114

This might sound like a funny question from a twelve-year-old. The less funny part is that I am 21 and currently studying at university (I don't live at University, although I am 15 minutes away. I do not use university network). You might or mightn't believe me, but I have more than enough information to know surefire that both Mom and the university are spying on me from a distance.

I know this sounds really paranoid, but let's not discuss it and instead assume that what I say is true. I am wondering in what ways it could be possible, and how I could counter it. Some information about my situation:

  • Mom pays for the internet.

  • Mom lives about 500 miles away.

  • Mom comes every week-end, but cannot physically access my computer (I am always at home, I would know if she did)

  • Mom is incredibly computer-illiterate, but I believe she gets help from people at my uni, as I am sure some of them know more than they should about me.

My first thoughts were:

  • My ISP: she might be calling my (her ...) ISP for internet history. I don't know if it is common practice, but it is theoretically plausible. After all, they can monitor my internet traffic, and since mom pays for the internet, she has legal rights to access history.
    I don't really know if there is a way to counter it. Would using Tor work against it?

  • Wi-Fi and neighbors: she might have gotten the Wi-Fi key and sent it to neighbors, relaying information to her. However, I rarely, if ever, use Wi-Fi. I am directly connected by cable. It is on though, so I don't know if they can still access my computer.
    If that's the case, can I just disable Wi-Fi and just use cable internet? Is there another way to counter it?

  • (Unlikely, but still): a trojan has been installed on my computer. However, Kaspersky doesn't tell me that anything is wrong. So I can't do anything about it if I don't find it. That probably won't happen because it most likely doesn't exist, and if it does, it is definitely well-hidden.

Would Tor solve this problem? Is it all I need? I'd really like to find an alternative solution, since using it for a long time would make me become suspicious even to the eyes of people other than mom.

@Matthew Peters: By spying, I mean virtually everything I look up. I don't download much. For example, she might know what youtube videos I watch, or what Wikipedia article I read, basically anything, whether HTTPS or not.

Pierre.Vriens
  • 165
  • 1
  • 1
  • 11
Azerty
  • 1,273
  • 2
  • 9
  • 8
  • Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/38530/discussion-on-question-by-azerty-how-can-mom-monitor-my-internet-history-from-a). – Rory Alsop Apr 18 '16 at 12:55
  • 27
    You can employ the same strategy as teenagers discovering their parents read their diary: use a secondary computer outside of her spying, and use the first one only for things you don't care if she learns about. ;-) – gerrit Apr 18 '16 at 14:21
  • 16
    "Know more than they should" is often an indicator of good empathy or talent for interlining. I often know more than I should about friends and colleagues, simply by extrapolating and intersecting different pieces of information I obtain, or just by watching their behaviour, mimic and gesture. My brain also happens to filter out less information than other people's brains do; e.g. recently I was hiking, and while talking with a friend, I heared several woodpeckers. Later the friend was astounded when I was telling another friend about the woodpeckers, because he/she did not recognize them. – phresnel Apr 18 '16 at 14:30
  • Can she see when you boot from a Linux live USB.If she can't then there is spyware on your PC (which Kaspersky cannot detect because it is legal) – Suici Doga Apr 19 '16 at 06:10
  • You might call it a trojan but parents call such software "parental control" software which no antivirus will detect as a malware because technically they're not malware. – slebetman Apr 19 '16 at 07:20
  • 78
    Which PC did you use to post this question? I think you may have alerted her to your suspicions, so now she is going to use more covert ways to monitor you, watch out for hidden cameras... – Anton Banchev Apr 19 '16 at 09:37
  • 4
    What browser are you using? I believe Firefox and Chrome (and probably others) allow you to set up an account for your browser. This lets you access some things from your other devices. So, for example, you can have your opened tabs on your PC opened on your phone's browser. This may extend to browsing history among other things. – David Starkey Apr 19 '16 at 14:37
  • 1
    Have you tried using Tor for things that you don't want your mom finding out about? That will either be safe or give solid evidence that you've got some serious spyware infesting your PC. – aroth Apr 20 '16 at 12:53
  • 12
    What proof do you have that you're being spied on? – Mazura Apr 20 '16 at 23:22
  • 1
    Use a VPN. Wipe your OS and HDD (after getting your work data to a new external HDD of course, I would possibly also nuke that prior to putting my data there). Get an untouched OS where you have verified the SHA. Install OS without internet connection running. Use a well configured firewall. At the last step, when you have already set up the VPN, e.g. like [this](https://www.privateinternetaccess.com/forum/discussion/9093/pia-openvpn-client-encryption-patch/p2) feel free to connect to the internet again. This would possibly enable you to keep your history to yourself. – lowtechsun Apr 22 '16 at 12:30
  • Did you consider installing Linux on your laptop? – Basile Starynkevitch Apr 22 '16 at 15:53
  • 3
    I will second Mazura's comment. You need to say exactly what the phenomena are that indicate you are under surveillllance. You can't just say "people are spying on me, how?". There are books written on that subject. – Tyler Durden Apr 22 '16 at 20:56
  • time to delete all the porn history – D. Tunus Apr 22 '16 at 22:17
  • This might be something as simple as configuring your browser to share information across devices. You should have added the autism information as part of the question as this may imply that you may still need help and support even as an adult living by himself. – Thorbjørn Ravn Andersen Apr 24 '16 at 13:11
  • You don't happen to be logged in into your browser (e.g. Google account in Chrome) on your system and your mother's? Because that would sync your browser history to her device as well (as hers to yours). May sound stupid, but you never know – BlueCacti Apr 25 '16 at 12:32
  • I once met someone with severe paranoia who believed the same things. He was absolutely sure all people knew everything about him. After finding out I was working in telecommunications he kept pestering me about checking his phone, computer and internet for spy software. Later he accused me of installing spyware on his devices. Lucky for me he believed everyone was installing spyware on his devices so he didn't have too much time to harass me exclusively. I believe he is in a locked ward now. – ASA Apr 26 '16 at 08:17
  • 1
    Who is the ISP? Look them up and check what services they offer. –  Jun 18 '16 at 10:00

