the site the moment I sent my password in cleartext to a local device…
You’re sure they aren’t decrypting your traffic? Check the root cert of any site and see if it’s their own root.
Larger companies that monitor for corporate passwords being entered on third-party sites usually use a browser extension that’s force-installed using Chrome Enterprise. That’s especially the case if they mandate the usage of Chrome.
Why do you say usually? It’s not what I do. I MitM every machine.
It’s what I’ve experienced at FAANG companies. MitM isn’t used and would break certificate pinning on sites (including internal tools) that use both certificate pinning and HSTS. The Chromium source code has a list of domains that are hard-coded to only accept particular root certificates.
I don’t MitM sites that are know to break. I also don’t decrypt healthcare or banking sites. In most cases you wouldn’t know it’s happening unless you look at the cert issuer.
Yep, they’re not decrypting HTTPS, I’ve triple checked. But we do have an MDM forced proxy service that does check any non-encrypted traffic…
This is definitely a thing.
Only if the site they’re visiting isn’t using HSTS, but it’s possible
I don’t think this is correct. HSTS only prevents downgrading.
HSTS says it must be encrypted but a proxy will create two connections and look at it clear in the middle. On the other hand cert pinning says it must be a specific cert that breaks the site if decryption is used. Apple is big on doing that for a lot of their site and apps.
What does that mean? HTTPS is a client-server thing, your APS and switches don’t really have anything to do with that.
Web control panel. All my network runs OpenWrt and I prefer to manage it from the web UI instead of terminal tinkering.
Ahh that makes sense. I thought you were claiming you somehow got all your traffic over HTTPS with some AP settings.
Setting their management interfaces to be accessed via https because the VPN blocks (after snooping on) http only access would be my guess
deleted by creator
Annoying, but ideally it would have been the initial configuration
This is the real story.
Sorta like north korea then. Understandable why they got the job… Must have felt like home.
I mean, more like does and has been, but I guess that’s just semantics. Evil gon be evil.
It wasn’t the lag from the employee’s computer to Amazon which was being monitored.
It was the lag from the hacker to the employee. Amazon could not have monitored the hacker’s computer.