If I open my Gmail account in office network or chat with someone in Gtalk, since our communications are through a proxy, will anyone be able to see my mails? Even if I log out, will someone be able to snoop my emails?
-
For what it's worth, the New Jersey Supreme Court recently ruled that personal web-based e-mail accessed on a company computer had an expectation of privacy. This may not help keep your messages private, but you'll have legal recourse if they don't. No mention of chat, though. E-mail on the company mail server is fair game, however.– aleCommented Feb 4, 2011 at 14:34
-
All that said, your company owns the equipment and you shouldn't expect it to be private. If it's not something you'd want the person in the next cubicle to overhear you say on the phone, I wouldn't type it in chat or e-mail.– aleCommented Feb 4, 2011 at 14:36
3 Answers
Gmail uses HTTPS by default.
However, there are still two ways that IT can see you:
- If your PC has a trusted certificate owned by IT, they can setup an SSL proxy which resigns using their certificate and capture all traffic.
- Your PC might have monitoring software
Either method could allow them to see your authentication cookie, which they could use themselves until you log out.
If they have an evil proxy, they could block logout requests to keep you logged in indefinitely and use your authentication cookie until it expires.
If they have a keylogger on your PC (some companies do this), they'll have your password, too.
-
2Always assume your IT department can see anything you do. And they often do more and more nowadays with the increasing threat of lawsuits and liability.– BBlakeCommented Feb 3, 2011 at 20:44
-
Is there a way to check if keylogger has been installed ? I feel someone is mis-using my system.– AbiCommented Feb 8, 2011 at 6:22
-
Can you pls give me names of the monitoring , key logger apps ? How can I check if they are installed ?– AbiCommented Feb 8, 2011 at 6:23
In theory your IT department could see and log everything - I doubt that they would though as it would be a waste of resources. As long as you aren't breaking any rules then I don't see this as an issue.
In short, if you are that worried about your personal information, don't use your work network. Use a netbook/laptop and a 3G card for personal internet usage.
As long as you use https, all the data is secure from the moment it leaves your computer until it reaches Google's servers (and vice versa).
Two caveats:
Gmail forces you to use https to login, but you have to have it enabled if you want it always on. If your not using https (check the address bar on your browser) Google how to enable it - it's straightforward.
Usually IT people can snoop into your PC (using some tracking programs or remote desktop software). If this is the case they have access to everything you do. Furthermore they can even install a key logger and take your password. It really depends on your companies policies.
-
2"As long as you use https, all the data is secure from the moment it leaves your computer until it reaches Google's servers (and vice versa)." This is not correct. As SLaks points out, an office workstation is typically provisioned with a root certificate of the company's proxy server. The proxy server can generate on demand an SSL cert for the URL you are trying to get to and present that to your browser. Your session is SSL to the proxy which maintains an SSL session to the intended site on your behalf. The company absolutely can, and often does, log your SSL traffic.– T.RobCommented Feb 7, 2011 at 3:45
-
@T.Rob - Curious.. what if you use an encrypted SOCKS proxy to funnel your traffic? ;)– JakubCommented Feb 8, 2011 at 16:33
-
@Jakub - Then you are probably safe from the SSL session being snooped. I initially thought that the SOCK proxy would terminate the SSL session but in doing a little research it seems to always forward the session once created. That said, it would be simple to terminate the outbound connection on the far side of the SOCKS proxy at an HTTP proxy, whip up a dynamic cert and forward the connection to the actual host. Bear in mind that the SOCKS proxy has to resolve the destination and can be made to resolve any destination at the HTTP proxy.– T.RobCommented Feb 8, 2011 at 18:38
-
In any of these cases where the company proxy generates a dynamic cert, the cert can be inspected to view the issuer, signer and subject. It should be obvious on inspection that the cert is not the actual cert of the target web site - GMail in this case..– T.RobCommented Feb 8, 2011 at 18:40