15 Answers15

192

Be careful about assuming too much. You say that you know "surefire" that your university is spying on you, but your only evidence is that your mom is computer illiterate and you're "sure some of them know more than they should" about you (WARNING - this is a red flag for those of us not in your situation, you do indeed sound extremely paranoid).

If you don't use the university network (which seems unusual when you're on campus with your computer, but I'll take it as given), then your university has no interest in your browsing history, full stop. If someone there in some way helped her get access to your activity, they could go to jail.

You wonder if your mom has conscripted your neighbors into her spying scheme (another red flag). Unless your neighbors are the absolute pinnacle of unscrupulous busybodies, they have no interest in your browsing history - they could also go to jail.

Very few people could legally help your mother to spy on you, and no one is interested in breaking the law to spy on you.

The ISP could theoretically provide her some of your browsing history:

  • If they offer some sort of network monitoring service for child safety, then they would provide her whatever they offered to provide her, but it's highly unlikely that such a service actually keeps records, and more likely that it is meant to just block content - if you're not being blocked, such a system wouldn't care what you're doing.
  • If you fall afoul of the DMCA by downloading copyrighted content and the copyright holder both discovers you and sends a notice to your ISP, that notice would be forwarded to your mother as the ISP account holder.

... ISPs are big, they have a lot of customers, and storing browsing history takes up a lot of space they for information they don't want to be legally liable for (e.g. if they record browsing history, they can be subpoena'd for it), so it's unlikely that they could provide this information to your mother.

That's assumption 1.

You then say that she knows what you browse whether you access it over HTTPS or not. This categorically rules out any sort of "from a distance" spying - once your request leaves your browser, no one knows what that request is until it reaches the server it's going to.

What this means practically is that if you use HTTPS URLs, someone (theoretically) could know that you went to YouTube, but they couldn't know what you watched. They could know you went to Wikipedia, but not which articles you read.

If someone is capable of breaking HTTPS encryption, that person has far more lucrative opportunities than helping mothers spy on their sons.

Even if you're mistaken and only HTTP URLs are affected, it still requires someone to basically perform an illegal wiretap to access that information because, as we've determined above, no one who has direct access to your browsing history is interested in keeping it or showing it to anyone.

Which leaves us with what is by far the most likely scenario: There are oodles and oodles of spyware programs out there that have varying degrees of legitimacy - as others have said, many are marketed as tools to give parents just this level of access. Your mother could have found such a tool by typing full sentences into Google easily enough, and they're probably one-click installers just for people like her. Have you confirmed that there is no hardware device like a keylogger installed on your machine? All of these methods get at your history the moment it's created, before it has a chance to be encrypted or go over the wire. They are also the most legally defensible ways for someone to view your browsing history.

