Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like transparent proxies.

Assuming:

  • the Gmail certificates that I installed in my browser are authentic, because...
  • the browser image itself is authentic, because...
  • my company sys admins are not engaging in any DNS hijacking to carry out silent MITMs between me and real Gmail servers,

Then:

Can things like the email Subject, the Recipient list, send/receive dates, etc be read by any 3rd party along the way?

(My understanding is, the https protocol guarantees 100% privacy or secrecy from any eavesdroppers but I'm not fully up-to-date on the current state-of-art in Computer Security.)

share|improve this question
1  
Are you trying to protect information from the administrator of the computer you are using? That's not a problem that can be solved with cryptography. If you're only talking about a hostile network, SSL is pretty good. (But still not 100%). –  Ladadadada Jul 6 '13 at 11:45
    
No, I am myself the admin of my computer. "SSL is pretty good. But still not 100%." That's my whole concern: What'd be the kinds of things missing from the 100%? –  Harry Jul 6 '13 at 12:39
add comment

1 Answer

up vote 4 down vote accepted

Can things like the email Subject, the Recipient list, send/receive dates, etc be read by any 3rd party along the way?

Nope, unless you have been coerced to install some 3rd party cert on your computer. Some companies don't allow you to use the Internet unless you whitelist one of their certificates (and all https traffic is decrypted-reencrypted and sent along). In such a case, they can read everything you can (and taint the data too).

Another thing that is possible is that you have added a malicious cert to your exceptions list without knowing what was going on. This happens -- user visits website, user gets ssl error, user adds exception. If that cert was a * cert or something like that1, then you're in trouble. Of course, you can easily check this in your browser certificate list.

However, since you've explicitly mentioned that your certificate list is pristine and there is no MITM going on, both of the above are ruled out.

Unless, of course, Google really is working with PRISM ;-)

1. I'm not entirely sure if browsers still accept * certs (CAs don't hand them out though). Firefox still seems to allow them. Either way, a similar attack can easily be done wth multiple-domain certificates: I can use an unsigned cert on manish.com that works for manish.com,*.google.com. Any visitor who whitelists my cert will be MITM-able.

share|improve this answer
    
Google is working with PRISM... 'We do no evil, sir!' –  Deer Hunter Jul 6 '13 at 15:44
    
Wildcard certificates are in fact still available from CAs, though they are highly restricted (either with technical or contractual controls to prevent abuse [in theory at least]). –  Adam Caudill Jul 7 '13 at 2:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.