Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I came across this interesting device called SurfEasy Private Browser. Here's the company's webpage and here's the product page on Amazon.com. I assume it's just a USB stick with a VPN client and bookmarks stored encrypted. According to their webpage it can be used "at work to prevent IT from monitoring personal browsing". Is this true? For example if someone is monitoring the display of of a user using this product, they still can see everything being done right? Also any files that are encrypted must be decrypted before they work so this would exist in memory and I would imagine there exists a tool that could transfer or log this unencrypted memory for the IT people. Are there any similar ideas or products to this in the sense they don't require administrative privileges on a computer but can give privacy over a public network? It seems straight forwards enough just to run a VPN client from an arbitrary location.

share|improve this question
    
You cannot achieve security on an untrusted computer. –  CodesInChaos Dec 16 '13 at 11:14
add comment

3 Answers

up vote 0 down vote accepted

"Guaranteed"? Maybe you didn't read the SurfEasy ToS (apologies for the length and the ALL CAPS):

DISCLAIMER. THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTY, REPRESENTATION, CONDITION OR GUARANTEE OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY IMPLIED WARRANTIES, REPRESENTATIONS, CONDITIONS OR GUARANTEES OF QUALITY, MERCHANTABILITY, MERCHANTABLE QUALITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ALL OF WHICH ARE DISCLAIMED TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW. YOU EXPRESSLY AGREE THAT USE OF THE SERVICE IS AT YOUR SOLE RISK. SURFEASY DOES NOT PROVIDE ANY WARRANTY OR GUARANTEE AS TO THE SECURITY OF THE SERVICE. THE SERVICE WILL NOT PROTECT YOU FROM KEY LOGGING, REMOTE SCREEN VIEWING OR OTHER VISUAL ATTEMPTS TO MONITOR YOUR INTERNET USAGE. SURFEASY DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR FREE OF ERRORS, VIRUSES OR OTHER HARMFUL COMPONENTS.

LIMITATION OF LIABILITY. IN NO EVENT SHALL SURFEASY, OR ANY OF ITS DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, SUPPLIERS, DISTRIBUTORS OR OTHER REPRESENTATIVES, BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES SUFFERED IN ANY CONNECTION WITH YOUR USE OF THE SERVICE HOWSOEVER CAUSED AND REGARDLESS OF THE FORM OF CAUSE OF ACTION, DEMAND OR CLAIM, WHETHER BASED ON CONTRACT OR TORT, INCLUDING NEGLIGENCE, AND EVEN IF SUCH DAMAGES ARE FORESEEABLE OR ANY OF THE FOREGOING PERSONS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL THE TOTAL LIABILITY OF SURFEASY, AND ITS DIRECTORS, OFFICERS, EMPLOYEES, AGENTS, SUPPLIERS, DISTRIBUTORS AND OTHER REPRESENTATIVES, TO YOU FOR ALL DAMAGES ARISING OUT OF OR RELATING TO THIS AGREEMENT OR YOUR USE OF THE SERVICE (HOWSOEVER CAUSED AND REGARDLESS OF THE FORM OF CAUSE OF ACTION, DEMAND OR CLAIM, WHETHER BASED ON CONTRACT OR TORT, INCLUDING NEGLIGENCE, AND EVEN IF SUCH DAMAGES ARE FORESEEABLE OR ANY OF THE FOREGOING PERSONS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) EXCEED THE AMOUNT PAID BY YOU, IF ANY, FOR ACCESSING THE SERVICE DURING THE TWELVE MONTHS IMMEDIATELY PRECEDING THE DATE OF THE CLAIM OR ONE HUNDRED DOLLARS, WHICHEVER IS GREATER.

quoted from https://www.surfeasy.com/terms_of_service

Not exactly the Good Housekeeping Seal or the Craftsman Tool Warranty, is it? While SurfEasy might or might not be a good product, and it might or might not shield your web surfing from the prying eyes of your company IT department, you'd be meshugeh to bet your job and livelihood on it.

share|improve this answer
    
90% of that is just the usual legal bullshit which doesn't say anything about the security of the product. The only relevant part is "The service will not protect you from key logging, remote screen viewing or other visual attempts to monitor your internet usage. SurfEasy does not warrant that the service will be uninterrupted or free of errors, viruses or other harmful components." –  CodesInChaos Dec 16 '13 at 11:16
    
My point is, OP said "guaranteed." Any consumer entering into any internet transaction, or in nearly any transaction with a big corporation, will encounter the "usual legal bullshit." OP is throwing words around without knowing or thinking about what they mean. You want a "guarantee," go to Sears, Roebuck and buy a Craftsman hand tool. –  user35648 Dec 17 '13 at 2:06
add comment

Generally speaking VPN is a proxy but much safer because it doesn't store logs (majority of the VPN providers doesn't store logs whereas proxy does !).

Say if you are in an IT company and you have got a German VPN the system admin / network admin will only be able to see you being connected to the German IP and you still will be browsing the internet with the German IP. Feel free to correct me if i'm wrong.

share|improve this answer
    
I don't think just because it's a VPN means it doesn't keep logs, where did you here that? –  Celeritas Dec 16 '13 at 10:55
add comment

There is no product out there that will guarantee your privacy, if someone really wants to see your data they will get it. Even if the encryption is perfect an attacker with the resources and desire will crack into your computer and see the data before it is encrypted.

What products like this do is protect your data from random sniffing on the internet, or intentional sniffing where they don't have the desire to take it further. It raises the bar, basically. This in itself isn't a bad thing at all necessarily, there's plenty of organizations out there which would love to get a hold of your data even though they have no right to it, and software like this can help prevent that.

If you are planning to use this product in a work environment to circumvent your employer's security systems then my advice would be not to. It's almost certainly against policy and could get you fired if the software is found. Remember, they have administrative control and can see any software you have installed. Having software designed to circumvent security controls isn't going to look good. If you want to browse privately get a good mobile data plan instead and use your own equipment to do it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.