Can an employer see what I'm doing on my iPhone whilst logged onto wifi

Question

I log on to my works wifi throughout the the day whilst at work, I use apps like WhatsApp and iMessages to communicate when I need to, can my employer see the content of those messages (actually read what I'm sending and receiving) or can they just see that I have been logged into WhatsApp and iMessages over the wifi signal?

Answer 1

According to Whatsapp, all message traffic between the server and your phone are encrypted. The same applies for iMessage. The initial contact for iMessage is initiated via normal SMS, and does not travel through the wifi network.

Therefore, it will not be possible (barring homebrew crypto security flaws) for your employer to read messages that pass through its wifi network, he will only be able to see that you are using those applications.

Answer 2

You could try using a proxy or vpn somewhere to tunnel your traffic through a secure pipe before 'going out to the web'. Many newer routers have vpn built in so you could set something up at home... that way the traffic between your device -> work wifi -> home would be encrypted, then from home -> web would be the only 'open' traffic.

Answer 3

If a site is not using SSL, then assume anyone, from you to the destination, can read your messages. If the site uses SSL, then you may or may not be safe.

If your employer is using a content filtering proxy, such as BlueCoat or Websense, then they may use an SSL certificate to decrypt and read your messages. This is often done to ensure that confidential company data remains confidential.

Content filtering proxies are internal company devices and as such, do not require certificates from official certificate authorities (CA). As such, these types of certificates are issued by a local certificate authority created by the company. If your phone was issued by the company, they may have installed the certificate on the phone. If it is your personal phone, you would be have been prompted to accept the certificate before being allowed to continue browsing.

You can verify in your settings on an iphone or android for any user installed certificates.

IPhone: Settings->General->Profiles

Android: Settings->Security->Trusted Credentials

A good rule of thumb is to perform incriminating activities outside a company network.

Answer 4

As a network admin I can tell you that it is VERY easy to see what you're doing. Programs like Wireshark now make it incredibly easy to sort through all the traffic based on source or destination. I could plug my laptop into a mirroring port on one of the routers and collect every packet you send. I've had to do this before to help diagnose what was flooding our network with bad traffic.

As other posters have noted, a lot of the content may be encrypted. I might not be able to see the actual text of your messages. I CAN, however, see how often you use that app, etc. Most employers really won't care enough to try to decrypt your packets, but remember they have everything they need to do so. At the very least, the employer can see what you're spending time on.

Don't ever do ANYthing at work that you wouldn't want your boss to stand there and watch you do. It's just too easy for the network admin to capture everything, not to mention putting key logging or other monitoring programs on your computer.

Answer 5

Can an employer see what I'm doing on my iPhone whilst logged onto wifi

Yes, but much of this depends on the apps themselves.

I use apps like whatsapp and iMessages to communicate when I need to, can my employer see the content of those messages (actually read what I'm sending and receiving) or can they just see that I have been logged into whatsapp and iMessages over the wifi signal?

Speaking of those two apps specifically, they can perform a man-in-the-middle security certificate attack and read your messages. You'd be able to detect this, though, and if the apps have been designed well they could detect this type of attack.

As long as your employer hasn't gone to extreme lengths to read your messages, though, they may be able to tell that you're using the apps, but not the content or destination.

Other apps may be more or less well protected. Simple facebook game apps, for instance, might not bother with encryption. If you're just browsing, your employer can tell where you're going, and if it's not HTTPS what content you're downloading and submitting to websites.

Answer 6

Any network owner can see where your packets are headed, and scrape their metadata for nefarious purposes. And on a company network you can't count on a proxy to keep your communications secure.

Your only option if you want privacy from the system admins at work is a VPN, preferably one natively supported by iOS and not done through an app using an API (more prone to leak). Good news is VPNs are really cheap these days, under $5 per month.

ED: I say not to use a proxy because that covers ONLY http/https data (mostly your browser), and not whatever custom socket programming apps might use. A VPN with a VPN-side network gateway is far more comprehensive, and provides 100% encryption coverage for the device. Of course, your employer might start to wonder why your phone is only dealing in encrypted data ...

I know the H/W firewalls here have an option (disabled) to log devices suspected of using VPNs to hide traffic (probably because these firewalls also have a content filtering module).

Answer 7

The answer depends on the environment and how your employer manages both BYOD (Bring Your Own Device) and the wireless network. From a theoretical perspective, the answer is yes, potentially they can, especially if they have some form of mobile device management infrastructure in place. The extent to which they can read what you are doing really depends on the amount of effort they want to put in. For example, they could setup a type of man-in-the-middle system by requiring you as part of the agreement to use the wifi, accept a certificate. Even if they cannot read the actual data in your packets, they can track what you are doing i.e. where you connect to, send packets of data to etc and this can tell them a lot about what you are doing.

However, the reality is that this is rarer than many think. It is one things to collect data and completely another to have the resources to actually analyse it and do something with it. Multiply that effort by the number of employees and you soon end up with a lot of data needing a lot of resources. In most cases, there will not be active monitoring, but rather a passive monitoring - data will be collected and then only looked at when some other event occurs, such as being investigated for misconduct. However, in general, very few employers are going to be at all interested in your text messages, tweets or whatsapp posts.

It probably is the meta data which will more often be the biggest issue rather than the actual content of what you send. Getting the content and being able to process it into something meaningful is too resource intensive for most employers. Having a summary which shows that while at work, during an average day, you visit facebook 1000 times, read your gmail mail 50 times, sent 400 text messages etc is a much easier metric to collect and usually sufficient for most employers to ask for you to exlain why you have so much time to do all of this, especially if there are questions about your work performance.

Answer 8

You can't easily know.

iMessage and WhatsApp may encrypt the communications using SSL (TSL) but your employer can be using an internal proxy with crafted certificates to intercept and decrypt the traffic.

You can know if this is happening, if you open a browser in your phone on an https site and it sends you an alert about insecure site even if it is a reputable site (google, facebook, etc)

The best thing you can do to prevent this, is to use a trusted VPN