Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of Google and Wikipedia, that is https://www.google.co.in and https://en.wikipedia.org. Now weather they are able to monitor my search contents and search topics? I know the query string are encrypted so i guess they can't. But I want to know what are all the information can be tracked except host name and the length of data? Can they sniff which topic i am reading in Wikipedia or what are the contents i am searching in Google?

And also if search my result contains images, especially when searching for something the page contains images from other pages and the same thing with image search also. The image is hyperlink to their corresponding page. Is that URL is traceable if i didn't clicked the image. because that image will be from other HTTP connections. So that is traceable right?

share|improve this question

migrated from stackoverflow.com Jan 21 '13 at 8:00

This question came from our site for professional and enthusiast programmers.

    
Try to capture network packet & you will know. Try. –  Raptor Jan 21 '13 at 6:10
    
@Shivan i tried using Wireshark, I couldn't track anything except sender, receiver and ports. –  sujeesh Jan 21 '13 at 6:12
2  
You just answered your question. –  Raptor Jan 21 '13 at 6:13
    
@ShivanRaptor I just want to know in case of firewalls is there any way? I mean I have restrictions to search scores of football, movie reviews in Wikipedia etc. So if they found it's not good for me. that's why i have doubt. –  sujeesh Jan 21 '13 at 6:16
    
Always append "you+are+monitoring+rascal" to all your URLs. Add it to headers also. –  Roman Newaza Jan 21 '13 at 6:17
show 4 more comments

2 Answers

They can still monitor HTTPS traffic if they replace the SSL certificate with one of their own. Many (hardware) filtering devices do that. The organization would have to make sure that their certificate is installed in the computers you use, otherwise the browsers start complaining about suspicious certificates.

You can check the certificate of any HTTPS site you're visiting: if is not from the site the company has inserted its own.

Listen to Security Now episode 243 (http://www.grc.com/sn/). Here is its transcript: http://www.grc.com/sn/sn-243.htm

To find more info Google 'deep packet inspection https' or just 'dpi https'.
E.g. this post: http://community.spiceworks.com/topic/137822-sonicwall-deep-packet-inspection-ssl-dpi-ssl

And whether 'your' specific Cyberoam firewall has this capability, you can maybe check at their website http://www.cyberoam.com

share|improve this answer
add comment

According to conversation above, HTTPS encrypts your request contents. You can't look into the packet and grab useful data, unless you decrypt it intentionally. There is only a very limited information you can grab from HTTPS packets.

Network capturing (e.g. using Wireshark) couldn't track anything except sender, receiver and ports.

share|improve this answer
    
I have a doubt. If search my result contains images, especially when searching for something the page contains images from other pages and the same thing with image search also. The image is hyperlink to their corresponding page. Is that URL is traceable if i didn't clicked the image. because that image will be from other HTTP connections. So that is traceable right? –  sujeesh Jan 21 '13 at 7:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.