4

I'm using mail.com over HTTPS. I sent a mail and I was connected over my access to the company VPN. Is it possible that the administrator of my company can read my mails? I used Firefox / Webbrowser Login of mail.com

  • did you install a cert of any kind from your company? If not, then no. – dandavis May 16 '18 at 21:02
  • What do you mean? I'm using a vpn client for connecting to the vpn server. – v1si0N May 16 '18 at 21:06
  • that sounds like "no", so HTTPS should have protected you, even on a LAN. no worries. – dandavis May 16 '18 at 21:07
  • 1
    Is all traffic routed through the VPN? Is the notebook owned by the company? – multithr3at3d May 16 '18 at 21:43
  • 1
    You should assume the company can read anything going through their network, and also review all policies of that company to govern your behaviors. Generally speaking, accessing personal mailboxes in such scenarios raise the risks of information leak and you should not attempt yourself. – Lex Li May 16 '18 at 22:22
2

Yes. In your case, since the VPN connects to your company, it is possible that they may have visibility into your outgoing web traffic. They will see anything over plain HTTP, but many companies nowadays are breaking SSL/TLS at their boundaries in order to inspect it. A good indicator to check if they are doing this is to go to a site that uses HTTPS (like Google) and then click the lock icon in your browser to view the certificate. If the certificate doesn't have Google's information in all of the fields, it means that they are decrypting HTTPS and can see your traffic.

Certificate

2

Many companies install their own CA SSL certificates so they can decrypt HTTPS traffic. This essentially allows the company to do a Man In The Middle attack on the encrypted HTTPS connection, and read the traffic in plaintext.

If you're using a computer given to you and configured by your company, it's possible that they've installed one of these certificates on your computer. If this is your own personal PC, and your company hasn't ever installed software on it or otherwise configured it, it's unlikely they've installed their own fake CA cert.

You should be able to check this yourself. You'll need to go to your mail providers site, and examine the certificate it's received. This is done in different ways in different browsers. In Chrome hit F12, in the console that's created go to the security tab and click on view certificate.

For Mail.com as of May 2018, I see:

Common Name (CN)    GeoTrust RSA CA 2018
Organization (O)    DigiCert Inc
Organizational Unit (OU)    www.digicert.com

DigiCert is a legit Certificate authority.

If it's issued by a legitimate certificate authority like Digicert above, your mail is safe from being viewed by your company. If it's issued by something else, like your company or another fake CA created by a network device, your company can potentially read your email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.