0

Last week my employer sent me a root cert to access the company’s VPN on my personal iMac. When I am connected to the VPN, I’m aware the VPN server can encrypt/decrypt the traffic, but I have some questions.

  1. If I am already signed in to an email service before connecting to the VPN and then receive or send an email after connecting, can the VPN server hijack the session from the URLs and payloads of that traffic and have the ability to pull other emails? What about apps that I have logged in (eg: twitter) that ping their servers every now and then; can such traffic enable the VPN owner to access my account as if they had a logged in session?
  2. Can direct end-to-end encrypted messages services like iMessage, Messenger, etc be decrypted and read by the server? If it can, can the VPN owner only read the messages that are being passed through the VPN?
  3. When not connected to VPN, does my iMac still make use of the installed cert when using the Internet normally?
  4. Does the root cert have the ability to collect other device info, offline usage behaviour, message traffic from eg: Slack, Discord, etc and perhaps send a report to the company’s server?

Some of these questions make me sound paranoid, but just intrigued to know how much privacy I am losing. Thanks!

Improve this question
3
  • There are multiple questions in the description and none in the title. These questions should either be posted as such (separately) or be summarized into one more general question that suits all of those privacy related concerns.
    – Bob Ortiz
    Commented Jan 9, 2023 at 13:38
  • Too many bundled questions. I can only tell you this about your privacy concerns. You will never be 100 percent private or anonymous. Companies you do business with, your bank, you employer, your school, your government, your browser, heck even amazon etc need your data and information to provide you with a service or product. They need to know who you are before they give you anything. And guess what. You do not have control over how THEY handle your data or information, even when they claim they take all precautions, follow NIST/ISO standards, or government regulations
    – Full Array
    Commented Jan 3 at 4:01
  • 1
    Also. Never mix business and personal affairs. You do not use your personal computer with your employers. If you must, you log in to your VPN do your work and log out. During your VPN session do not do personal activities in your computer.
    – Full Array
    Commented Jan 3 at 4:09

1 Answer 1

Reset to default
1

I’m aware the VPN server can encrypt/decrypt the traffic,

A VPN server by itself can not decrypt application traffic. When doing HTTPS over a VPN the HTTPS is still there after VPN exit.

The company might have also some firewall/proxy though which does SSL interception. But this by itself has nothing to do with the VPN, except that due to the VPN the internet facing traffic might now pass through the company infrastructure and thus also through SSL interception. But this is just a "maybe" and it is not clear if the certificate you got is for such SSL interception.

If I am already signed in to an email service before connecting to the VPN ...

Mail clients, web browsers and other applications are often written in a robust way. If the connection breaks because a VPN got established and thus traffic flows differently, then they might transparently try to re-establish the connection. It is not clear in your case if you even have a full VPN which passes all traffic through the company infrastructure, or a split VPN which is only about allowing company related traffic to communicate with the company infrastructure.

Can direct end-to-end encrypted messages services like iMessage, Messenger, etc be decrypted and read by the server ...

End-to-end message encryption like used in iMessage can not be intercepted by SSL interception or similar.

When not connected to VPN, does my iMac still make use of the installed cert when using the Internet normally?

If it was installed as a fully trusted root certificate, then it will use it as such, i.e. similar to Let's Encrypt and others. But it is not known how the certificate was actually installed.

Does the root cert have the ability to collect ...

The cert is not an active element which will do anything. A VPN client instead is an actual program and could in theory do such things, similar to any other program you use on your system - which does not mean that it actually does.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .