0

By "my credentials" I mean the username and password that I provide upon log-in in various web sites, such as Google, Microsoft etc.

My company is allowing browsing through a web-proxy.

What troubles me, specifically, is the potential ability of my company's IT personnel to steal such kind of information.

I clarify, I am always talking about SSL/TLS encrypted communication. I know that simple http traffic is easily sniffed.

5
  • By using a proxy your company as the potential to perform a MiTM attack on even encrypted traffic. – Ramhound Mar 4 '19 at 12:49
  • Can you elaborate on how a MiTM attack can reveal my credentials? With an example? – cnom Mar 4 '19 at 13:13
  • Generic example here: en.wikipedia.org/wiki/Man-in-the-middle_attack#Example Also good discussion here (more relevant to your case): security.stackexchange.com/q/8145/201081 – Art Gertner Mar 4 '19 at 19:42
  • @cnom - By using the proxy, your company could issue their own SSL certificate, so they can decrypt traffic between your client machine, their proxy server, and some other external server. How this is accomplished is well documented, but the details of how you accomplish it, do not pertain to your question as it is currently written. If you are are worried about your personal details being harvested by your company, don't use company IT equipment, for personal business. – Ramhound Mar 4 '19 at 19:58
  • are you using a company computer? For all you know, they have a keylogger on it and are capturing everything you type. If you are worried about your company stealing your personal information, you shouldnt be using a company computer or network. – Keltari Mar 4 '19 at 20:07
4

The short answer is: no your credentials are not secure when you browse through a corporate web-proxy. As pointed out by @Ramhound, this creates opportunity for man in the middle attack.

In particular, corporate laptops are often per-configured with software and a set of trusted certificates may be intentionally modified to include corporate CA which is otherwise not trusted by "clean" unmodified browser.

Routing all traffic through web-proxy is a normal practice for larger companies. Just because traffic is routed through the proxy it does not immediately mean that there is a reason for you to worry. This is usually a question of ethics an trust.

  • You should not be using corporate internet connection for anything not directly related to your work therefore there is no strong need for you to expose your private data/credentials over this intrinsically insecure connection.

  • It is also normal to assume that if you work for that particular employer you have a level of trust in employer's security policies that permits you to expose some work-related data to connection managed by corporate IT.

  • If you have any valid reasons to suspect IT personnel in your company of any fraudulent activity, you must report them.

2
  • Thank you for the thorough answer! About your 1st bullet, though, I should say that there are some kind of accounts, which one could say are mixed private-and-work related... – cnom Mar 4 '19 at 13:11
  • 1
    Yes, that is understandable. A lot of people end up using their personal google / microsoft login both at home and at work. I think this is not the best practice from security point of view but it is very common. This is why it is a question of trusting your employer. The opportunity to eavesdrop exists and is very real. You either trust your employer or look into a way of better segregating the use of accounts between home and work... – Art Gertner Mar 4 '19 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.