My work lets us log onto their WiFi with our personal phones. We don’t have to log on every time; it just connects automatically. I have nothing downloaded on my phone from my work that they could ‘spy’ on me with.

Am I right in thinking if it is a secure site, for example, google.com if I search let's say for Facebook on the google domain it would just come up as google.com on the network traffic log providing there was no man in the middle attack from my employer?

Which brings me to my next question: how do you know if your employer is doing man-in-the-middle attacks?

Lastly, when logged onto Facebook can they see my messages that I send over their network in clear text?

I’ve probably been logged into the WiFi for about 3 years and never thought about what they could actually see until my friend mentioned why she uses a VPN.

  • You have asked 2 very different questions (1. what can they see? and 2. how to detect mitm?) but we have multiple Q&As covering each.
    – schroeder
    Dec 29 '20 at 18:08

If you use plain HTTP, then of course they can read everything. But the major sites like Google and Facebook don't support HTTP, only HTTPS.

Technically it is possible that they fake CA certificates, implement a man-in-the-middle and read all your traffic. But this is possible only in case they control your phone an install their certificates or if they trick you to install one of their certificates.

In a normal case there are many preinstalled CA certificates on your phone. If you don't accept their certificates (certificates faked by your company, in case your company fakes them), then you can be sure that your traffic to the sites in public internet cannot be read. What they see is only target host and port, the amount of data, duration. Based on timing and data volume in some cases it is possible with high probability to identify the data type like text messages, images, music, or videos. But not the content itself.

  • Thanks mentallurg, is there anyway I can tell if my employer has faked a certificate?
    – Sal
    Dec 29 '20 at 18:22
  • @Sal: If it was faked, your browser would show you a message that certificate is invalid.
    – mentallurg
    Dec 29 '20 at 19:11
  • @Sal: If you find the answer helpful, you can vote it up and mark as accepted.
    – mentallurg
    Jan 4 '21 at 20:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.