Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Work provides people from my company that 'work at home' with a separate VPN router which will be plugged into my existing home router.

They have also asked for the router model, username and password etc of my home router. They said that this info was needed so that they could program it to work with the VPN router so that is able to pass through the home router.

My question is this; whilst I know that while I am connected to the work router which is connected to the work server through the day they will be able to monitor internet access etc, once I unplug the VPN router after work, would they still have access to my internet traffic, emails etc?

I connect to work at the moment on a separate work PC via a cable and surf, email etc, wirelessley via a laptop. My laptop is firewalled, but could they do any snooping with the information I have given them for my router, once the VPN is unplugged?.

Forgive me, I am new to VPNs and work connections.

share|improve this question
4  
To clarify, are they asking for your wifi credentials, or your routers administrative account? IMO demanding the latter is as unacceptable as any other "tell me your password" demand. If configuration changes need to be made, insist they document them so you can do them yourself. –  Dan Neely May 30 '13 at 18:00

3 Answers 3

GdD answered it best however, I'd like to add a few things. We have a managed client (VoIP, Security, Networking, etc). In total there are about 400 "teleworkers." My client ended up getting a separate connection for their workers' homes. This in my opinion is the best option. Consider the following: In your home, you have a son, daughter, roommate, etc. In your home, a recurring theme is to be online. Your bandwidth becomes saturated, in which you cannot function at 100%, or whatever their needs are. Further, if they did control any kind of logging, what happens if your child, roommate, etc., visits a site that is out of policy with your company. Would you be fingered for it.

Sounds cumbersome for an MIS/IT department to tell everyone: "Alright give us your credentials to log into and configure this machine" There is only ONE MECHANISM, they'd be able to use to get into it. And that is by allowing remote connections (punching a hole in your firewall) to get in from the onset to do any programming.

share|improve this answer

If you give them the username and password of your personal home router then they could (depending on model and firmware) configure it to log your traffic and forward the logs to them, or do other unethical things as described in this question. It's very unlikely that they would use the credentials to do such things, however I would refuse to give them control of my personal router, and instead get the configuration requirements and do it yourself.

Presuming that you keep control of your own equipment then once you disconnect or power down the work VPN device then they cannot use it to spy on what you do.

share|improve this answer
    
can some router models connect to a VPN and act as a full MiM? –  ratchet freak May 30 '13 at 20:26
    
@ratchetfreak yes, most enterprise devices will support packet capturing (for debugging) and home routers can include things like TCPDump if desired: emtunc.org/blog/04/2011/installing-tcpdump-on-dd-wrt-wrt54gl –  NULLZ May 31 '13 at 0:28

No. Once you disconnect from the VPN, none of your traffic is routed through their network. It all just goes through your normal home internet connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.