A big honorable mention goes to the person in the other answer or comment that suggested that if you have a browser profile logged in on a computer that your mother has at her house, then she can view your ongoing internet history as if it were her own. Simplest fix would be to browse in in-cognito mode (or equivalent for your browser if not Chrome), it won't record your history.

As for what to do about all of this, I'm going to go the tough love route:

  1. Talk to your mother. Tell her to back off, or if she won't tell her she's welcome to view your history but it won't change what you look at. You're a big boy, act like it.
  2. Pay for your own ISP. As I've stated I don't believe this avenue is being exploited to see your information, but if she's paying for your service and using that as a justification to spy on you, then it's time to take the next step to separate yourself from reliance on her.
  3. Reformat your computer. If there's any concern that something is installed that you can't find, just backup your important documents, erase the thing and start over. Don't put a bandaid on a bullet hole by using ways to hide your traffic from spyware.
  4. This one I'm just throwing out there to see if it sticks, if it doesn't describe your scenario then sorry, I'm mostly keying in on the above mentioned red flags: if you're off your meds, get back on them.
Jason
  • 1,907
  • 2
  • 9
  • 15
  • 52
    I have a disability (autism) and thus am considered to be a potential danger to myself. I guess this reason could allow my mother and neighbours to spy on me legally, to make sure I don't get harassed or something... (Mom is a doctor, and the law in France might slightly differ from those from the US. The french are very (overly...) protective). – Azerty Apr 17 '16 at 19:03
  • 11
    Does your mother still retain her status as your legal guardian? Afaik there's no western jurisdiction that would allow or require a legal guardian for adults with autism as it doesn't impair their judgement even in severe cases (as opposed to e. g. schizophrenic or bipolar disorders). In all developed countries someone would need to convince a judge that your condition inherently impairs your decision-making process for her to retain guardianship. – David Foerster Apr 17 '16 at 19:18
  • 44
    @azerty that's actually helpful information and informs some of the things that otherwise come off as paranoia, both the autism and living in a different country from myself. In that case, my first suggestion is probably my best, have a frank discussion with her about growing up and boundaries. And be OK if she won't back off knowing that adults don't need to hide things from their parents – Jason Apr 17 '16 at 19:39
  • I'd say the simplest long-term fix for the browser profile one might just be to change your password, unless you don't want the other people with access to the profile to know it. – JAB Apr 17 '16 at 20:15
  • 1
    "This categorically rules out any sort of "from a distance" spying - once your request leaves your browser, no one knows what that request is until it reaches the server it's going to." -- except that the Mom (or her nominated agent) is an evil maid. So *if* she does display knowledge of specific pages visited via https, then personally I would check for "security" products that install their own root certificate and intercept https traffic before investigating the possibility that I was hallucinating conversations with her. IIRC Kaspersky has this option, no super-spy ability required. – Steve Jessop Apr 18 '16 at 12:35
  • 2
    (I say evil maid -- the questioner says she no longer has physical access to the machine, so I suppose strictly speaking she is not. However, I don't think we can rule out from what the questioner says that she's had access in the past, enough to set up parental monitoring that she's now using). – Steve Jessop Apr 18 '16 at 12:44
  • @SteveJessop Perhaps my language wasn't as precise as it should have been - by "from a distance" I meant spying that did not involve *any* direct access or modification of the computer, what you're describing is sort of a gray area since it's not "spyware" per-se that *captures* activity before it leaves the computer but *does* require access to the computer and performs the first stage of its nefarious actions prior to data leaving the computer. – Jason Apr 18 '16 at 14:30
  • 2
    "Simplest fix would be to browse in in-cognito mode (or equivalent for your browser if not Chrome), it won't record your history." Or create a new, separate browser account. – jpmc26 Apr 19 '16 at 04:46
87

This sounds like it would mostly likely be some kind of Internet monitoring software (a.k.a legal spyware) installed on your computer when you set it up. Some ISPs provide this kind of service either network blocking or device monitoring (e..g this article from the UK).

From the statement that they can view HTTPS connections, we can rule out just standard traffic sniffing as they wouldn't be able to intercept the content of HTTPS connections without having installed a root certificate on your computer.

So a first question would be, did you install any software on your computer when you setup the connection? Can you uninstall it (bearing in mind that it may cause your access to be blocked, depending on how the system is configured)

Assuming that as part of your connection you got a WiFi network, you could try with another device (e.g. cheap tablet, phone) and see whether a) it works and b) your mother is aware of surfing that goes on there. For example you could go watch this classic a couple of hundred times on that device and see if she mentions it.

