Can my work track what I do on my home computer via a remote connection?

Home » Internet » Privacy

Summary: Using a computer at work puts you at the mercy of your workplace IT policy. It's technically possible that your work could track all your activities.

Can they?

Sure.

Do they?

Maybe. It's easy to do, but it's hard to manage. It really depends on just how you connect to your home machine and how aggressive your company is about tracking you.

•

Off the top of my head, I can think of at least two ways your company could be tracking what you're up to as you remote access your machine at home.

1. Keystroke logging.

If your machine at work has a keystroke logger installed, then it doesn't matter what you're doing or who you're connected to - your keystrokes can be recorded. Couple that with screen image capture and your workplace could record a fairly accurate record of your session, including whatever it was you were doing at home.

It's fairly unlikely that they'd do this unless they had a really strong reason to. It can be fairly data and labor intensive to go through all the collected data to see what you were up to.

But it could be done.

2. Proxy/Intercept

Remote desktop is encrypted and secure by design. Additional alternatives, like VPNs or other VNC remote access tools are similarly typically encrypted as well. So one would think that the actual data stream was safe from sniffing, yes?

Maybe not.

There are techniques I've recently heard discussed that work like this:

• Remember that you don't really control your work computer. So hidden proxies, alternate certificates, and other tools could be installed by your company's IT department.

• When you attempt to make a remote desktop connection to your home computer, that's transparently intercepted by a proxy that sits between you and your home machine.

• That proxy is able to decrypt the data, examine, or log it, and then re-encrypt it on its way to your home computer. The same applies in the reverse path.

• Except perhaps for a little slowness, you'd never know without examining the characteristics of your connection very closely and knowing what to look for.

This approach is technically complex, so again I wouldn't expect a company to necessarily set it up unless they had serious reason to or were particularly paranoid.

But the short answer is that it's possible.

•

So the bottom line is that yes, absolutely it's quite possible. Not necessarily easy, but it can be done.

Only you can judge how likely it is that your company is doing it, or whether what you're doing would be "against the rules" if they were.

Related:

• Ask Leo! - Can my company monitor my IM conversations at home?

• Ask Leo! - Can my ISP monitor my internet usage?

Article 11937 | Posted October 23, 2007