Hacker News Reader

Comment by jeffwask | Hacker News Reader

It all feels so very fragile. You are one forgetful moment from me seeing an alert for impossible travel.

If you set up your entire home network to tunnel back via the VPN, it's basically bulletproof. The failure mode would be "no connection", not a leak via the local, non-VPN'd connection. You can even maintain an actual air gap between the 2 networks with one device that handles the tunneling and exposes an ethernet port that's only ever bridged to the VPN interface, and the normal router's WAN port connected to that.

I have such a setup - the local connections at the end-user sites are inexpensive consumer-grade connections (because they are cheaper and quicker to set up than a proper leased-line which has months of lead time, and you're not going to convince small restaurants/coffee shops that they need to spend 500 bucks/month for a leased line to serve public Wi-Fi) with various bullshit such as filtering, dynamic IP, etc - but the network hardware tunnels back to my infrastructure and abstracts away all the intermediary connections, giving them a "clean" Ethernet port. As a bonus, it can tolerate intermediary connections failing without dropping in-flight TCP connections, since those run over the tunnel rather than the raw interfaces which have gone down.

There is a difference if it is your own vs corporate hardware: MDM can enable wifi remotely, then do a location scan against wifi networks nearby (ostensibly this is for theft purposes)

If you really want to do this and fool wireless location, I wonder if a client running at the "real" location can run something like airodump-ng and send the received (B|E)SSIDs to the remote end where a fake AP spoofs them. You don't actually need to break any crypto to do this, simply broadcast the same networks with the same security parameters (even if the key itself is different). Signal strength will be an issue but it's probably still good enough to fool the system into returning an inconclusive result. Tampering with the wireless card to prevent it from receiving anything is also a solution.

And then what? If you care more about compliance than the employee, you fire them and they do the same thing somewhere else a month later.

And... you don't think there are companies and leadership teams that think this way.

there surely are, I just don't think its a big deal for any competent employee

Yes, of course. You'd want to claim that you're in the same state/country but live 200 miles away from company offices.

Reply on news.ycombinator.com