If you don't have access to another device a second option would be to boot your computer into an alternate operating system off a USB key. that's a pretty cheap approach, and should avoid most spyware software. something like xubuntu should be light enough to run reasonably from USB.

Rory McCune
  • 60,923
  • 14
  • 136
  • 217
  • 20
    It could also be a report supplied by the host. Sky in my country will provide a breakdown of sites visited of the child lock software is active. – Terry Apr 17 '16 at 10:51
  • Even if the monitoring software lead is tempting, I am still doubtful about it, because I don't remember having installed anything that could contain such a software, and knowing my mom's skills in terms of computer (using ie, typing whole sentences in google, not being able to copy and paste even after repeatedly having taught her...), it seems unlikely. Maybe she called someone to come home while I was studying at uni to install the so-called software, but this seems far-fetched... Plus, wouldn't Kaspersky tell me about it ? Or wouldn't it be at least in its exclusion list?(it isn't) – Azerty Apr 17 '16 at 14:50
  • 11
    Without software installed on your machine (or someone manually installing a certificate on your machine), there's no way to intercept HTTPS connections (unless of course your ISP can break HTTPS, which is doubtful). Kaspersky would likely not tell you about it if it's "legitimate parental control" software, as that's not strictly malware. – Rory McCune Apr 17 '16 at 15:01
  • 43
    Actually, *Kaspersky itself* includes parental monitoring software (at least, the version I had at one time). Did you buy and install Kaspersky yourself, or is it tied to your Mom's account? – Ben Apr 18 '16 at 03:44
  • 1
    Well from what I remember, you could monitor Internet (and application) use, even getting daily or weekly reports, without turning on any limitations, timeouts, or controls. All you needed was the Kaspersky admin password. – Ben Apr 18 '16 at 12:07
  • 2
    The HTTPS comment depends in what is known about the connection. If the mom only knows which sites are visited that could be intersepted without breaking the encryption. – Taemyr Apr 18 '16 at 23:17
  • 67
    Welp, I can cross getting rickrolled on stack exchange off my bucket list. – shmosel Apr 19 '16 at 06:51
  • 1
    @Ben it still does support it. – ave Apr 19 '16 at 20:49
  • 3
    It might be worth noting that Kaspersky, by default, installs its own root CA on your system to scan HTTPS traffic, effectively performing its own MITM. You can turn this off (I always do). – Seth Apr 20 '16 at 17:06
  • My bets are on the ISP monitoring tool. The tool might just track a list of URLs requested without actually intercepting the real traffic. Visiting HTTPS or not in this case doesn't really matter. You might figure out how to circumvent this, probably try to change DNS to google instead of using your ISP's ones but I won't rely too much on that solution. Funny thing is, if she sees this page on the list probably she knows that you know and probably she will eventually stop. – MacK Apr 21 '16 at 14:45
  • Good old Rick Astley [never disappoints](http://i.stack.imgur.com/fcWwV.png). – E.P. Apr 23 '16 at 12:08
  • 2
    @MacK You can't "track a list of URLs" without exploiting one end of the connection or breaking the encryption. DNS only receives the domain name (eg. `youtube.com` without the video ID) and the set-up for the HTTPS connection only exposes the IP address (which can only be used to derive a domain name if it's not using something like CloudFlare or vhost-based hosting to serve multiple domains through that IP). – ssokolow Apr 24 '16 at 15:42
  • In reply to the OP about the answer: Just to add, Lubuntu would probably be faster than Xubuntu to run off a LiveUSB as the "L" does stand for "Lightweight" and that is its purpose. –  Aug 18 '16 at 15:24
  • 1
    The "L" in lubuntu doesn't stand for lightweight, "The name Lubuntu is a portmanteau of LXDE and Ubuntu" (from the wikipedia article on lubuntu). Both xubuntu and lubuntu are relatively lightweight derivitives of ubuntu. Heck if performance is the absolute key, I'd recommend something like alpine, which is likely smaller than either. – Rory McCune Aug 19 '16 at 17:15
87

One possibility that I came across by accident:

Google (and possibly other search engines), keep track of what you search for, if you are logged in.

