25

I connect to the internet using my company's Wi-Fi and Tor. Can they still see the websites I visit?

Improve this question
3
  • 2
    1) Are you using a company computer? They could have some logging software installed 2) In which jurisdiction are you?
    – CodesInChaos
    Aug 12, 2014 at 10:26
  • 1
    In the future, please do more research before asking, and show us in the question what research you've done. Your question is covered well by other questions with the tor tag. See, e.g., security.stackexchange.com/q/1057/971 and security.stackexchange.com/q/27845/971.
    – D.W.
    Aug 13, 2014 at 18:01
  • 3
    I propose to reopen this question. It specifically asks about using Tor at workplace and the answers nicely describe the problems specific to this environment, especially use of computers which are managed by somebody else. This important part of the question is not covered by any of the questions which are considered duplicates.
    – Steffen Ullrich
    Dec 12, 2016 at 16:44

3 Answers 3

Reset to default
32

Generally speaking No. Assuming:

  1. You follow Tor's best practices

    Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To avoid problems with Tor configuration, we strongly recommend you use the Tor Browser.

    so if it's not setup correctly things can still leak like DNS requests for example.

  2. You are using a private computer (or at least one the company doesn't control). If they are admins on your computer they could install VNC or some logging software that will record your actions regardless of what software you use.

Improve this answer
11
  • 34
    The workplace can detect that he is using Tor though. Which might be worse than them knowing where he is browsing.
    – Taemyr
    Aug 12, 2014 at 12:00
  • 10
    @Taemyr "If only suspicious activity is private, privacy becomes suspicious."
    – Luc
    Aug 13, 2014 at 8:54
  • 3
    Your workplace has the right to restrict what software you use on work computers and the work network. Don't be surprised if you're told to stop using Tor entirely.
    – Blazemonger
    Aug 13, 2014 at 15:27
  • 1
    @Pacerier What you are doing is probably not so bad as what you could be doing. When all the employer sees is that you are using TOR he is left to guess.
    – Taemyr
    May 26, 2015 at 2:39
  • 1
    @Taemyr, What do you mean? Tor doesn't bypass data transfer limits. The limits are still there.
    – Pacerier
    Jul 2, 2015 at 9:03
59

First:

  • Don't use work computers for personal use, people!

Many network policies forbid personal use. Our policy states that personal use is not forbidden but is monitored. If you don't want to be monitored you need to use equipment you control.

TL;DR: If you don't want your parents to know you smoke, don't smoke in front of your parents.

Work Equipment

If you are using a work computer, yes, if they want to, they can monitor everything you do. All they have to do is install software on your computer (which is actually their computer) which logs all web browsing activity.

If I caught someone using Tor in my organisation (absent special permission) I would fire them on the spot, for violating half a dozen policies, including circumventing our protections against data exfiltration, required both by data protection law and our agreements with our customers.

Own equipment

If the equipment is owned and controlled by you, I am wondering why they have given you permission to connect it to the network.

If you don't have permission, then again, that is grounds for termination.

If you have permission

If you are using your own equipment, and you have permission to connect to the network, (for example the company supplies visitor Wi-Fi as a courtesy, and allows staff to use this) then you are in the same position as when you use a hotel, coffee shop, or fast-food restaurant Wi-Fi, and there is then nothing special you need to know.

So what should you do?

If you want to e.g. email your doctor about your cancer diagnosis without alerting your employer, you should do it from your smartphone, using the data connection.

Improve this answer
7
  • 1
    Note: I am explaining the why as well as the how: why the employer will want to do this, and why you should not try to circumvent their policies, and how to achieve what you want (privacy, presumably) without doing so.
    – Ben
    Aug 12, 2014 at 16:18
  • 1
    Really great point mentioning why circumvention is a huge liability for employers.
    – Joel B
    Aug 12, 2014 at 16:19
  • 2
    +1 how stupid can people be. Use a smartphone with data service for your personal communications from work.
    – R.. GitHub STOP HELPING ICE
    Aug 13, 2014 at 3:15
  • 5
    I would use TOR just so you could fire me on the spot
    – code ninja
    Aug 13, 2014 at 8:18
  • 5
    This answer is a great reason why questions should be formulated neutrally. It's fine to advice someone of best practices but from a technical point of view half the answer is off-topic.
    – musiKk
    Aug 13, 2014 at 8:44
2

You should be aware that Windows allows administrators to run scripts on any computer that connect to the local Windows domain, so if you login to the domain, the admin controls your computer.

The same is potentially true by just connecting to the network. This is the untrusted network threat model, which is almost impossible to protect against unless your computer sends 100% encrypted traffic - which it doesn't. One unencrypted auto-update request, from Microsoft or some other vendor, gives anyone in control of your network the ability to install any code they want on your computer.

Improve this answer
5
  • 2
    "just connecting to the network" won't allow them to run code on your computer. That's what we call an RCE and is considered a security vulnerability if software allows it. Sysadmins can only run scripts on Windows remotely because the system was connected to the active directory by an administrator earlier; you can't just run code on anyone connected to your WiFi network. That would be, well, either lots of fun or hell, depending on which end you're on.
    – Luc
    Aug 13, 2014 at 9:00
  • 1
    Untrusted network threat model allows it, because so much software updates over unencrypted channels. Even Microsoft updates were unencrypted until recently. For example 'http:// microsoft.com /update' gets switched by the proxy to whatever EXE you want, then you own the computer.
    – Jeff-Inventor ChromeOS
    Aug 13, 2014 at 9:05
  • 5
    @Jeff-InventorChromeOS actually Windows updates have to be signed by Microsoft for them to install.
    – kinokijuf
    Aug 13, 2014 at 14:56
  • @kinokijuf, Citation please.
    – Pacerier
    May 5, 2015 at 5:38
  • 2
    symantec.com/connect/blogs/… “Hijacking Windows Update is not trivial because updates must be signed by Microsoft.”
    – kinokijuf
    May 5, 2015 at 8:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.