How safe is using personal Gmail and Google Account at work?

Question

Two closely related questions:

1) My boss said it's ok for us to go on our personal email during our breaks. If I do this, can the company steal any information beyond what is viewable on the screen? Does this mean as long as I don't send or view any private/confidential emails this should be ok? Since Gmail uses an encrypted connection, does this mean someone monitoring the network can get my password?

2) The computers at work reset all the settings on each log out. I found it hugely beneficial to login to Chrome with my Gmail Account. This is so tabs, bookmarks and history are saved. What security precautions should I follow considering someone else could potentially use the same computer (though not logged into my Window's account)? Should I log out of Chrome after each use or should I change some settings to not sync specific things?

I have 2 factor authentication enabled.

Answer 1

You can monitor anything in a network you control. So that means private webmail can be monitored by your employer.

Legally (us) they are allowed to do so when using company equipment or resources.

Monitoring is usually done on traffic, so all info on every page you load is susceptible to interception. This does require specific software and quite a lot of time, so is only done by larger companies, or in case where a specific employee is suspect.

So Stay on the safe side and don't use private mail if you have a reason to believe your employer is interested in you in ways you don't like. Use your phone (not via WiFi).

Answer 2

Always assume your traffic is being monitored if:

• You don't own the computer/device you are using;
• You are not the administrator of the network you're connected to.

Answer 1: Usually you should assume that everything you do at your workplace is being monitored. Maybe it's not really happening, but let's assume the worst.
It's not that hard to read unencrypted traffic on every network. If you don't own neither your machine nor the network you're connected to, your employer could be effectively reading even the HTTPS encrypted traffic.
It's easy for a network administrator that has access to your machine/account (does he?) to setup a "fake" certificate on it and perform a MITM (Man-in-the-Middle) attack. This means that, for example, when you visit gmail.com and you type in your password, this will be sent to your network administrator first, and then he will send it to gmail.com. So every web page or data sent/received through the the page can effectively be stolen.

Just to clarify:

Since Gmail uses an encrypted connection, does this mean someone monitoring the network can get my password?

The encrypted connection is not related to your password! The encryption when you visit a web page (or you send data through it) is managed via certificates. Your password "only" protects the access to your account.

Answer 2: Given the answer to question 1 and the fact that the computer resets after each logout, I think that, assuming all info get destroyed on logout, you don't have to do something else. Just in case, check your User folder to see if some Chrome files don't get deleted on logout. The path should be something like C:\Users\YOUR_NAME\AppData\Local\Google\Chrome\User Data

Answer 3

The biggest concern here is that you are likely using a work-issued computer, whose software was installed by your IT department. Since they are able to install anything they want on your work-issued computer, they can install what amounts to spyware on it. If you cannot trust your work-issued computer to be secure, then you cannot rely on any of its security features to guard you against your employer.

For example:

Since Gmail uses an encrypted connection, does this mean someone monitoring the network can get my password?

That is only true if you can trust your work computer. If you have an adversary that can modify your computer's configuration—like your employer can—they can intercept your encrypted GMail traffic. There are in fact commercial products that are designed to allow businesses to inspect their employees' encrypted connections. Most of these work by using a combination of two components:

1. Install a transparent proxy on the company's outbound network connections, that intercepts all outbound traffic and acts like a "man in the middle" for all connections.
2. Configuring the employees' work computers to trust the proxy unconditionally for all encrypted connections (by installing what's called a root certificate). This means that the employee's computer will allow the proxy to impersonate the remote site.

Similar techniques are also used by some adware vendors, most notably the infamous Superfish adware that Lenovo preinstalled on its laptops some years back.

So before you get to questions about whether to log out of Chrome and such, you have to decide whether to trust your employer's computer in the first place. Frankly, with the spread of smartphones in the past decade, I just don't bother anymore—I just read my personal mail on my personal phone.

Answer 4

1) Yes, the company could be monitoring everything you type / view / send on a company based computer. Importantly, it may be done by the company to protect themselves, not to harm you --

My company uses firewalls that "Man-In-The-Middle" all inbound / outbound connections - meaning that the firewall decrypts all encrypted traffic, inspects it, then re-encrypts it so it still looks encrypted to the end-user. We don't do this because we Infosec folks are evil, but because we want to know if people are sending out secure documents over webmail, or accidentally downloading viruses or other malware. We also block access to lots of sites and domains (including advertisements) to reduce the number of infections we get on user systems.

If you're looking at sensitive things you don't want your employer to know about (personal, healthcare, employment, etc), use a phone or tablet and your cellular data plan to keep it secure.

2) If the computer is set up to wipe out settings between every use, you should be relatively safe in using the computer to login, use your bookmarks, and then have everything cleaned up at logout -- but a malicious administrator could be collecting your info while the system claims to be cleaning up, or someone could attach a hardware 'keylogger' that would collect key strokes from the computer.

You should add "Google 2 Factor Authentication" to your gmail account. This simply means when you log in, you give your password, and a PIN code that is sent to your phone at login time. It makes breaking into your account much harder, even if someone has grabbed your password, because the need the code generated on your phone to login.