Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Put Your Work Email on Your Personal Phone

onezero.medium.com

Post reply on HN
Print view View original

191–200 of 278 posts

Re: Don’t Put Your Work Email on Your Personal Phone

#191

Post by TimTheTinker »

pwthornton wrote: post #126
kpwags wrote: post #21

This is certainly a very good reason to not put your work account on your personal phone, but my primary reason not to is that it's my device and I pay for the service. If my company needs me to be available beyond my 9-5 workday, they can pay for it. If there's an emergency, they can always call, but I don't like being "always on".

My company pays for my service but not my phone, so I'm in a gray area here.

My company pays a $75/month BYOD stipend. It's more than enough to cover the phone bill.

Re: Don’t Put Your Work Email on Your Personal Phone

#192

Post by kemiller2002 »

JoshTriplett wrote: post #184
ghostbrainalpha wrote: post #174

Earlier quoted context omitted.

That's a good question. But as long as you don't save any files on your personal computer, it is just a transport device like a car that gets you to work. I'm guessing the law isn't that forward thinking though. Maybe I should keep a <$200 mini-PC, just to RDP into work so I have no problem giving up that machine.

> Maybe I should keep a Doesn't help you. Either your personal devices are in scope or not. If they are, then they all disappear and you're unlikely to get them back. Investigators don't trust the subjects of the investigation to tell them what devices are in scope or not. If your devices are in scope, they'll take everything that has any chance of having data on it. (Source: many many reports from subjects of such i…

In the FBI's defense, they did return all the equipment after they were done with it (if I remember correctly within like a day too). Funny enough though, one guy thought it was strange that after they gave his phone back, all of his text messages from then on were suddenly emailed to his work email also. Wouldn't happen to be that all email in the company was saved indefinitely due to the archiving server?

Re: Don’t Put Your Work Email on Your Personal Phone

#193

Post by jrockway »

twic wrote: post #173
eschneider wrote: post #148

Earlier quoted context omitted.

Nothing focuses the mind on sensible email retention policies like working at a company where all the email got subpoenaed.

And since discovery processes are often leaky, pPart of the onboarding at my company is the lesson that you shouldn't write anything in an email that you wouldn't be happy to have splashed all over the Wall Street Journal. So, for example, we try to choose names for applications that aren't going to give people the wrong idea, eg don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderMa…

> don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderManager

Good advice. I am somewhat surprised at times on what the media doesn't uncover and try to spin as a conspiracy theory. For example, we had this open source project publically available https://gfiber.googlesource.com/kernel/prism/ around at the same time as the Snowden leaks about "prism" and nobody wrote any articles about it. Of course, it's completely unrelated... but I feel that that normally doesn't stop people.

I found the whole thing very interesting.

Re: Don’t Put Your Work Email on Your Personal Phone

#194

Post by colechristensen »

mpeg wrote: post #168
kemiller2002 wrote: post #102

Funny story (well OK, not so funny), I worked at a company where the FBI decided to pay a visit and investigate some potential naughtiness performed by members of the senior staff. They asked questions such as "Do you use your cell phone and personal email for company matters." Guess what a lot of them said, "Yep, have to." That immediately made their personal equipment, etc. in scope for the investigation and they c…

And that's why you don't talk to police; they could have just said no or refused to answer to make it harder for the investigators.

If the FBI comes in your office with a warrant and you refuse to speak I'm guessing they'll be taking your phone anyway and/or arresting you. Making things harder for investigators often means making things harder for yourself too. Winning an argument about your personal device's admissibility in court six months later isn't really winning is it?

Re: Don’t Put Your Work Email on Your Personal Phone

#195

Post by stevenwliao »

shalmanese wrote: post #180
tristor wrote: post #142

I work from home/remotely. For years I've followed a simple policy. I don't use work devices for personal use, and I don't connect my personal devices to any work accounts. I've never had an employer that's had a problem with this, and the most I've ever heard is comments about how I'm just inconveniencing myself because I carry two phones, two laptops. But the reality is, it's been extremely beneficial when I've had…

I love having a work laptop that only has work on it but I've never been able to have a personal laptop that doesn't eventually get all the work stuff onto it at some point. What do you do if you're lying in bed watching a movie when you remember that you need to schedule a meeting with X for tomorrow at 11am? Do you get out of your warm bed and pull out your work laptop and add the calendar entry and then climb back…

> What do you do if you're lying in bed watching a movie when you remember that you need to schedule a meeting with X for tomorrow at 11am?

Carry your work phone to bed and use the calendar app.