Anyone with (access to) your login name and password can access your search history. This includes any computer you logged in to Google on (e.g. if you accessed your Gmail from your mother's computer). I do computer support for my parents, and left myself logged in to Gmail - and suddenly started getting other things in my search history (thankfully, it was about cycling tours, not anything I'd need therapy for ;)

If you think this may be the case, go to Gmail, log in, go to the bottom of the page, and look for "last account activity in...." click on the link and "sign out of all other web sessions". Change your password.

AMADANON Inc.
  • 1,481
  • 9
  • 9
  • 23
    This was the first thing I concluded as well. OP only knows that his mom has knowledge of his browsing history, which would pop up automatically on the home computer if he logged into his gmail while using Chrome before heading off to school. Occams razor dictates that the simplest answer (and this is brutally simple compared to all the other conspiracy theories) is the most likely. – Jeff Meden Apr 18 '16 at 13:40
  • 2
    Yes, this was also my first thought. No need for tracking software when Google already tracks it and stores in your account. Change your google password and security questions and see if it stops. No need for any tech savvy when Google does all the work for you. This could be as simple as you've logged in to your Google account on your mom's computer at some point and it stayed logged in. Really, this seems most likely to be the correct answer. – reirab Apr 18 '16 at 18:56
  • 1
    I would add "change your Google settings to not log searches" as well, after the "change your password" step. – Andrea Lazzarotto Apr 18 '16 at 21:15
  • 1
    This is the answer I came to give. Youtube videos, and wikipedia? Sounds like the google account! Clear your sessions, change password, log out. – CQM Apr 18 '16 at 22:04
  • Wikipedia is not, of course, a Google property, so won't show up unless you search Google for it. Youtube is, so YouTube videos will be revealed, even if you search for it somewhere else (or on YouTube). – AMADANON Inc. Apr 18 '16 at 22:18
  • 8
    If you use Chrome as your browser and it is signed into your account for Sync, Anybody else who is also logged into Chrome with the same account will have the whole browsing history, not just searches. – Boluc Papuccuoglu Apr 19 '16 at 06:52
  • Now you mention it, my kids use my computers when they are home, and never delete their browsing history. I only find this amusing. It really messes up the google automatic ad tailoring. I assume if they want to browse something and not let me be aware of it they will do this from another machine. – RedSonja Apr 19 '16 at 13:13
  • 1
    @BolucPapuccuoglu has hit the nail on the head- Chrome can track ALL browsing activity (minus that done while Incognito). It's possible your mother has used a session you've left logged in elsewhere or somehow has worked out your credentials. Do try closing all sessions and changing your google credentials if you use Chrome. – Danikov Apr 19 '16 at 13:39
  • If you're using Chrome, can you install a different browser such as FireFox or Opera and use that? – SQB Apr 19 '16 at 16:23
  • this seems like the most likely situation to me. – JBCP Apr 19 '16 at 23:28
  • Upvoting this not only for being extremely plausible in this situation - but for being an important piece of knowledge. I $#!t a brick when I first realised this. **Uncle Google is always watching.** Sure, it's in the fine print, yadda-yadda, but if you're like me, it's not something you expect. – underscore_d Apr 22 '16 at 18:42
  • ...and OP, everyone, should use two factor authentication. – Paulb Apr 24 '16 at 13:12
  • IIRC you can close other sessions from the Google account settings page. So close all sessions, change your credentials (add 2-factor authentication), check for open sessions again (and close if any). – BlueCacti Apr 25 '16 at 12:35
  • Chrome has settings to disable syncing of search history, doesn't it? Where would that show up? – mbomb007 Apr 08 '19 at 15:09
26

Sorry if I'm stating the obvious, but:

  • Why don't you ask your mother how she's doing it?
  • Or someone at the uni, if your mom is not cooperative?
  • Or, if you receive support from a social worker, ask him/her?
  • Or, if all the above fails, a sufficiently trusted computer-literate friend who can gain access to your computer (if the monitoring is device-based) or network (if network-based).

This is a very specific question which only someone with first-hand knowledge of the situation can answer reliably. Asking "how can X remotely monitor my internet history" is not the same as asking "how can a person remotely monitor someone else's internet history", which anyone could discuss.

By the way, you may be aware that interception of your electronic communications may only be carried out by a public authority and only under the cases specifically contemplated by the law (Loi n° 91-646 du 10 juillet). So if you are quite sure that you are being monitored, better clear that up with all the parties concerned before they dig themselves in too deep a hole.

Qwerty
  • 261
  • 2
  • 2
  • 3
    +1 for specifically addressing OP's situation and the legal situation in their country. – Jason Apr 20 '16 at 18:50
  • She does pay for his ISP - does that affect the legalities? – Tim Apr 25 '16 at 10:16
  • @Tim If the ISP isn't allowed to monitor your browsing history, it cannot give that information to his mom as they wouldn't have it. ISPs often block certain sites (e.g. piracy, child pornography, etc.) and might get an alert if someone visits those sites, but they can't/won't keep a history of your browsing habits. – BlueCacti Apr 25 '16 at 12:38
10

Was your computer supplied by the university, or using a university OS image, or custom network access software? You mentioned you're not using the university network, however if you have their network monitoring software installed, then they still could see your history.

It's unlikely to be your ISP. They don't typically have the resources, or inclination to monitor your network traffic.

Do you by any chance use a Chrome profile on your computer that you've also used on your mum's computer? If so, could you have left it signed in? Is it possible your mum might have guessed your Google password?

I'm curious about how you're certain you're mum can check your history? If she said something like "I know you've been accessing porn", then she's just having an educated guess ;-)

If you have any concerns about the security of your wifi, then change the passphrase and ssid.

user1751825
  • 905
  • 4
  • 10
  • 6
    Not sure about the "not your ISP" piece. Some ISPs sell add-on "parental safety" software which is monitoring stuff by any other name – Rory McCune Apr 17 '16 at 09:25
  • 1
    Windows has parental controls/reporting built right in if you've configured it see https://account.microsoft.com/family# – James Snell Apr 17 '16 at 16:09
  • 1
    @JamesSnell That's a good point. If the OP's computer was provided by his mum, then this may be a possibility. – user1751825 Apr 18 '16 at 00:32
  • 1
    @RоryMcCune Thanks for that. I wasn't aware that ISP's provided such services. Are they just re-selling standard computer based monitoring software, or do they provide it as an actual upstream monitoring service? – user1751825 Apr 18 '16 at 00:33
9

First thought that came into my mind is shared browser user, maybe you have used computer at home with your account, and then did not sign out? For example, if you use Chrome, all your browser history is being synced between all of your devices, including your moms computer.

You could use a different browser, and some kind of VPN to ensure that your traffic is not seen for ISP.

Valdas
  • 200
  • 4
5

You could use Tor, or maybe simply a VPN, for no more time than necessary to find out if she still knows what you've been browsing. If positive, you have determined that your computer is compromised. Now:

  • Make sure there are no weird pieces attached to it (there are hardware keyloggers).
  • Format your hard drive and do a clean install of the operating system and your usual software.
  • Don't ever let anyone have unrestricted, unsupervised (yes, it's unsupervised if you're drunk - just saying) access to your computer/user account/administrative privileges. Since you say your mom is computer-illiterate, and she doesn't have access to your PC, it's possible that someone you trust (a close friend to you, anyone really) is helping her. (¹)
  • You may also consider using Full Disk Encryption, like BitLocker on Windows or Truecrypt (cross-platform) or any other.

But, before you do that...

If you feel brave enough, go to a lan-house or someone else's computer, download a HIPS/firewall combo to a flash drive and learn how to use it; then install it on your computer, set it's alert level to maximum and watch out for anything suspicious, like direct access to key strokes.
Don't trust Kaspersky (or any Antivirus suite, for that matter) on detecting unknown or custom-made invasions, since they are usually ineffective on this case. Anyone who knows how to use a C compiler can grab some source code from the internet which will result in a "undetectable" keylogger (to antivirus, that is).


(1) I know what it's like to have paranoid / overprotective guardians. Also I've been in a situation in which I could be this guy who betrays someone else's trust in order to bring "peace of mind" to his mother. So my final comments on this issue are: If you actually find out who is helping her get unauthorized access to your stuff, they can face time in prison. In most places I know it's also illegal even if it's your mother who's doing it, and you could sue her, even if she pays for your internet bill, but that's another story altogether.
Finally, assuming you can actually provide compelling evidence you're being eavesdropped, you may get help from the autorithies. This is very serious.

Marc.2377
  • 594
  • 3
  • 10
5

Others have mentioned shared profiles, known passwords, and google history, and the ways to resolve those.

But even more likely is: what do you get if you google your name, plus the word "youtube"? Do you get the videos she mentioned, because those are the ones you have commented on using your account?

That is to say - perhaps she is not spying on you, just stalking you?

