Live data from Hacker News

Don’t Put Your Work Email on Your Personal Phone

onezero.medium.com

61–70 of 278 posts

Re: Don’t Put Your Work Email on Your Personal Phone

#61

Earlier quoted context omitted.

Ask. Since this often affects larger enterprises, start at the help/service desk. If that doesn't get you an answer, try Information Assurance or Information Security departments. Lastly, most large orgs have a Privacy office. During all communications, make it clear what your concerns are; perhaps even link to articles like this one. Corporations that care about customer and employee privacy will take such inquiries…

Sure, but I assume there's something in the device itself that indicates there is a profile or remote access? I don't see a work-related profile on my phone, but maybe there's something else beyond the obvious Profiles entry in General settings?

This is why I frame this as an ethics issue. If you install some sort of MDM profile, unless you spend a lot of time understanding mobile device management implementations, you won't necessarily know what the capabilities are.

If it is your device, typically an employer will disclose in their policies what capabilities they use.

Now, does this prevent a rogue infosec person from deviating from the policy? No. Nor does it prevent the state from compelling the company to abuse their MDM technology. If these examples are part of your threat model, you should not use your personal device with your employer's infrastructure. I don't think this makes your employer's choice to use MDM a bad one, however. They are protecting the corporation, after all.

Re: Don’t Put Your Work Email on Your Personal Phone

#62

Earlier quoted context omitted.

That is totally understandable, and I hope you don't get in trouble when law enforcement comes looking for your personal device that somehow got caught up in their list of devices to look for.

Why do they need access to my device? The email is on the server.

Yes, and your device read the email, so now your device is in scope. It doesn't matter what else you did with your device and their data, they now have a reason to look through your device.

Re: Don’t Put Your Work Email on Your Personal Phone

#63

Earlier quoted context omitted.

If it doesn’t require an MDM profile, I have no problem putting my work email on my personal phone. I don’t want to carry around two devices.

That is totally understandable, and I hope you don't get in trouble when law enforcement comes looking for your personal device that somehow got caught up in their list of devices to look for.

Please don't just copy and paste the same (FUD) comment all over the place

Re: Don’t Put Your Work Email on Your Personal Phone

#65

>When you add a work email address to your phone, you’ll likely be asked to install something called a Mobile Device Management (MDM) profile ...what? The Outlook app containerizes your email accout specifically so that you dont have to do this. Your company can remotely wipe your work account and only your work account. Of course MDM gives access to your phone - thats its whole purpose.

MDM gets applied if you want to access your exchange server with the default iOS apps because those apps don't have remote management built in.

If you use the Microsoft apps, you don't need to have an MDM applied because those apps handle the remote management functionality themselves.

Re: Don’t Put Your Work Email on Your Personal Phone

#66
post #16

At least if your org is on Office365 and doesn't have too restrictive policies, you can get your email over standard IMAP. There also exist some nice man-in-the-middle proxies which pretend to exchange servers that you've implemented the policies they ask for. I've got multiple "work" (one is a volunteering role) office365 exchange accounts on my personal phone, using [ https://sites.google.com/site/bikomobi/exchaine…

Experiences vary. Some stodgy F500's have IMAP and ActiveSync locked down in various ways that force you to run the Outlook app.

The Outlook iPhone app doesn't require MDM.

Re: Don’t Put Your Work Email on Your Personal Phone

#67
post #16

At least if your org is on Office365 and doesn't have too restrictive policies, you can get your email over standard IMAP. There also exist some nice man-in-the-middle proxies which pretend to exchange servers that you've implemented the policies they ask for. I've got multiple "work" (one is a volunteering role) office365 exchange accounts on my personal phone, using [ https://sites.google.com/site/bikomobi/exchaine…

Experiences vary. Some stodgy F500's have IMAP and ActiveSync locked down in various ways that force you to run the Outlook app.

Tons of places outside of F500 are doing that. At work we just disabled IMAP for almost all O365 accounts and any other method of authentication that doesn't implement our two factor authentication. The rising number of compromised accounts because the user used the same password elsewhere, apparent bruteforce attacks, etal forced the issue.

Of course MDM is not required for any of this. Worst case is on Android you're forced to use Microsoft's Outlook app.

Re: Don’t Put Your Work Email on Your Personal Phone

#68
post #27

This "stop and think" warning is very good, but let's be honest, in many roles you can't say "no" anymore. Most companies require a significant subset of employees to use their personal device for work and have corporate accounts active on it. It may not be true for you personally, but I bet it is for most people who have on-call rotations. Features like Android's separate profiles are critical. We need similar sandb…

A company cannot force you to use your hardware to run their business at least not without compensation. Having a phone number that can be paged is significantly different than installing MDM software that can track literally everywhere you go, wipe your phone without your permission, etc. If a company is saying you "must" install something in your personal device without any compensation on top of your regular paycheck this is incorrect. If you use your own car for work you're typically compensated with mileage or you can write it off on your taxes.

Re: Don’t Put Your Work Email on Your Personal Phone

#69

Earlier quoted context omitted.

Why do they need access to my device? The email is on the server.

Yes, and your device read the email, so now your device is in scope. It doesn't matter what else you did with your device and their data, they now have a reason to look through your device.

Would that mean if I were at a hotel and used their computer in a pinch to access the web client (not that I ever would - keyloggers) would that be in scope?

Re: Don’t Put Your Work Email on Your Personal Phone

#70
I've seen the same thing with Chrome. If you log into Gmail it automatically link the browser with the corporate account for all Google services. And if you go on the settings page (chrome://settings/) it shows "Your Browser is Managed by Your Organization". This allow the manager to automatically install extensions, filter websites... I removed the auto managed browser while being connected and it wasn't an easy task unfortunately.
Post reply on HN