Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 6 down vote favorite

If I open my Gmail account in office network or chat with someone in Gtalk, since our communications are through a proxy, will anyone be able to see my mails? Even if I log out, will someone be able to snoop my emails?

share|improve this question
For what it's worth, the New Jersey Supreme Court recently ruled that personal web-based e-mail accessed on a company computer had an expectation of privacy. This may not help keep your messages private, but you'll have legal recourse if they don't. No mention of chat, though. E-mail on the company mail server is fair game, however. – Al Everett Feb 4 '11 at 14:34
All that said, your company owns the equipment and you shouldn't expect it to be private. If it's not something you'd want the person in the next cubicle to overhear you say on the phone, I wouldn't type it in chat or e-mail. – Al Everett Feb 4 '11 at 14:36

migrated from stackoverflow.com Feb 3 '11 at 13:15

3 Answers

up vote 8 down vote accepted

Gmail uses HTTPS by default.

However, there are still two ways that IT can see you:

  • If your PC has a trusted certificate owned by IT, they can setup an SSL proxy which resigns using their certificate and capture all traffic.
  • Your PC might have monitoring software

Either method could allow them to see your authentication cookie, which they could use themselves until you log out.
If they have an evil proxy, they could block logout requests to keep you logged in indefinitely and use your authentication cookie until it expires.

If they have a keylogger on your PC (some companies do this), they'll have your password, too.

share|improve this answer
2  
Always assume your IT department can see anything you do. And they often do more and more nowadays with the increasing threat of lawsuits and liability. – BBlake Feb 3 '11 at 20:44
Is there a way to check if keylogger has been installed ? I feel someone is mis-using my system. – Abi Feb 8 '11 at 6:22
Can you pls give me names of the monitoring , key logger apps ? How can I check if they are installed ? – Abi Feb 8 '11 at 6:23
up vote 4 down vote

In theory your IT department could see and log everything - I doubt that they would though as it would be a waste of resources. As long as you aren't breaking any rules then I don't see this as an issue.

In short, if you are that worried about your personal information, don't use your work network. Use a netbook/laptop and a 3G card for personal internet usage.

share|improve this answer
up vote 0 down vote

As long as you use https, all the data is secure from the moment it leaves your computer until it reaches Google's servers (and vice versa).

Two caveats:

  1. Gmail forces you to use https to login, but you have to have it enabled if you want it always on. If your not using https (check the address bar on your browser) Google how to enable it - it's straightforward.

  2. Usually IT people can snoop into your PC (using some tracking programs or remote desktop software). If this is the case they have access to everything you do. Furthermore they can even install a key logger and take your password. It really depends on your companies policies.

share|improve this answer
2  
"As long as you use https, all the data is secure from the moment it leaves your computer until it reaches Google's servers (and vice versa)." This is not correct. As SLaks points out, an office workstation is typically provisioned with a root certificate of the company's proxy server. The proxy server can generate on demand an SSL cert for the URL you are trying to get to and present that to your browser. Your session is SSL to the proxy which maintains an SSL session to the intended site on your behalf. The company absolutely can, and often does, log your SSL traffic. – T.Rob Feb 7 '11 at 3:45
@T.Rob - Curious.. what if you use an encrypted SOCKS proxy to funnel your traffic? ;) – Jakub Feb 8 '11 at 16:33
@Jakub - Then you are probably safe from the SSL session being snooped. I initially thought that the SOCK proxy would terminate the SSL session but in doing a little research it seems to always forward the session once created. That said, it would be simple to terminate the outbound connection on the far side of the SOCKS proxy at an HTTP proxy, whip up a dynamic cert and forward the connection to the actual host. Bear in mind that the SOCKS proxy has to resolve the destination and can be made to resolve any destination at the HTTP proxy. – T.Rob Feb 8 '11 at 18:38
In any of these cases where the company proxy generates a dynamic cert, the cert can be inspected to view the issuer, signer and subject. It should be obvious on inspection that the cert is not the actual cert of the target web site - GMail in this case.. – T.Rob Feb 8 '11 at 18:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.