-2

My school says that they can see their students history, but is it possible for them to do so even though you are using your own device?

6
  • 2
    Not sure how the title relates to the body
    – schroeder
    Oct 12, 2018 at 19:11
  • 2
    Hello, and welcome to the Information Security SE. Your question is slightly vague. If you can give us more information, we will be able to provide you with better answers. For example, are you on their network? Are you using only your own device, or the schools devices as wel?. Are you referring specifically to browser history, or any other sort of information Oct 12, 2018 at 19:11
  • sure, in some cases they can.
    – dandavis
    Oct 12, 2018 at 19:12
  • In almost all cases they can. They own the network, they only need to look at DNS traffic.
    – ThoriumBR
    Oct 12, 2018 at 19:52
  • @ThoriumBR but tying DNS queries to specific students is not always straightforward
    – schroeder
    Oct 13, 2018 at 9:58

1 Answer 1

1

TL;DR: yes, in some cases they can

I assume you are browsing the Internet on your own device connected to your school's Wi-Fi network, and that they didn't make you install any software on it or make you accept any SSL certificates (e.g. via Profiles on iOS).

Provided you only connect to websites protected by HTTPS (SSL/TLS), all they can see are the DNS requests from your device and a pretty precise estimate of how much data you are transferring, but not the names of the pages.

For example: imagine you are watching the YouTube video at https://www.youtube.com/watch?v=dQw4w9WgXcQ. They will be able to know that you are streaming content from youtube.com at a certain bitrate, but they won't be able to know what content exactly is being transferred (though they will be able to take a wild guess and say it's a video, since you are on YouTube).

However, when you are instead using a website that doesn't support HTTPS (i.e. you're at an address that starts in http:// instead of https://, using software such as WireShark they will be able to read data transfers in clear and see exactly what you are seeing!

Additionally, if you plan on using Torrent software (such as uTorrent, BitTorrent, qBitTorrent, Transmission or similar) or other P2P platforms (like Emule), the data you transfer will also most likely be not encrypted, so doing illegal torrents from school is not a great idea, not that it is in general. Most online games (albeit not Minecraft since version 1.7.x) will also not encrypt their connections.

Ways around these limits are:

  • Using VPNs (some are free, but the good ones are paid services)
  • Using something like Tor (not recommended due to the high connection latency and low bandwidth, as well as being blocked at most schools and workplaces)
  • Using a selfhosted encrypted network proxy at home (Squid is IMHO one of the best softwares to do this)
  • Not breaking school rules maybe (?) :D
1
  • You may want to add that they will be able to see the hostnames from SNI (although this data would likely match the data they could gain from DNS)
    – jrtapsell
    Oct 12, 2018 at 19:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.