[MassDaemon]

I can access the Internet in our company through a proxy server (ISA Server). I recently noticed that all of my personal E-Mails which I've checked at worked is logged and seen by some of the network admins. I use GMail and I'm sure that nobody knows or has logged my password. There is also no remote desktop program running on my computer. I also know that no one has access to the cached content of my temporary internet files. They have logged my E-Mail address which existed on the header of the webpage, they also know the sender of the E-Mail, they can see the photos attached or included in the E-Mail, simply every thing, maybe even my password. I managed to find the link for secure surfing GMail: https://mail.google.com
Considering that my Internet activities have been logged somewhere inside the local area network, does the above link help me to check my E-Mails privately, or it's just secure between our internet server and GMail server? If my idea isn't still safe enough, what would you suggest?
Thanks in advance

 

[newbiesecurity]

It appears that the standard http://www.gmail.com site only encyrpts your login, but your actual messages are passed in plaintext. The link you posted seems to keep your login and the messages encrypted. That should protect you from the problem. If you think that admins are accessing your email against your company's policies, you should talk to your supervisor about it. There have been significant changes in the laws that dictate what data companies need to be monitor and keep for reporting purposes. You might try https://www.hushmail.com if you feel Google isn't secure enough.

 

[MassDaemon]

Thank you for your reply. Let's look at the problem this way: When I try to connect to my E-Mail I send my request to our proxy server: "internet.****.com:8080". My request is then sent to "https://mail.google.com" and google sends back the info including text, pictures, flash, mp3, etc. in an encrypted format to our mail server. Then the mail server redirects the data to me. As far as I know an https connection is secure between Google and our internet server. My question is: "Is it also secure between my computer and my internet server?"

 

[newbiesecurity]

They may be using a HTTPS proxy, which would allow them to essentially perform a man-in-middle-attack and see your traffic in plaintext. Most browsers will present you with a "lock" icon when you are using https. Double click on that icon and view the certificate. The certificate should be issued to the site that you are connected, in this case mail.google.com. If issued to your company, or some other company other than the site you are accessing, they are probably intercepting your traffic. There are some legitimate reasons for using a HTTPS proxy, but that doesn't give them the right to have a cavalier attitude when handling your personal information.

 

[MassDaemon]

Thank you for your reply!