16

I have noticed a lot of questions in this format being tossed around:

Can my employer see what I'm doing over Wi-Fi/Work Internet Connection?

Just searching for "Can my employer" on the Security Stack brings up tons of these types of questions.

Now it's not always exactly this question. Sometimes there are little variations like:

When I'm using App-X, can my employer see what I'm doing over Wi-Fi?

or

Can my roomates see what I'm doing on my home internet?

Would a canonical "Who can see my data over a network?" question be useful?

My thoughts are that there are only a few different circumstances in which the answer would differ (i.e. whether or not the application encrypts its data, whether or not there is a proxy in use etc...), and these could be covered in a single question/comprehensive answer.

OR would the idiosyncracies (like network configuration, application used, encryption standards) between questions of this type make it a poor candidate for a canonical question?

11
  • 5
    I think cleaning up that mess somehow is a good idea. Before asking a question, it might be worth considering if any of the existing ones could be edited to be general enough to serve as a canonical question. Perefably one that is not to specific, and already has a good general answer. – Anders Oct 30 '16 at 16:35
  • Good call @Anders . I will have a look through the questions and post any questions I find with potential, and hopefully we can work one of them down into what we need. – INV3NT3D Oct 31 '16 at 13:15
  • This question/answers looks promising. Any thoughts? – INV3NT3D Oct 31 '16 at 13:23
  • 1
    Those idiosyncrasies are usually suggested in the answers and not inherent in the questions (from what I see). The confounding variable would probably be apps, app versions, and the OS. Those are important in my opinion - unless it's part of the selling point, App encryption and security is a total black box. – Dave Oct 31 '16 at 17:27
  • @Dave I thought the opposite, actually. It seemed to me that the questions have slight differences like the ones you suggest. I.E. one question asks about an iPhone on WiFi, another mentions Facebook Messenger on an iPad. But I do agree that these, among others, are the important points to keep in mind. – INV3NT3D Oct 31 '16 at 18:49
  • @INV3NT3D Looking through the question you suggested and some of the other, I think it might be better to start freash. All of them have small specific points that end up taking a lot of space in the answers and clouding the big picture. But I might be wrong. – Anders Oct 31 '16 at 20:05
  • @Anders I agree. The question I posted had the sort of things I'd be looking for in an answer, but as you said, the specifics kind of muddle up the question into something less comprehensible. Now it's just a matter of formulating the question properly. We would want to cover, in my mind, the major OSs', device type, encrypted vs. non encrypted data, wireless vs wired networks, the degree of the 'opposing' parties' authority, but I'm not sure if that's too broad for a single question. Any thoughts on how the wording should go, or what I'm missing? – INV3NT3D Nov 1 '16 at 12:10
  • There are a few up-votes, but I am curious as to what the community would want out of this question. There is some agreement that this is a good question, but as far as what this question will involved still seems foggy. Any thoughts, suggestions, or even passerby comments about the use of 3's as E's in my username? – INV3NT3D Nov 2 '16 at 13:35
  • @INV3NT3D It is tricky to write a good canonical question. I would also appreciate some input from more people. – Anders Nov 4 '16 at 8:37
  • @Anders I'm starting to learn that you are absolutely right. I will respond to my question with a proposition of the question sometime this weekend (what a mouthful), hopefully that will stimulate some community input. – INV3NT3D Nov 4 '16 at 18:45
  • @INV3NT3D Thanks to you as well! I think the end result was pretty nice and it will surely be a useful dup target in the future. – Anders Nov 25 '16 at 20:26
1

I think this could be a good canonical question that could often be used as a duplicate target. But for it to be useful it needs to be on a level that the kind of person who usually post about this can understand.

That means there should be no assumptions in the question that the novice could not verify if they apply. So I don't think we should mention proxies and installed certificates or asume that the computer has not been tampered with - I would say that is stuff for an answer.

And I think the question should explicitly state that it is trying to be canonical and aimed at the broad audience.

So here is my attempt at a question:

Can my employer see what I do on the internet when I am connected to the company network?

Lets say I browse the web and use different apps while connected to the network at work. Can my employer (who controls the network) see what websites I visit, what emails I send, my IM messages, what Spotify songs I listen to, etc?

Does it matter if I use my own computer or one provided for me by my employer? Does it matter what programs I use, or what websites I visit?

This is an attempt at a canonical question following this discussion on Meta. The aim is to produce basic answers that can be understood by the general audience.

That is my two cents. Feel free to copy paste if you want to, edit if you feel like, or throw in the bin if you prefer that. I have some bullet points for what I would like an answer to contain, but maybe I should save them for an actual answer...

8
  • Fantastic. Way to trim the fat. I think as you've stated it is perfect. I like that it is OS agnostic, and simple to understand. Thank you Anders, I will be back on a computer in the morning and I will keep you updated. – INV3NT3D Nov 15 '16 at 23:02
  • Anders, I feel like the question is perfect the way you have it formulated, but would you like to post the question? Out of fairness, as you put it together the way it will eventually be posted, you should get the chance to post it first. If not I'd be happy to, but I won't budge until I hear back from you. Thanks again. – INV3NT3D Nov 16 '16 at 13:42
  • Nah, I'll let you post it. You did most of the work in pushing for it, so I think any rep coming from it is well deserved. – Anders Nov 16 '16 at 16:55
  • Very well! Thank you again Anders, I will be posting the question in the next half hour if you want to get your bullet points locked and loaded. – INV3NT3D Nov 16 '16 at 17:37
  • Soon I'll have to decide what the correct answer is. Should I make the decision sooner rather than later, and what criteria should I go by? The most votes isn't necessarily what I would choose, but, should I go with the community on this one and let the other answers supplement it, or pick one of the more, as I see it, informative answers? – INV3NT3D Nov 22 '16 at 13:22
  • @INV3NT3D Tricky question. I would say it is up to you as the OP to decide if you want to go with your own prefernces or with the communities voting. Just like with voting, there are no strict guidelines. – Anders Nov 22 '16 at 23:23
  • @INV3NT3D So the short story is: Whatever you do, it is perfectly fine. – Anders Nov 22 '16 at 23:25
  • 1
    Thanks Anders, going to go with the community. Although I may prefer an answer with more detail about what exactly is going on, the overwhelming majority have chosen what they believe is the most correct (which is absolutely correct in this case). Hopefully the rest of the answers can supplement the highest voted answer with more granularity. Thank you again for guiding me through the process Anders, really appreciate it. – INV3NT3D Nov 25 '16 at 16:16
1

I apologize if posting an answer to my own question is not preferred on Meta, but I couldn't have fit everything into a comment. TL;DR, check the block quote at the bottom of this post for the proposed question.

This is what I have come up with, and what I think the question should involve. Any and all input is appreciated.

The question should cover "Who can see my data over a network?" in a very general way, but will still need to address some specific concerns, these being:

  1. Is the "attacker" actively or passively listening in?
  2. What measures are in place already? Is there a proxy?
  3. What is the level of authority the "attacker" has on the network?
  4. What sort of device is being used? What version?
  5. What applications are being used?

Now, these questions are, generally, the reason why there are so many different variations of the "Who can see my data?" question on the network right now. In order to sharpen the question while still making it as general as possible, I believe the question should address these questions in the following way:

  1. The attacker should be actively looking for any information they can find
  2. The measures already in place should be of an unknown quantity, but we should assume there is no proxy, or the answer is pretty simple, but it should address what would happen if there was a proxy
  3. The attacker's level of authority should be that of a Sys Admin, someone with administrator privileges on the network but no sort of "illicit" access, i.e. they can't install a dedicated piece of malware on the target's machine or access their device without permission (if they brought in their own device, for example)
  4. As far as the device is concerned, any up-to-date device should be fair game for this question as we want it to cover a vast majority of the already existing questions
  5. The applications being used should fall into the category of either encrypted or not encrypted, finer granulation would make the question to broad

Now, how should the question be formulated? Here's my first swing:

Who can see my data when I am connected to an actively administered/monitored network, and what can they see?

Assuming that:

No one has had any illicit or physical access to my devices. My OSs' are all up to date. Some of my applications encrypt data, and others do not. There is a proxy, but I have not installed any certificates. There is very little other information about the network.

Any input is appreciated; please criticize, poke holes, call me names, etc...

3
  • 1
    Nice start. I have some comments, will elaborate later. – Anders Nov 8 '16 at 9:21
  • @Anders thanks. Would love to hear your thoughts. – INV3NT3D Nov 15 '16 at 20:59
  • Thanks for the reminder - I needed that. See my answer below. – Anders Nov 15 '16 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .