7

Possible Duplicate:
Is Gtalk communication encrypted?

How can I make sure that my chat is not read by someone else (especially within my organization network)?

Using a Wireshark capture in the network you can capture Yahoo! Messenger conversations, YM doesn't use encryption. I searched GTalk's help but I couldn't figure out exactly how secure it is.

1
  • 1
    Not guaranteed; Symantec IM Manager is able to store logs of all "corporate messaging" and includes support for Google Talk. Whether it covers the audio is not something I know about. If they can do it, there's probably multiple products and ad-hoc methods that can do it.
    – dlamblin
    Oct 2, 2009 at 18:54

5 Answers 5

6

Google Talk uses the XMPP (Jabber) protocol, with SSL encryption layer - the same that's used for HTTP ("HTTPS") and many other programs.

<edit> But as Wil says in his answer, some companies may have SSL proxies installed, and monitor all communications that way. (But I doubt that those proxies check anything other than HTTPS on its usual port.) </edit>

1
  • 1
    +1, Thanks for referencing me! I am not 100% sure though, I think you are correct on the majority (90+%) of firewalls, but I have seen some DPI models that simply treat all http with one rule, https either another and ignore port... I is just noting as you and I said that it is possible, but unlikely.... However again on top of this, I have seen a heavy increase in offices using IM monitoring tools (for MSN and others) Not personally seen Jabber, but most of the tools probably support it :S Oct 1, 2009 at 13:32
7

You can never be 100% sure, on a machine at a company, they could even have their own signed root certificates installed on your machine and have a SSL proxy that monitors everything.

If you use Google Talk, it should be secure as far as standard interception goes, however, if you do not want people to know what you are doing, the best thing is just not to use it at work.

6

If someone in your organization truly wants to know what you're doing on your computer, they'll probably slap a keylogger on it anyways. Protocol security is moot at that point.

3

I think what you're really doing is a kind of "risk assessment". Risk assessment has two factors: one is the probability of a bad outcome, the other is the severity of the outcome if it occurs. The "product" of these two (subjectively determined) factors is your actual risk.

The probability of a bad outcome is sort of unknown here, but if you don't own the computer network at work, they are pretty much free to record whatever they want (if they really, really want to and if it is actually "worth it" to them).

If the worst thing that could possibly happen is that someone would listen in on your conversation with your wife about what time you're coming home from work-- then, I'd say your risk assessment is very low, regardless of what IM software you use.

If the worst thing that could happen is that your employer discovers that you're going to poach clients from them-- then yeah, that's a risk.

2

Your question can be asked in more than one way. eg. "Is the web secure?". It's an open question which leads to many different answers. However, Google does use the data you generate to further 'improve' their services. Google learns from your actions to further enhance their Advertisement services and increase revenues.

So is Google Talk secure? Is the phone line secure? Is a credit card transaction secure? Depends on what you think of it.

Not the answer you're looking for? Browse other questions tagged .