Is it safe to check personal accounts on work computer?

Question

Sometimes I check things like my personal emails and do financial transactions like pay bills on my work computer. I came across an article recently that said your work monitors every little thing you do on the computer so it's best not to do personal things on there. But I would think that it's safe as long as you safely log out of your accounts and clear history?

And even if your employer can see your activity on the computer, I would assume they have no way of seeing your online passwords and accounts? Can they?

Is it ok to do such things on a work computer like pay bills and so on? Is there risk involved?

Answer 1

It's safest to assume your employer can see everything. Now if the sites you visit are all property secured your employer probably won't be eavesdropping passwords,¹ but that data could still be in your browser. This site isn't the place for a technical analysis; instead let's focus on the human element. Have you ever forgotten to clear a session? Have you ever let your browser remember an "unimportant" password? Even the most careful humans goof sometimes, and when they do, anybody with access to the machine can use your stored credentials.

All that said, your IT department probably doesn't care. You probably face a bigger risk from other users of your computer -- you're probably not perfect at locking when you step away, right? Or you might allow a coworker to debug something in your environment. Or you might get a new machine and hand the old one off to an intern without reimaging.

The chance of having your private data compromised is very small in most workplaces, but it is not zero. If checking your bank balance from work is that important, you might decide it's fine. On the other hand, you could wait until you get home, or use your phone.

Finally, you should assume that your non-private browsing activity is all logged -- URLs, timestamps, and maybe other stuff. IT departments do look at this information sometimes -- usually in the aggregate, but if they see something interesting they might drill down.

¹ There are things they could do to eavesdrop on secure connections, but it would be an intentional move. The tools normally used by a non-evil corporate IT department are unlikely to compromise your passwords for secure sites. But nothing is ever guaranteed.

Answer 2

A)
Is it OK to do? Yes, generally.

B)
Is it advisable to do? No, if avoidable don't do it.

C)
Are there risks? Yes.

A)
You can use your work computer and internet access if there are no policies or contract paragraphs prohibiting it.

C)
Legally employers are allowed to monitor their computers and network/internet access.
This includes keyloggers, screencapture and other soft- or hardware mechanisms.

The risk is that you don't know who exactly has access to those logs and with them your private information.
They could be stolen or sold by a disgruntled or criminal employee or used against you in some form.

B)
Most of the time there won't be an issue.
However, it is generally prudent to avoid using third party equipment or internet access for private, sensitive activities.

Answer 3

If the company controls what security certificates the web browser accepts, then they can intercept and decode any HTTPS-encoded traffic to any web site. The only additional thing they need to do is install a proxy server between your desktop computer and the internet - and most companies have that anyway.

The attack is essentially:

• Company configures all their computers to accept a company-issued top-level security certificate.
• When you connect to your bank's secure web site, it will go though the proxy server.
• The proxy server traps the request for a security certificate. It sends on the request to the bank, and the bank sends back a valid certificate. The proxy server keeps that certificate.
• The proxy server makes up a new certificate, in the name of the bank, but authorized using the company's own top-level certificate.
• Your browser accepts that, because it thinks the certificate is genuine.

Now when you type in your banking password, the proxy server can decrypt it, because it set up the secure connection to the browser, not the bank. The proxy server can then re-encrypt the password and send it on to the bank.

The proxy server can also decrypt the data coming back from the bank, because it set up the connection to the bank, not your browser. Again, having snooped on the data, it re-encrypts it and sends it on to your browser.

If it's all done correctly, neither you nor the bank sees anything wrong.

Answer 4

While different companies have different policies on Internet usage, and different IT departments do different levels of monitoring, I think it's safe to assume that yes, they could potentially see everything you're doing.

I would have thought that HTTPS traffic could not be read, but according to @SimonB it's possible that they could even then.

Logging out of your account and clearing history will make no difference. It's unlikely they check your activity by looking at your browser history, or by checking to see where you're logged in. What they probably do is monitor the network traffic as it passes through their network servers, so they'll know where you've been even if they never even see your physical computer.

Answer 5

I'm not an expert on cyber security, but I would think a company could, in principle, track anything that is being done on a computer that they own.

On my corporate laptop, I have to go through an internet proxy, so for sure they have a record of every website I have navigated to. If they wanted to, I'm sure they could monitor anything I type into a text field on a web page on that machine (including usernames/passwords). So, there could potentially be a risk.

But, having said that, I would think most companies have better things to be doing and would not want the level of risk associated with pilfering cash from their employees' bank accounts or selling their personal data. A particularly unscrupulous company could do it, in theory, but the chances are probably quite low.

Edit:

Chances are probably higher that a rogue individual working in IT might do something nefarious, so there is a level of risk. I admit that I check bank accounts on my machine though, so I'm not too bothered about it.

Answer 6

To explain a somewhat funny/amusing story, a long time ago I was working in my college and a professor was explaining how he encrypts all his homework answers on this shared unix system using some pretty fancy encryption methods at the time. He said no one could crack the password in a hundred thousand years using all of the university's servers and certainly not the current semester. That night I emailed him the entire semester's solution and he was livid. How did I crack it, he would ask. Simple, I looked back in his command history and saw he entered a password in the command line tool, a very well made password with numbers, etc but it meant nothing when I knew it.

Point is, there's no way to know what level of security the system has. You type in sensitive material, it might be viewed by anyone, even in some cases your coworkers. Your work station most likely has connections to proxy servers, and key loggers installed. All easy stuff to monitor and view on the end of a system admin or just a curious coworker. You should assume everything you do in a public space is viewable by the public at large. All the security in the world means nothing when it is filtered through a controlled system.