Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've noticed recently when I log on to sites like Hotmail that IE has been telling me there is something wrong with my SSL certs. When I examine the certs, the Issuer appears as "Blue Coat" from "Some-state, AU", and the certification path has only one item in it: "mail.live.com". What's even more strange is that the IP of the Issuer is unreachable: 153.23.3.251

Call me paranoid, but this gives me the feeling my Network Admins are trying to spy on me. Am I crazy?

share|improve this question
5  
Are you sure it isn't "Bluecoat"? They are a well-known enterprise proxy appliance that can be configured for SSL proxying. –  logicalscope May 18 '12 at 5:00
    
Fixed. Yes, it is Blue Coat. So in other words, (after a google of the product) they are very obviously spying on us. –  wtfsven May 18 '12 at 5:09
add comment

1 Answer

Yes, your Network Admins are spying on you. The trade off is that if they do, you can't rely on the identity of any remote party you connect to via TLS; but if they don't, you might be taking advantage of the confidential channel to download malware, post proprietary documents to competitors or whatnot.

When I'm working for companies that use this type of filter, I take the filter for what it is: the IT department is assuming responsibility for the identities of remote parties I connect to. I therefore use https connections to work-related services as I normally would: if their filter gets it wrong and connects me to a fake CRM, for example, that's a decision that my IT department took on my behalf.

I avoid anything where I care about the identity of the remote end like online banking. I would never ask my sysadmin in real life whether she thought some random server was owned by my bank, I'm not going to start doing it via a proxy device either.

share|improve this answer
2  
Nice answer Graham. We did this in one of my old jobs because (as Graham says) we were worried about users downloading malware, sending out proprietary documents (to places like dropbox, yousendit etc) and bypassing controls that we had put in place. Like your company, we used Bluecoat to perform this also. You will find that you sysadmin probably has no choice and has been forced to do this by HR/Legal/InfoSec etc and that in your employment contract, you've probably accepted (unknowingly) such interference. –  Mark Hillick May 18 '12 at 9:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.