0

If I am in a place (not at home) such as an educational or work environment and use their WiFi and send or receive Facebook messages or Instagram DMs, are my messages visible to the IT admins of that environment? These messages are sent through my personal mobile device (the device was not given to me).

I believe Instagram and Facebook use TLS encryption, though I'm not sure if that protects my messages from being visible to the IT admin. I know it's visible that I use those applications, but I wonder if it's also visible what exactly I do in the applications.

Nothing sus happening in the messages, I just rather the contents of the messages to be kept personal (separate of those environments).

Improve this question
0

2 Answers 2

Reset to default
3

I believe Instagram and Facebook use TLS encryption, though not sure if that keeps my messages from being visible.

Yes, that keeps your messages from being seen by others. How does SSL/TLS work? explains this process a bit more in depth.

The only way for someone other than Facebook to read your messages would be for someone to perform a Man-in-the-Middle attack. You would recognize that this is happening, because your browser or app would display an error and refuse the connection.

In a corporate environment, it's possible (and even likely), that TLS Interception is used to inspect your traffic. This is done by having a Certificate Authority (CA) installed on your work device and then using a proxy, which claims to be the server you are trying to connect to.

You can detect this by checking the issuer of the certificate of the site. For example, Facebook's certificate is signed by DigiCert. If your connection is intercepted, it's likely signed by something related to your company, such as "ACME Internal CA".

If in doubt, you can ask your employer if they use TLS packet inspection on a work machine.

Improve this answer
4
  • @Danny In case of it being your own personal device, then no, it shoukd not be possible, unless someone asked you to install a CA certificate on it.
    – The one who tests
    Sep 4, 2022 at 22:01
  • @The one who tests ,not very familiar. What would it look when asked to install a CA certificate? I know for example back when I was in school years ago, we would need to sign in with our student ID and pass to use the wifi, signing in as a student (there were more options, like guest, but this was the option I chose back then I think).
    – user282383
    Sep 4, 2022 at 22:23
  • Can’t remember which option I went with back then. No way to check my networks either since they got deleted recently. Unless there’s a way to recover them
    – user282383
    Sep 4, 2022 at 23:16
  • @Danny Depends on your device. That would be a separate question though.
    – The one who tests
    Sep 5, 2022 at 1:00
-1

Well like most of these type things, it is complicated and a bit fuzzy.

With only a few Google searches I was able to find what is below within Meta's documentation. How fuzzy these details are is anyone's guess as Meta iterates their their software constantly and may run different versions in different areas.

If you are using "Secret conversations" then messenger relies upon the Signal Protocol.

On Instagram you must use end-to-end encrypted chat which they docs state "This feature is only available in some areas."

The reality is, follow the current docs and then if you trust "Meta" then assume your messages are reasonably safe from prying eyes.

Level of Risk should also be considered in all security conversations. What is the worst thing that would happen if they were seen?

Maybe try a VPN.

Improve this answer
6
  • But both use TLS regardless of the level of extra protection your use, which makes it safe from the local network. So, I'm not seeing any complications or "fuzziness".
    – schroeder ♦
    Sep 5, 2022 at 8:09
  • It is fuzzy as it is Only available in some areas and only is properly activated and the assumption that the docs follow reality.
    – jwilleke
    Sep 5, 2022 at 10:48
  • TLS is only available in some areas? And only if you turn it on? I think you are confusing E2E and transport encryption.
    – schroeder ♦
    Sep 5, 2022 at 10:50
  • The question was "Are my Facebook messages or Instagram DMs visible (aside from FB and IG) while using a local wifi?" not really about work. And in "an educational or work environment" where there is almost always "SSL-TLS Interception" which is a Man-in-the-Middle configuration, TLS packets are "visible".
    – jwilleke
    Sep 6, 2022 at 7:42
  • But that's a specific condition and context that you never mention. The way your answer reads, it's universally true. Besides, not all education and work use TLS interception, and if they do, it's not on all networks and for all sites. So you've skipped over the relevant bits.
    – schroeder ♦
    Sep 6, 2022 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy