-4

Network security is not exactly my area of expertese so I apologize if I've phrased this question wrong or if it's already been asked somewhere:

If I am on a network that is monitored, like the network at my office is, but I am on websites that use https, or if I SSH into a server, can that traffic be monitored or does it just show as encrypted noise?

I'm sure they can see the activity on their network, but if I check (for example) my personal gmail from work, and it's over https it should be invisible right? As far as I know the network is monitored, but I don't believe the local computer is actually monitored/key logged.

Improve this question
4
  • We have a certain amount of leeway, but we are allowed to do (within reason, obviously) whatever we want if we arrive early, or are using or computer during lunch, so I was just curious. I'm really not up to anything nefarious.
    – lyonsinbeta
    Jan 26, 2012 at 16:25
  • I had no idea this would garner such a reaction. Despite the down voting (eek!) I really appreciate the speedy responses and robust conversation.
    – lyonsinbeta
    Jan 26, 2012 at 16:41
  • thekungfuman, it's gracious of you to take it that way. We're not very keen here on questions about subverting local network policy, since a lot of us are network admins! You clarified your question somewhat, but I fear a bit too late. I hope you'll stay around SF and ask other questions that generate more light and less heat.
    – MadHatter
    Jan 26, 2012 at 16:57
  • Don't worry @MadHatter, I haven't been scared off just yet. :-) And I'm sure I'll have more questions in the future.
    – lyonsinbeta
    Jan 26, 2012 at 20:17

2 Answers 2

Reset to default
4

If they control the machine, the could have installed a CA certificate allowing them to forge certs and perform a MITM attack. There are monitoring products that do this.

Improve this answer
3
  • That's very interesting. I can't see the organization I work for doing this, but it's a scary prospect when using any network you don't control. Could something like this even be done (illegally) at the ISP level to just circumvent all secure connections?
    – lyonsinbeta
    Jan 26, 2012 at 16:32
  • 3
    Typically an SSL MITM attack would be detected by an SSL warning popping up in your browser due to the un-trusted root CA. If your employer has full access to your machine, though, they can install their root CA in the browser's trusted CA cache. Needless to say, it is impossible for someone at a coffee shop or at your ISP to do.
    – EEAA
    Jan 26, 2012 at 16:34
  • Thanks for clearing that up @ErikA. I was starting to get (too) paranoid for a minute there.
    – lyonsinbeta
    Jan 26, 2012 at 16:43
1

Or there's the ever present screencap/activity monitor installed on the server itself, which neatly bypasses any encryption by just taking video and keystroke data.

Realistically if you're on a "compromised" terminal - whether that be by corporate policy or a hacker, SSL will not protect your data.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .