8

Update:

  • I don't care if the company knows I'm using a private VPN (this is allowed and confirmed with the IT department). My only concern is if the company knows I visited nba.com (for example).
  • On iOS, I think the only demon/background monitoring is the "device management"? So they can only inject the TLS certificates
  • I'm not sure for the macOS if they pre-installed software to record the keystroke or the web requests before sending out via OpenVPN.
  • I am free to uninstall and install any browser so the Chrome/Firefox is not modified or customized by the company.
  • DNS might be another issue but I'm planning to set up a personal DNS server to handle that.
  • From the company policy, we are allowed to watch games and even play PUBG/LOL/CSGO using the company laptop. So there is no policy concern.

Question:

I'm using the company laptop (MacBook Pro with macOS 10.13) and iPhone (iOS11). I am aware everything could be censored when I'm on the company WiFi. Due to the device management (at least on iOS) and HTTPS certificate pre-installation, I think the company can also know every web request even I'm using the laptop at home.

So I'm using the personal VPN software (openVPN) whenever I'm not working. (For sure I'm using the company VPN when working and accessing the codebase, which is not in the scope of this question) My assumption is my personal browsing behavior over personal VPN should be protected and not visible to the employer.

Do I need any other steps to hide my behavior?

  • Does the company have any special software running on that computer? – forest Sep 10 '18 at 3:00
  • @forest I looked into the "Application" folder and don't find anything strange. (I just did a factory reset and disk formatting on the laptop. In order to have the company network connection I did the device onboard to install certificates but I didn't notice any software installed. – donkeyinstartup Sep 10 '18 at 3:35
  • 3
    I'm not sure, but what is your goal, getting fired? Formatting the disk in an attempt to get around company policy on a corporate-owned device seems like not such a great idea (I'd be surprised if that worked anyway). Is it allowed or not allowed to visit nba.com? If policy allows, worry not. If it doesn't then use your own private computer. – Damon Sep 10 '18 at 9:30
  • It seems to me that you are going to great lengths to use the company's infrastructure for things it is not supposed to be used for. Why? Just go to your sport websites when you get home, and focus on your work when you're at work. – Lightness Races in Orbit Sep 10 '18 at 10:12
6

Yes. You should use the device you own to privately do anything.

Apple Configurator 2, which is used to configure corporate owned Apple devices, is able to

ensure that the users’ web traffic stays within the organization’s guidelines.

It further notes that

These include the ability to enable a web filter via a global proxy to ensure that the users’ web traffic stays within the organization’s guidelines.

If a global proxy is set, OpenVPN will have no chance but to communicate through the proxy, telling (warning) the IT that you are trying to a)connect to a foreign network which can lead to a data breach b)mitigate their control by using OpenVPN.

They could not be able to read the contents, but company policies may get you fired for getting your device unprotected by connecting to a foreign network.

Update:

I don't care if the company knows I'm using a private VPN (this is allowed and confirmed with the IT department). My only concern is if the company knows I visited nba.com (for example).

They can't. But they can forbid deleting browsing history in a device, and require to hand them over.

On iOS, I think the only demon/background monitoring is the "device management"? So they can only inject the TLS certificates I'm not sure for the macOS if they pre-installed software to record the keystroke or the web requests before sending out via OpenVPN.

You can see what the MDM monitors in the MDM profile section in Settings.

I am free to uninstall and install any browser so the Chrome/Firefox is not modified or customized by the company. DNS might be another issue but I'm planning to set up a personal DNS server to handle that.

That's good. Although I am concerned about data breaches.

From the company policy, we are allowed to watch games and even play PUBG/LOL/CSGO using the company laptop. So there is no policy concern.

You need to check a)what liabilities you might take if a data breach happens because of you b)is there an official confirmation that allows personal VPNs

  • Good to know the managed device manual from Apple. I'll read it through since both my Mac and iPhone are managed by the company. It's better to know everything in the box :) – donkeyinstartup Sep 10 '18 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.