42

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Root CA
   Operative CA1
      ___________.net
         mail.google.com

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
   Google Internet Authority G2
      *.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too.

If this is true, can I work around this? Or please correct me if I'm wrong.

Improve this question
10
  • 3
    Not sure I understand how this is not throwing a security error in your browser... is "Root CA" and/or "Operativ CA1" trusted because certificates have been installed on your machine as trusted, or did your company somehow get a different certificate from google for mail?
    – Michael
    Commented Feb 21, 2017 at 17:50
  • 3
    Probably these certificates have been installed on the machines as trusted, yes. My account has limited access. I need permission for everything expect some basic function, so I can not check this out.
    – ampika
    Commented Feb 21, 2017 at 19:00
  • 2
    @dave_thompson_085: I don't think this is strictly a duplicate; that questions asks about what has happened, while this asks about workarounds.
    – sleske
    Commented Feb 22, 2017 at 9:12
  • 3
    @ydaetskcoR Browser pinning explicitly accepts local CAs, specifically to allow for use cases like corporate TLS intercept, e.g. chromium.org/Home/chromium-security/…
    – Mark E. Haase
    Commented Feb 22, 2017 at 15:41
  • 1
    @mehaase: Arguably that's a serious bug: unwanted installation of local CA (by malware or a malicious user) will go undetected. It should be doing the opposite; always showing a red broken lock (but allowing the connection) when a local CA that's not restricted to the local DNS domain is used.
    – R.. GitHub STOP HELPING ICE
    Commented Feb 22, 2017 at 17:58

3 Answers 3

Reset to default
50

Yes, a company doing SSL interception could in theory read all your traffic if you use the company network. Depending on where you live and what kind of contract you have the ability for the company to do this might also be somehow part of the contract or working rules which might also include that you are only allowed to use the company network for work related stuff.

can I workaround this?

Yes, you might use a different machine and network like your mobile phone for your private, not work related, traffic. Depending on the configuration of the firewall it might also be possible to use some VPN tunnel through the firewall. But it is usually explicitly forbidden to do this so you risk to get fired for this.

Improve this answer
11
  • 39
    Since they do SSL interception, in theory they could also do something more invasive such as keyloggers or remote screen capture. "Use your machine, not their machine" seems the best advice, to me.
    – Federico Poloni
    Commented Feb 21, 2017 at 11:02
  • 7
    Of course, if your employer provides your mobile phone, that is their machine too.
    – Martin Bonner supports Monica
    Commented Feb 21, 2017 at 12:54
  • 3
    @Shadur: pretty much every enterprise firewall and also several low budgets and also the open source squid http proxy can do this. Several desktop antivirus do this too. And some malware or adware too. It's nothing special today.
    – Steffen Ullrich
    Commented Feb 21, 2017 at 13:56
  • 3
    Yeah, it's not particularly difficult. It's just a damned stupid thing to do because you're breaking the chain of trust.
    – Shadur-don't-feed-the-AI
    Commented Feb 21, 2017 at 13:57
  • 6
    @steffenullrich And it's easy to do badly, and when done badly the potential security risks far outweigh the benefits.
    – Shadur-don't-feed-the-AI
    Commented Feb 21, 2017 at 15:43
10

In addition to scanning for malware, corporate IT also uses TLS intercept for data loss prevention (DLP), eg. making sure you're not sending proprietary documents through your personal e-mail.

In most medium to large companies, you must sign an "Acceptable Use Policy" as a condition of employment, and that policy will explicitly state that they are allowed to monitor everything you do on a company-issued computer and/or the company's network. It may also include restrictions on what type of personal activities you're allowed to do on the company's computer/network. And if it does, then the policy probably forbids you from workarounds such as a VPN.

Assuming you work for a big company that has this type of policy in place and also the technology to monitor and enforce compliance, my recommendation is to use your own personal device for personal matters (i.e. smartphone) and do not connect your device to the company's network. (Some companies have a separate, "open" network for employee-owned devices.)

Improve this answer
4
  • 2
    If such an interception is not documented in some formal policy, it is thoroughly bad form to do it surreptitously, and a reason to reconsider if you want to work for them.
    – rackandboneman
    Commented Feb 22, 2017 at 15:23
  • 1
    @rackandboneman I agree. It's completely unethical to do it without informing employees. When the policy is documented, it's often not explained in a way that the average employee would understand, and so I think an incomprehensible AUP is equally unethical.
    – Mark E. Haase
    Commented Feb 22, 2017 at 15:34
  • 1
    Absolutely agree. This is a browser UX problem too. The browser should always be showing connections accepted due to a locally installed root CA as "broken lock"/"insecure" and reminding the user that their activity is being intercepted and monitored. Not only would this protect the privacy of average employees who don't understand the AUPs; it would also actively discourage inappropriate use of workplace computers/networks rather than relying on punishing employees after they do something wrong.
    – R.. GitHub STOP HELPING ICE
    Commented Feb 22, 2017 at 18:00
  • @R That's a really good idea! You should submit your idea to the Chrome bug tracker; I think the Chrome team is likely to be the most responsive to your security UX proposal. And maybe contact @__apf__ on Twitter: she works directly on the TLS UX in Chrome.
    – Mark E. Haase
    Commented Feb 23, 2017 at 15:47
7

Being able to "read" all your encrypted communication doesn't necessarily mean someone is literally sitting at a computer and looking at your data. The "man in the middle" is generally a firewall or proxy appliance, where the IT/Security administrators create rules to block or flag certain types of content. The appliance inspects the packets in plain-text, but it's generally not exposed to a live human.

That said, the general rule applies that you should only do work-related things on your work devices. Even if your traffic isn't being decrypted, the name of the site you are visiting - though not the exact URI - is still visible (via SNI). In other words, even over HTTPS, whether you're just visiting Facebook too much or browsing pr0n, the list of sites you are visiting is visible to corporate eyes, with or without something intercepting the cert. Be smart and just keep personal things on personal devices.

Improve this answer
2
  • 6
    The hostname that you're connecting to is transmitted in plaintext (SNI), not the full URI. Anyone snooping knows that you've connected to https://​facebook.com/, but not what you're doing there. This can be an important distinction.
    – josh3736
    Commented Feb 21, 2017 at 18:23
  • @josh3736: Exactly. I submitted an edit to correct this.
    – sleske
    Commented Feb 22, 2017 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .