this post was submitted on 19 Dec 2025
229 points (99.1% liked)
Technology
77768 readers
3214 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
To me that means Amazon can and will monitor every keystroke of every employee.
This is the real story.
I mean, more like does and has been, but I guess that's just semantics. Evil gon be evil.
Worked at Google and can confirm if you typed your password into a non org website you were flagged and asked to reset your PW. The problem is some of the training websites Google used and were Google branded were apparently non org websites. But it shows they are looking for "certain key strokes"
My employer does the same over a proxy. Luckily it can't breach HTTPS, but it was annoying to set all my APs and router and switches and other network nodes to HTTPS just because the damn thing would block the site the moment I sent my password in cleartext to a local device...
What does that mean? HTTPS is a client-server thing, your APS and switches don't really have anything to do with that.
Setting their management interfaces to be accessed via https because the VPN blocks (after snooping on) http only access would be my guess
You’re sure they aren’t decrypting your traffic? Check the root cert of any site and see if it’s their own root.
Larger companies that monitor for corporate passwords being entered on third-party sites usually use a browser extension that's force-installed using Chrome Enterprise. That's especially the case if they mandate the usage of Chrome.
Why do you say usually? It’s not what I do. I MitM every machine.
This is definitely a thing.
Only if the site they’re visiting isn’t using HSTS, but it’s possible
I don't think this is correct. HSTS only prevents downgrading.
HSTS says it must be encrypted but a proxy will create two connections and look at it clear in the middle. On the other hand cert pinning says it must be a specific cert that breaks the site if decryption is used. Apple is big on doing that for a lot of their site and apps.
Annoying, but ideally it would have been the initial configuration
It wasn't the lag from the employee's computer to Amazon which was being monitored.
It was the lag from the hacker to the employee. Amazon could not have monitored the hacker's computer.