4

I am connected to the internet in the office where I don't want the administrator of the network to find out the contents I check (for example images).

First I use a Firefox private browsing window to not leave a trace on the computer.

Then I supposed when I search images through SSL protocol (I mean in particular https://images.google.com), the images are only shown and are detectible on my computer and not any computer in the path so it keeps my privacy

Am I safe with the scenario above?

  • 23
    If there are things you don't want your employer to know, don't do them at work. – Bob Brown Oct 12 '14 at 13:18
  • 1
    If nothing else, the mitigation steps required to make your requests private are going to look really suspicious. They may even violate one or more employee agreements you may have signed. And if you spend too much time looking at whatever those images are, you can still be called to account for wasting time at work. If there's an information breach from an insider, and they can't find any other obvious routes out, you're going to look really good for it... – Clockwork-Muse Oct 12 '14 at 23:19
  • 1
    No amount of encryption stops someone from walking up behind you. Just, you know, as a reminder. – corsiKa Oct 13 '14 at 0:39
  • by office I mean university, I do those searches just few times on my free time, but discovering the contents (images) by any one, could make problems for me or the university. In fact the administrator doesn't much bother but there are some nosy organization in my country who may want to trace who do what. – Ahmad Oct 13 '14 at 17:02
7

For all practical purposes, if you are accessing the internet from your own personal computer, then using SSL alone will prevent your network administrator from knowing the exact URL (initial DNS connection will only reveal hostname) of the images you download from https://images.google.com/.

However, if you are using your employer's computer, where the OS is installed by your system administrator, then besides turning on incognito/privacy mode to clear browsing history, there are two extra things to look out for:

  • The first thing is to go through the list of trusted Certificate Authorities (CA) stored within your browser to ensure that there is no Man-in-the-Middle proxy root certificate installed, which can be use to decrypt HTTPS connection if your connection passes through a MITM proxy.
  • The second thing, which is more difficult to do, is to ensure that there are no spyware or keylogger installed on your computer. These can log your site visits without you knowing it.

A simple way to overcome these two obstacles is to boot up from a Linux Live-CD to surf the web over SSL.

  • I installed a windows 7, I am its administrator and turned off remote desktop, I created a vpn connection to connect to the server and access internet, however there was another Windows XP installed on the computer, I also was the admin of that but just a network-based virus scanner (panda) had been setup on it. – Ahmad Oct 12 '14 at 13:12
  • If you are not specifically targeted by your employer, CIA-style, you should be safe. But as Bob says, try not to do personal stuff at work. Who knows if someone catches you watching some cat videos at work. – Question Overflow Oct 12 '14 at 13:53
  • Instead of trying to audit the CA list directly (it's going to be full of companies you need but almost certainly have never heard of); spot checking the CA used at home and work are the same. ex my employer uses a product called Bluecoat to monitor network traffic and for anything not on the whitelist it will come up as being secured by bluecoat.employer.com, instead of by the normal CA. – Dan Neely Oct 12 '14 at 17:48
3

Keep in mind that the HTTPS connection only works between you and Google - the website that actually hosts the picture might not support HTTPS. If you never click the "visit page" or "view image" buttons, you are probably safe since you are viewing Google's copy of the image.

However, if you click one of those buttons, you will download the image from the original site which probably does not have HTTPS enabled. This will allow someone monitoring network traffic to see what image you viewed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.