Dewi Morgan
  • 1,340
  • 7
  • 14
5

She pays for your internet. Many providers offer plans "for kids" with parental control, including full reports of visited resources. Using those is the easiest and most obvious option for computer-illiterate person.

Changing PC or other hardware won't help of course as long as you use same internet access. If your PC is free of non-standard security certificates, any tunnel (e.g. VPN, Tor) leading outside of boundaries of your ISP's network will work.

If you don't care that she will know hosts that you visit and only want to keep final paths hidden, just making sure that you use HTTPS everywhere would be enough too.

Oleg V. Volkov
  • 799
  • 5
  • 11
  • Short and sweet, answering the part of the question that isn't too broad, and no speculation put forth: plus one. – Mazura Apr 20 '16 at 23:36
4

I say that you haven't given us enough information to identify how this is done. Your mother's lack of technical literacy may not matter much as long as she knows somebody (or knows somebody who knows somebody) who was willing to lend a hand getting a solution installed.

Perhaps, also, it's not your mother who is spying on you, but someone else (with more proximity) is closely spying on you, and is providing your mother with some summarized details. This idea is highly based on speculation, so I'm just throwing it out as a possibility to consider. Now, on with some more technical focus...

Most of the other answers seem to focus on the idea that network traffic is being monitored. That is one possibility. You could make changes on your computer, or even replace your entire computer, and the situation could continue.

There are other possibilities. Your keystrokes may be logged. (In that case, she may also have passwords.) With some "remote administration" software, a person may be able to see files on your hard drive, which could include a list of recently visited sites and/or cached files. In that case, you could even change Internet providers, and the situation could continue.

Without knowing more specific details about the situation, there is little possibility for us to provide confidence in a very specific fix. Even if you can find a piece of spying software on your computer, successfully removing that software might only remove part of a multi-component problem, so you may continue to be violated or at risk of easy re-implementation (if they can re-install the software at will, possibly more hidden the next time).

There are some general steps that you may be able to take. These might be like using a bazooka to kill a fly (overkill), or might actually be exactly what you need.

Your first step is to back up any data that you care about, because much of the rest of the process may be prone to erase lots of data.

Get into a trusted situation. That means taking care of the computer you use. That means using trusted hardware (mostly people trust hardware that they buy off the shelf; though there are some reports of such hardware being compromised, there may be no reasonable safer way to do it), and making sure your operating system disc is trusted. (Mainly, that means using either a commercial disc, or a disc that you wrote to using an image that you downloaded from a trusted site.)

Using network-privacy technologies like a VPN or Tor may help. However, you may need to set up passwords/etc. Don't bother doing that until you are on trusted hardware. Then, make sure that any new passwords (to a remote server) are communicated using encrypted protocols (e.g., HTTPS rather than HTTP).

TOOGAM
  • 372
  • 1
  • 5
3

If you want to be sure that you are safe, reinstall your operating system from a clean (stock) image. Then turn on 2-factor authetication for all possible services (Google, Facebook) and change all passwords (including your mailbox password).

Against network traffic spying you have to use VPN connection - it encrypts traffic from your computer to the VPN provider. For example Avast SecureLine.

Xdg
  • 131
  • 2
  • 2
    Or you could use [Tor](https://www.torproject.org/), which isn't tied to any corporate group and seems to be the standard on this website. – wizzwizz4 Apr 18 '16 at 15:53
  • 1
    Yes, it's true. But Tor is usually slower and more complicated to establish connection. – Xdg Apr 18 '16 at 16:02
0

The key here is your university. More than likely, the university intercepts all traffic on it's network and applies filtering (as well as logging). Thus your mother simply gets that info from them.

I would suggest using a VPN for your connection. Tor maybe over kill and isnt even the best solution for this case.

Note that in some cases the school may not allow VPN connections so you may need to do some fancier stuff or simply use a different network altogether.

Matthew Peters
  • 3,592
  • 4
  • 21
  • 39
  • 5
    OP said he didn't use the university network so not likely them... – Rory McCune Apr 17 '16 at 09:12
  • 3
    Oh that's embarrassing... I'm not sure how I misread that. #friendsDontLetFriendsDrinkAndAnswer – Matthew Peters Apr 17 '16 at 13:55
  • 4
    @MatthewPeters You did not misread - it is my fault and didn't realise the "studying at uni" could have been misleading, so I edited it after you posted your answer. Sorry about that ! – Azerty Apr 17 '16 at 14:43
  • This is both not his case and also wrong since he said it also happens with HTTPS. – Keavon Apr 18 '16 at 04:43
  • @Keavon I have heard of situations where educational institutions require you to install their CA - http://security.stackexchange.com/questions/104576/my-college-is-forcing-me-to-install-their-ssl-certificate-how-to-protect-my-pri – Sebi Nov 18 '16 at 17:54
0

I would almost disagree with Matthew. Not saying its impossible but to release that information would require more than just "Being a parent". We are talking about Warrants and Subpoenas to obtain that information given that she does not lease the Line for the university and you are older than 18.

