4

I simply want to know if is this normal, abnormal, deceptive, illegal, etc...

I am at work. When I bring up a certificate for most domains, I get a very standard certificate. When I bring one up for Facebook or Twitter (social media sites), the certificate throws a warning. The warning is because they are untrusted. Looking at the certificate, the Issuer is the company that runs the local network in our building. It is not a standard issuer.

This is exactly how it is listed (replacing the company name with xxx.com):

Issuer: DC=com, DC=xxx, CN=XXXsubCA

  • 1
    The company running the local network is distinct from the company you work for? If the entire building has to tunnel traffic through a brazen MITM, then I am not sure about the legality. I can't say for sure, but in the US I think this practice might fall in violation of privacy laws. Since you had to come here and ask about it, I will assume that clear disclosure was not provided as it should be to all companies and employees that otherwise would rightly expect privacy over a secured connection. – AJAr Feb 6 '15 at 19:15
3

Some companies are very concerned about information leaking onto social media sites. Because of this, they will put in proxies that inspect the content of data sent to social media. When they do this, they issue their own certificate, and it behaves in the way that you describe.

Is it normal? Not for the average user, but increasingly normal in corporate environments

Is it deceptive? Sort of, but you might have been notified of this kind of thing in a corporate policy

Is it illegal? That really depends on your jurisdiction. But, as I said, it is becoming increasingly common, and in many jurisdictions is legal (with or without notification).

The other question you need to ask is, "what is my risk?" And here it is: Because they are interested in the content of what you post, it is likely that they store, inspect, and alert on that content. That means that everything you post goes to your company. All communication (to those sites) is no longer private to you and your intended audience, but is exposed to those who are authorized to view such information in your company.

1

In the United States, the practice might fall in violation of national privacy law. I can't say with certainty, however I believe that clear notice must be given to all users of a network where the benefit of privacy normally offered by—and therefore typically expected of—a secured connection is not intact.

Furthermore, there is a security risk at hand: based on the fact that you had to ask about this here (issuer of the certificate was not trusted), it seems likely that other employees—especially those who aren't as skeptical as you—would in time become desensitized to those warnings, eventually taking for granted the validity of any untrusted certificates issued under that name. There is the possibility here that another machine on the network will intercept the traffic with untrusted certificates under that same name, and potentially cause even more harm than just casual day-to-day infringements on employee privacy.

If not illegal, it certainly is at least an unethical and potentially harmful practice in the case where disclosure of the act is not given to network users, and especially where network users are not even informed of how to add the CA as a trusted issuer.

  • 1
    unless the certs are installed by group policy and employees are informed via corporate policy- then the users are not faced with errors and there is notification – schroeder Feb 6 '15 at 19:54
  • Yeah, in that case I think a claim of privacy infringement would depend on the extent to which affected employees could reasonably be assumed to understand the implications based on the language of the policy (and maybe the background assumed for a position that entails use of the network). – AJAr Feb 6 '15 at 20:03
0

Generally they don't want to encourage people accessing the outside sites with the proper standardize way as there is a chances it lead to many problems such as policy violation, malicious attacks and also data leakage. To protect these all from external world, they can have third party servers it may be proxy or what ever ( the company bought ) will check the complete packet analysis and encrypt the contents on their own CA setup configured on the third party server. Such servers as Blue coat , FireEye , Websense, etc

  • In case of untrusted certificates , then the server ( proxy or anything ) they configured a little mistake by forgot to install the RootCA or the corresponding certificates. So, just by installing the cert will solve the problem – user45475 Feb 6 '15 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.