up vote -4 down vote favorite
share [g+] share [fb]

Network security is not exactly my area of expertese so I apologize if I've phrased this question wrong or if it's already been asked somewhere:

If I am on a network that is monitored, like the network at my office is, but I am on websites that use https, or if I SSH into a server, can that traffic be monitored or does it just show as encrypted noise?

I'm sure they can see the activity on their network, but if I check (for example) my personal gmail from work, and it's over https it should be invisible right? As far as I know the network is monitored, but I don't believe the local computer is actually monitored/key logged.

link|improve this question
We have a certain amount of leeway, but we are allowed to do (within reason, obviously) whatever we want if we arrive early, or are using or computer during lunch, so I was just curious. I'm really not up to anything nefarious. – thekungfuman Jan 26 at 16:25
I had no idea this would garner such a reaction. Despite the down voting (eek!) I really appreciate the speedy responses and robust conversation. – thekungfuman Jan 26 at 16:41
thekungfuman, it's gracious of you to take it that way. We're not very keen here on questions about subverting local network policy, since a lot of us are network admins! You clarified your question somewhat, but I fear a bit too late. I hope you'll stay around SF and ask other questions that generate more light and less heat. – MadHatter Jan 26 at 16:57
Don't worry @MadHatter, I haven't been scared off just yet. :-) And I'm sure I'll have more questions in the future. – thekungfuman Jan 26 at 20:17
feedback

closed as off topic by ErikA, Zoredache, MadHatter, Ben Pilbrow, ceejayoz Jan 26 at 16:46

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

2 Answers

up vote 4 down vote accepted

If they control the machine, the could have installed a CA certificate allowing them to forge certs and perform a MITM attack. There are monitoring products that do this.

link|improve this answer
That's very interesting. I can't see the organization I work for doing this, but it's a scary prospect when using any network you don't control. Could something like this even be done (illegally) at the ISP level to just circumvent all secure connections? – thekungfuman Jan 26 at 16:32
3  
Typically an SSL MITM attack would be detected by an SSL warning popping up in your browser due to the un-trusted root CA. If your employer has full access to your machine, though, they can install their root CA in the browser's trusted CA cache. Needless to say, it is impossible for someone at a coffee shop or at your ISP to do. – ErikA Jan 26 at 16:34
Thanks for clearing that up @ErikA. I was starting to get (too) paranoid for a minute there. – thekungfuman Jan 26 at 16:43
feedback
up vote 1 down vote

Or there's the ever present screencap/activity monitor installed on the server itself, which neatly bypasses any encryption by just taking video and keystroke data.

Realistically if you're on a "compromised" terminal - whether that be by corporate policy or a hacker, SSL will not protect your data.

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.