Is the installed certificate used for school wifi able to track me at home?

Question

I've read similar questions being answered on the safety and privacy of school wifi certificates but my question on whether they can still track me at home stands. I'm using my own computer (not school's) but the certificate I installed in order to use wifi seems a bit fishy.

This is the BYOD programme we're using: https://cyberhound.com/byod/.

Is this a certificate to simply access my school's wifi or do they have full control outside of school on my home internet?

Answer 1

The certificate is one part of the whole system. The other part is the school router which should be CyberHound Appliance.

When your browser connects with a site with https, the flow goes roughly like this:

1. Browser initiates connection with the server
2. Server returns its own certificate and a chain of certificates reaching up to a well known Certificate Authority (CA)
3. You browser checks the server's certificate is valid, and the chain of certificates reach to a CA that it already trusts.
4. If the chain of certificates does not reach to a CA that your browser already trusts, it will show you a warning that your connection is not secure

When you install the Cyberhound certificate, you are adding to the list of trusted root Certificate Authorities.

This means Cyberhound appliance can now do following:

1. When your browser makes an https connection to any server, cyber hound will intercept the request and generate a certificate for that server signed by its own root CA
2. Your browser will receive a certificate from Cyberhound appliance instead of the actual server you were trying to use. As the browser on your computer already trusts the cyber hound root CA, it will trust the certificate
3. Now Cyberhound appliance will be able to decrypt the communication between your browser and target server. It may log your activity and enforce other school policies.

As you see the certificate and the router (appliance) work together to intercept your https communication. So unless your home network is also being intercepted by a router that has access to Cyberhound private keys, you home internet usage can not be monitored by your school or Cyberhound.

TL;DR: You home internet connection can not be monitored just because the certificate is installed on your computer. There must be a router on your network with access to Cyberhound private keys to generate the certificates in order to intercept the communication.

Note: I have left some details out to keep the answer easier to understand.

Answer 2

Installing additional Root CAs to your PC can give others significant access to your network communications depending on how trustworthy the operators of that Root CA are. You rely on Verisign abiding by its Certificate Practice Statement (CPS) and only issuing certificates to authorised users of the represented resource.

In this case you are installing a Root CA to enable them to effectively perform man-in-the-middle ‘attacks’ on your communications which can be used to read sensitive data, impersonate you and access services you have signed-on to, and potentially compromise your computer. The access may not limited to just HTTPS either.

If you trust the administrators of the cyber hound appliance implicitly to not attack your computer, and also (more importantly) to competently design, implement and operate the appliance properly without compromise of the private key material, you will probably be fine.

If not I’d remove the certificate, or at least scope it (slight benefit only) - right-click, properties, ‘Enable only the following purposes’ and tick only ‘Server Authentication’.