0

My company provided me with a MacBook for work. I was the one that took the laptop out of the sealed box and I was the one to set it up. I only had to install the tunnelblick VPN client and use the tunnelblick (certificate) file (fileName.tblk) that was explicitly generated for me. No other IT/administration/device management software or anything else in that regard was/is installed.

I'm now considering to sign in with my private Apple Id and use my passwort manager on that device (for convience), because I'm pretty sure that in my case they are not able to access any information even if I'm connected to the VPN, except for the websites that I connect to (which I don't mind them knowing).

Am I correct in my assumption? I know that it is possible to install a root CA to apply MITM attacks to circumvent the VPN limitations, however I couldn't find anything if that is even possible with tunnelblick. I didn't see any abnormalies with the certificates of the websites that I checked in my browser (e.g. google was still certified by GTS)

Improve this question
-1

tunnelblick seems like a simple p2p VPN that establishes a secure connection. However if all your traffic is routed through the organizations' DC rather than split tunnel configuration they might have a web gateway acting as a MITM. You can relatively easily check this by checking the certificate of common websites you use. If it's the original certificate there's probably no MITM.

Improve this answer
3
  • The OP says he certificates of the websites that I checked in my browser. You answer You can relatively easily check this by checking the certificate of common websites you use. You suggest to do what the author has already done. – mentallurg Apr 8 at 22:30
  • Let's say they installed a root CA (either on the VPN server or directly on my device), then I would still be able to identify MITM if the certificate on my company laptop doesn't match the one my private device, right? – user255171 Apr 9 at 18:28
  • If the organization replaces the certificate and it's not trusted by your browser than it should raise a security warning on the site certificate – Igliv Apr 28 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.