My guess is something similar to a Trojan. She installed a software similar to K9 web protection, http://www1.k9webprotection.com/ , on your computer and thus can view the logged traffic. If added to the trusted applications on Kaspersky it would not view this as malicious.

I would be willing to bet performing a clean wipe and install of your computer might help solve this issue.

That being said, that seems like an overly bearing Mother, and you are well old enough to be considered an adult. This is a crime, regardless of relationship. I would ask your mom to cease and desist this action immediately, as a scare tactic. I realize you would not report your mom. Still the option is there.

Jeff Meigs
  • 277
  • 1
  • 8
  • 2
    heh, ISPs in some countries can and do monitor/block connections legally, it's in the T&Cs, no warrant required. – Rory McCune Apr 17 '16 at 09:27
  • 3
    I agree with @RоryMcCune. Some universities require you to sign a contracts if you choose to use their internet or bring their computer on campus. Very strict universities like Bob Jones requires you to even install remote desktop software. All of which is legal because the student willingly opts in these terms and conditions to use their internet services. – Bacon Brad Apr 17 '16 at 15:22
0

Given the current information there are a lot of possibilities how this could happen. Try to eliminate a few.

Do you have a mobile device with a separate data plan that is not paid by your mom? If not you can get cheap prepaid ones for like 10$.

If you have a mobile data plan do all your surfing on your computer for some time over this mobile plan by setting up a mobile hotspot through your mobile device. If you mom still knows what sites you are surfing it might be a software on your computer.

If she doesn't know what sites you are surfing after this experiment it might be the ISP or the router.

Lukei
  • 101
  • 1
0

It is taken as given that your mother is spying on you, and somebody might be helping. I will also take as a given that you don't want just the data you send to a site and what specific pages on that site you visit to be private. Please take note that what your mother and her helpers are doing is illegal and if you have proof, you should tell them (your mother and who ever else) to cease and desist. If that isn't an option for some reason here are some suggestions.

  1. Use a VPN. VPN's allow you to access some other LAN (Local Area Network, think everything connected to your router), that you aren't physically connected to. If you have ever used a gaming service like Himachi you have used a VPN. There are various browser addons that you can use to hep make this process easier. Please note that this will be slower than a plain Internet connection and will cost money (generally about $10 a month, but varies quite a lot). Your VPN provider can also log what you do, so make sure you pick one with a good reputation that promises as much privacy as possible.
  2. Use tor. Tor works like this, say you have a letter you want to send privately, the way tor would do this is by putting a letter inside of a letter inside of a letter and so on. You would then send the letter to the first person, they would open it, and then send the letter inside to the address on it. Every layer of this is encrypted over each other, so the only thing known by each node that forwards your letter is where it came from and where the next step is. If the data you're trying to send isn't encrypted (not https), the last step on the network (the exit node) can read what you're doing. Tor is free, but is also slow. This would be a great solution while you're doing things you want private, but might be inconvenient if you're doing something that requires a lot of bandwidth. https://www.torproject.org
  3. Use Tails. Tails is a live usb drive that allows you to boot into another operating system with out affecting your computer. Tails uses tor and therefore has all the flaws it has, but the advantage is that if you suspect there is any kind of monitoring software on your computer tails would go completely around it (Keep in mind if there is a hardware keylogger or a bios infection tails won't go around that). This would probably have to be used while doing things that you want private, and would be inconvenient as a general purpose OS, but if you want to use it all the time, go for it. Tails also has a feature to store files in a secure, encrypted manner called "encrypted persistence." https://tails.boum.org

Some notes on these: depending upon where you live, using any of these might arouse suspicions by your ISP and government. Always remember to use your best judgment when it comes to this kind of stuff as if you live in certain places you can be arrested.

Mitchell
  • 159
  • 4
  • 1
    These suggestions don't really address the questions of how this might have been done, and Tor and VPNs have been suggested by most of the other answers. – schroeder Nov 18 '16 at 07:59