Is Google hangouts encrypted? Would my work's IT guys be able see pictures and text I send while on a work computer? Yes I know I shouldn't be sending stuff I don't want them to see while at work, but it wasn't at work. I use hangouts on my phone as well and just realized I use the hangouts Chrome plug-in at work and it was syncing all my conversations.
You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options:
- It's possible to install additional root certificates on company's machines and use that to MITM all the traffic (traffic goes through company's gateway/proxy anyway, and having friendly root certificate on user's PC allows to do a full MITM);
- It's possible to install "employee monitoring software", which is essentially a key logger + process monitor + screen grabber. Some tools have capacity to locally intercept received messages in chats.
- It's possible to use remote access/collaboration tools to monitor what's happening on the screen of a particular PC.
In short, if you don't have control over the PC you're working on (and with company's workstations you typically don't), you cannot assume it's free from such surveillance implants.
Hope that's not too scary :)
Yes if your Google Hangouts data has synced onto your work computer the IT department could view it. However don't freak out yet, unless they are looking for it, it's extremely unlikely that they will see it.
There are three places that the IT Department could see it:
When syncing your hangout data if your IT Department monitors traffic over the network they could have seen it. As BigBob1000 says it's encrypted (HTTPS) however many enterprises install trusted certificates on their computers and then basically Man-in-the-Middle their own computers to decrypt all HTTPS traffic. Chances are even if they were doing this they would not have recorded the data, just that you connected to Google.
This is a more plausible issue but still incredibly unlikely, Chrome (all browsers) cache things. So rather than downloading the same image from Google a hundred times it downloads it onto your computes hard drive once, then uses that each time. I'm not sure what Chrome caches for hangouts, but an educated guess would be that it's profile pictures of your contacts and other images but not the text of your conversations.
You can clear your cache your IT Department might still have a backup but most places don't backup desktops, only servers.
Honestly I'm just putting this one in for completeness. EDIT: After seeing Andrey's answer, he brings up a good point, this is more plausible than I though. There could be employee monitoring software that records chat logs.
While it's certainly possible, the more applicable question is "how likely is it that my IT department cares?" (Unless you're doing something that could get you fired or arrested, naturally.)
In addition to that, the other consideration is that it costs a lot of money to actually store everyone's web traffic, so the content of messages and web requests is generally not stored for any significant period of time - it costs a lot of money to store that information and make it searchable, and there's rarely any business reason to do so.
Take it from an IT guy - you're not that interesting, and I resent requests to "look into" other employees' activities. I have better things to do than spy on people's social media use or web browsing, so even when I'm explicitly directed to do so, I don't look any harder than I have to in order to comply with my orders. At my workplace, that involves emailing off a canned report to the requester with high level stats on a user's activities - how many web requests made over a certain period, which domains those requests were made to and a break down of those requests by website category - and this is only when I can't get away with saying "no" to requests about what some employee is doing online.
If your company has a product named "Google Vault" installed then yes your IT department, or anyone granted access to Vault, can read your unencrypted Hangouts messages and pictures.
Google Vault is an eDiscovery platform - https://support.google.com/vault/answer/2462365?hl=en
The only way they would not be able to read your Hangouts messages is if you have turned the history "off" for each chat. In Google Chat this option is named "Chat off the record". In Hangouts it is named "Hangout history". Anything typed after turning off the history is not recorded.
To see what your IT people can see: Open your Gmail in the Chrome browser and click on the "Chats" label found after expanding the "More" button. Deleting what you find in this label won't help you because once it exists it exists forever or until the Google Vault policy expires it.
Yes - you really should assume that anyone can read anything you do online anywhere, anytime. If they own the network then doubly so. If they own the computer you're using, triply-so-with-knobs-on.
From another angle, if you are doing stuff on the work computer or in the work environment that you don't want work to know about, you probably shouldn't be doing it. Murphys law tells us this WILL go wrong for you at some point.
Assuming the IT department are models of benevolent permissiveness and/or ignorant/incompetent, it only takes one colleague who takes a dislike to you (possibly because you spend too much damn time on hangouts when you should be working, f'rexample) to peer over your shoulder, or one computer crash mid-session, or some unexpected computer virus, or a new and exciting bug in Google Hangouts that brings your machine down, to expose whatever it is you didn't want to be exposed.
Then again, by the sound of it, the day your mobile phone gets lost/stolen someone has a load of great blackmail material on you anyway. The problem with things you put on the internet is that they're on the internet.
Depends....easy way is to simply ask the I.T. department:
You: hi, I'm curious if our IM chats and emails are backed up or stored for compliance reasons. If I need to recover a chat from google hangouts for legal reasons, is it possible?
I worked in finance where 100% of all communication was recorded in our office as per government regulations including phone calls, chats on any IM client(we had a special software dedicated to it), etc.
Chances are you are not actively monitored but your browsing habits might trip an office firewall for repeated violations which may cause some scrutiny if it's ridiculous(tons of porn, obscene bandwidth usage, constant upload/downloading 24/7 such as torrents or spotify).
Emails yes if you are using thier domain or sending to a work email domain.
EDIT: one thing to watch out for is building security. If the I.T. department set up or paid for the cameras like I did, we can 100% spy on you at any time and even have zone triggers to alert us. One D-bag I know got building security to record entry times to tag late workers without them knowing despite the company merely being a renter. If you can,tell security to deny any requests to access that information from a third party becuase it will be used against you if possible.