I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like transparent proxies.
- the Gmail certificates that I installed in my browser are authentic, because...
- the browser image itself is authentic, because...
- my company sys admins are not engaging in any DNS hijacking to carry out silent MITMs between me and real Gmail servers,
Can things like the email Subject, the Recipient list, send/receive dates, etc be read by any 3rd party along the way?
(My understanding is, the
https protocol guarantees 100% privacy or secrecy from any eavesdroppers but I'm not fully up-to-date on the current state-of-art in Computer Security.)