• Deceptichum@kbin.social
    link
    fedilink
    arrow-up
    6
    ·
    11 months ago

    That’s what we have to do.

    It’s not what we should have to be doing, protections need to be put in place to safeguard citizens privacy instead of promoting corporate overreach.

    • johntash@eviltoast.org
      link
      fedilink
      English
      arrow-up
      2
      ·
      11 months ago

      If you want privacy, don’t use a work device for personal stuff and don’t use a personal device for work stuff. Corporations are always going to want to monitor their own equipment for data exfil, etc, I don’t think any laws are going to tell them not to.

      • Deceptichum@kbin.social
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        11 months ago

        We need laws to make them not to, just like we have laws that tell them they cannot put cameras in the toilet.

        We should not forfeit our right to privacy just because they’re a company and demand it and the meek accept that outcome.

        • BurningRiver@beehaw.org
          link
          fedilink
          English
          arrow-up
          3
          ·
          11 months ago

          Okta (a cybersec company) literally just had a huge breach recently because an employee saved corporate log in credentials in his personal gmail account that got hacked. He accessed the personal email account from a work device.

          https://krebsonsecurity.com/2023/11/okta-breach-affected-all-customer-support-users/

          There are other areas where the company policy also failed, but saving sensitive corporate data to a personal email account is what kicked it off, and why you don’t use work devices for personal matters, and vice versa.

        • johntash@eviltoast.org
          link
          fedilink
          English
          arrow-up
          2
          ·
          11 months ago

          We need laws to make them not to

          That would conflict with laws that protect your PII/PHI. Are you okay with a doctor saving your health information onto their personal cell phone? Or a bank teller with access to move money between accounts able to do so from their cell phone at a bar while drunk? Or a plastic surgeon posting photos of their patients to social media without their consent?

          Corporations suck, but people also suck. Even if there’s no malice intended, the average person is bad at personal security and can’t really be trusted to protect data that the corporation is legally responsible for protecting.

          We should not forfeit our right to privacy

          My point from before was that if you want privacy, don’t use a device that you don’t own. If you’re doing something not work related, use your own device and don’t use the corporate wifi.

          • Deceptichum@kbin.social
            link
            fedilink
            arrow-up
            1
            ·
            11 months ago

            You actually think, corporations shouldn’t be able to snoop through your emails is the same as employees will post your private details on the internet???

            No fuck this, no one can be that unbelievably dumb to make such a ridiculous reach.

            • johntash@eviltoast.org
              link
              fedilink
              English
              arrow-up
              1
              ·
              11 months ago

              Lol sorry, I’m probably not explaining it properly.

              • Corporations are required (by law in a lot of cases) to protect certain information
              • Corporations also have an interest to ensure their own property isn’t misused or abused

              Corporations need a way to achieve those two points. Normally this is done by some sort of MITM corporate proxy and maybe some invasive spyware-like software on the machine itself.

              Some people absolutely abuse this power and would have no problem reading your personal e-mail, or watching your desktop screen all day. I agree that this shouldn’t be a thing and they shouldn’t have access without some sort of strict approval process.

              But, how is a corporation going to prove that you did or did not send a secure/private document on your work device through your personal e-mail? If you are using your personal email, it won’t go through the corporate mail server so they have to rely on either MITM proxies and logs, or something locally on the device. The alternative (no monitoring at all) would lead to situations where data is compromised and the company has no idea why or how, if they even are aware of it at all.

              Similarly what if an employee uses their personal email to accidentally download a virus and that virus starts uploading all of the files on the device to a server somewhere? Without any sort of monitoring, that event could go undetected.

              If there’s an alternative, I’d love to hear about it. But I’ll probably always stick to keeping work and personal data separate.