Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Network security is not exactly my area of expertese so I apologize if I've phrased this question wrong or if it's already been asked somewhere:

If I am on a network that is monitored, like the network at my office is, but I am on websites that use https, or if I SSH into a server, can that traffic be monitored or does it just show as encrypted noise?

I'm sure they can see the activity on their network, but if I check (for example) my personal gmail from work, and it's over https it should be invisible right? As far as I know the network is monitored, but I don't believe the local computer is actually monitored/key logged.

share|improve this question

closed as off topic by EEAA, Zoredache, MadHatter, Ben Pilbrow, ceejayoz Jan 26 '12 at 16:46

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

We have a certain amount of leeway, but we are allowed to do (within reason, obviously) whatever we want if we arrive early, or are using or computer during lunch, so I was just curious. I'm really not up to anything nefarious. – lyonsinbeta Jan 26 '12 at 16:25
I had no idea this would garner such a reaction. Despite the down voting (eek!) I really appreciate the speedy responses and robust conversation. – lyonsinbeta Jan 26 '12 at 16:41
thekungfuman, it's gracious of you to take it that way. We're not very keen here on questions about subverting local network policy, since a lot of us are network admins! You clarified your question somewhat, but I fear a bit too late. I hope you'll stay around SF and ask other questions that generate more light and less heat. – MadHatter Jan 26 '12 at 16:57
Don't worry @MadHatter, I haven't been scared off just yet. :-) And I'm sure I'll have more questions in the future. – lyonsinbeta Jan 26 '12 at 20:17
up vote 4 down vote accepted

If they control the machine, the could have installed a CA certificate allowing them to forge certs and perform a MITM attack. There are monitoring products that do this.

share|improve this answer
That's very interesting. I can't see the organization I work for doing this, but it's a scary prospect when using any network you don't control. Could something like this even be done (illegally) at the ISP level to just circumvent all secure connections? – lyonsinbeta Jan 26 '12 at 16:32
Typically an SSL MITM attack would be detected by an SSL warning popping up in your browser due to the un-trusted root CA. If your employer has full access to your machine, though, they can install their root CA in the browser's trusted CA cache. Needless to say, it is impossible for someone at a coffee shop or at your ISP to do. – EEAA Jan 26 '12 at 16:34
Thanks for clearing that up @ErikA. I was starting to get (too) paranoid for a minute there. – lyonsinbeta Jan 26 '12 at 16:43

Or there's the ever present screencap/activity monitor installed on the server itself, which neatly bypasses any encryption by just taking video and keystroke data.

Realistically if you're on a "compromised" terminal - whether that be by corporate policy or a hacker, SSL will not protect your data.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.