Don’t Put Your Work Email on Your Personal Phone • Hacker News Board

Re: Don’t Put Your Work Email on Your Personal Phone

#41

Post by helen___keller » Wed, Jul 24, 2019, 1:59 PM UTC

cj wrote: post #34

Our company uses G Suite's Advanced MDM on a G Suite Enterprise account. I administer its configuration. Unless I'm missing something, there's not an obvious way to "spy" on employees, which this article is claiming. Perhaps it's possible, but if it is, it would require a lot of deliberate effort to accomplish. For example, there's not an out of the box way to track employee location. There's not a way to track emplo…

>There's not a way to track employee internet browsing history out of the box.

Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage.

Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

Re: Don’t Put Your Work Email on Your Personal Phone

#42

Post by alistairSH » Wed, Jul 24, 2019, 1:59 PM UTC

souterrain wrote: post #33

If your employer subscribes to an ethical model which permits them to abuse MDM, viewing your web history and tracking your location, you need to do more than remove your personal device from their control. You must find a new employer—preferably while you make public this repulsive behavior.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else.

Edit - looking at Settings->General->Profiles, there is one entry, which is for connecting to my Olympus camera. Nothing for the office.

Re: Don’t Put Your Work Email on Your Personal Phone

#43

Post by scarface74 » Wed, Jul 24, 2019, 2:00 PM UTC

phjesusthatguy3 wrote: post #32

scarface74 wrote: post #20

Earlier quoted context omitted.

If it doesn’t require an MDM profile, I have no problem putting my work email on my personal phone. I don’t want to carry around two devices.

That is totally understandable, and I hope you don't get in trouble when law enforcement comes looking for your personal device that somehow got caught up in their list of devices to look for.

Why do they need access to my device? The email is on the server.

Re: Don’t Put Your Work Email on Your Personal Phone

#44

Post by Communitivity » Wed, Jul 24, 2019, 2:01 PM UTC

I had to deal with this a number of years ago, and my response was "If you want MDM on the device to enable mail, then you buy me a separate device. Otherwise, I will access mail when I am at my corporate laptop or on the web via VPN." Never let them MDM your personal device, because they will possibly auto-wipe your phone if something proprietary or secret leaks out via email and you are on the distro.

Re: Don’t Put Your Work Email on Your Personal Phone

#45

Post by davidf560 » Wed, Jul 24, 2019, 2:01 PM UTC

saagarjha wrote: post #24

Fradow wrote: post #15

> you’ll likely be asked to install something called a Mobile Device Management (MDM) profile. Chances are, you’ll blindly accept it. Say WHAT? That's the entire premise of the article. Any sane person who have even a vague idea of what a MDM is will answer with a resounding NO. Is there actually serious companies who ask their employees to install a MDM on their personal phone? The moment you install a MDM on a phon…

> Is there actually serious companies who ask their employees to install a MDM on their personal phone? Every company that does BYOD?

Can confirm; the Fortune 500 company I work for has pretty extensive support for BYOD. Managers can be stodgy about providing work phones, plus carrying two devices is a pain.

I use Android so I'm relying on the Android for Work sandboxing, but truthfully I don't know the exact details of what that does and does not allow my employer to access. It does bother me, but I don't feel like I have a whole lot of choice. Being able to respond to Google Chat messages at any time (when away for lunch, for example), is feeling more and more like a requirement/expectation.

Also, commuting on the train pretty much requires mobile Hangouts support (which Google effectively makes impossible to use via a website if you're on Android), unless you want to always be at your desk in the office prior to the first meeting each day.

Re: Don’t Put Your Work Email on Your Personal Phone

#46

Post by souterrain » Wed, Jul 24, 2019, 2:03 PM UTC

alistairSH wrote: post #42

souterrain wrote: post #33

If your employer subscribes to an ethical model which permits them to abuse MDM, viewing your web history and tracking your location, you need to do more than remove your personal device from their control. You must find a new employer—preferably while you make public this repulsive behavior.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else. Edit - looking at Settings->General->Profiles, there is one entry, which is…

Ask. Since this often affects larger enterprises, start at the help/service desk. If that doesn't get you an answer, try Information Assurance or Information Security departments. Lastly, most large orgs have a Privacy office.

During all communications, make it clear what your concerns are; perhaps even link to articles like this one.

Corporations that care about customer and employee privacy will take such inquiries seriously.

Re: Don’t Put Your Work Email on Your Personal Phone

#47

Post by folkrav » Wed, Jul 24, 2019, 2:04 PM UTC

Pfhreak wrote: post #22

Interesting that this was just about spying, when the real reason to keep work email off your phone (imo) is to maintain work life balance. If I can access my work email on my phone, I will access my work email on my phone. Constantly. I'm bad enough with my phone and my personal email. Everywhere I've worked I've told my manager I turn off work when I leave (unless I'm oncall). I've never had this be a concern, acro…

I just use Android 7+'s work profile feature - basically a walled garden for MDM - and turn off work notifications on nights and weekends. After that it's just a matter of a tiny speck of self-control (unless you're workaholic, it's not that hard _not_ to open a work app) and I don't get annoyed by work stuff despite it being setup on my personal device.

Re: Don’t Put Your Work Email on Your Personal Phone

#48

Post by ok_coo » Wed, Jul 24, 2019, 2:04 PM UTC

At my current org, it was hinted to us that if we tied (email forwards, etc.) or added any work account to a personal device, that the personal accounts and device could be subject to audits.

Don't mix your work and personal stuff. Keep it separate, keep it safe.

Re: Don’t Put Your Work Email on Your Personal Phone

#49

Post by cj » Wed, Jul 24, 2019, 2:04 PM UTC

helen___keller wrote: post #41

cj wrote: post #34

Our company uses G Suite's Advanced MDM on a G Suite Enterprise account. I administer its configuration. Unless I'm missing something, there's not an obvious way to "spy" on employees, which this article is claiming. Perhaps it's possible, but if it is, it would require a lot of deliberate effort to accomplish. For example, there's not an out of the box way to track employee location. There's not a way to track emplo…

>There's not a way to track employee internet browsing history out of the box. Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage. Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying.

I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort.

(This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)

Re: Don’t Put Your Work Email on Your Personal Phone

#50

Post by alistairSH » Wed, Jul 24, 2019, 2:04 PM UTC

souterrain wrote: post #46

alistairSH wrote: post #42

Earlier quoted context omitted.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else. Edit - looking at Settings->General->Profiles, there is one entry, which is…

Ask. Since this often affects larger enterprises, start at the help/service desk. If that doesn't get you an answer, try Information Assurance or Information Security departments. Lastly, most large orgs have a Privacy office. During all communications, make it clear what your concerns are; perhaps even link to articles like this one. Corporations that care about customer and employee privacy will take such inquiries…

Sure, but I assume there's something in the device itself that indicates there is a profile or remote access? I don't see a work-related profile on my phone, but maybe there's something else beyond the obvious Profiles entry in General settings?