Re: Don’t Put Your Work Email on Your Personal Phone

#196

Post by Thriptic »

OrangeMango wrote: post #161
kemiller2002 wrote: post #102

Funny story (well OK, not so funny), I worked at a company where the FBI decided to pay a visit and investigate some potential naughtiness performed by members of the senior staff. They asked questions such as "Do you use your cell phone and personal email for company matters." Guess what a lot of them said, "Yep, have to." That immediately made their personal equipment, etc. in scope for the investigation and they c…

If you use your home computer to RDP into your work computer, what would be the correct answer to the question? The "work" occurs on the company-owned computer, but you are typing on the keyboard of your personally-owned computer.

I am not a lawyer, but from what I understand from a forensics class I took, personal devices can be in scope in the US if:

* A warning banner is displayed when you connect to the VPN / network / asset that states that use of the resource voids your expectation of privacy, you consent to monitoring, and you acknowledge they can inspect personal devices etc

* You signed a policy document acknowledging that they can monitor you and that connecting to a company resource brings your personal device in scope of monitoring and seizure

* You committed a crime, the police become involved, and a search warrant is issued.

If you do not sign such a policy document, they do not have evidence of a criminal (ie not civil) infraction, and they do not display a warning banner, then you can claim reasonable expectation of privacy (meaning you were ignorant of their policy), refuse a search, and there isn't much they can do to my knowledge. In this specific case you would have to talk to a lawyer, but I would just be safe and use only work assets for work.

Re: Don’t Put Your Work Email on Your Personal Phone

#197

Post by izzydawndrdog »

cannonedhamster wrote: post #60
alistairSH wrote: post #42

Earlier quoted context omitted.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else. Edit - looking at Settings->General->Profiles, there is one entry, which is…

Generally MDM software swallows up everything. It's been a while since I managed an MDM instance but we could track everywhere the employee went by default and when I suggested we turn it off there wasn't an option nor did management want to. We could see every app pretty much everything on the device. I will never install MDM on my phone after managing it. I've also seen phones accidentally wiped. Back up your phone…

Apple MDM is changing quite a bit come iOS 13 and macOS Catalina 10.15. A new enrollment methodology called User Enrollment is aimed at protecting the privacy of employees using their own personal devices. User Enrollment greatly limits what the company can see about the device. As an example, the MDM can only see the apps that it has installed on its own, it can't get any PII (Personally Identifiable Information) such as a phone number or serial number from the device, etc. The MDM data and visibility into the device is essentially sandboxed.

This article provides a summary of MDM User Enrollment, including details about how Apple separates personal and business data on separate APFS volumes.

https://simplemdm.com/apple-user-enrollment/

Before User Enrollment there wasn't a great Apple MDM enrollment option that struck this privacy balance for employee-owned devices. App data couldn't be viewed per-se, though a list of apps is certainly available (as mentioned by cannonedhamster). Some companies would skip MDM and essentially "wrap" individual apps in order to have the ability to encrypt the app data and have some control over the binary, but that's about it.

I'm not sure of the story with Android, though I'm under the impression that there is a similar "sandbox" option for MDM, albeit the implementation and user experience is rather messy and obtuse.

Full disclosure: I work for an MDM software producer.

Re: Don’t Put Your Work Email on Your Personal Phone

#198

Post by jonny789 »

Similar could be the case, when an office gmail account is used by a number of employees for viewing & replying official emails.

One employee who is logged in using office gmail in his/her android phone. The person (other employee) knowing the password can easily view most of the phone activity by visiting https://activity.google.com (which includes search history with location).

Re: Don’t Put Your Work Email on Your Personal Phone

#199

Post by briandear »

egypturnash wrote: post #179
zippergz wrote: post #164

Earlier quoted context omitted.

Are you, with a straight face, saying that you'd rather receive a PHONE CALL than a notification from an app that you can set time-sensitive notification methods for (i.e. DND overnight, etc.)? I'm not fan of getting any kind of work message outside of working hours, but I'd FAR rather let my co-workers send me a slack message that I can ignore and/or deal with when I feel like it than call me on the phone. No one at…

At least on iOS, Do Not Disturb covers phone calls, too. With the ability to set overrides for calls from Very Important Numbers. Voice mail exists as well.

Voicemail? How tedious. A Slack message is far preferable. Nothing stopping you from setting do not disturb in Slack.

Re: Don’t Put Your Work Email on Your Personal Phone

#200

Post by colechristensen »

bhandziuk wrote: post #165
kemiller2002 wrote: post #102

Funny story (well OK, not so funny), I worked at a company where the FBI decided to pay a visit and investigate some potential naughtiness performed by members of the senior staff. They asked questions such as "Do you use your cell phone and personal email for company matters." Guess what a lot of them said, "Yep, have to." That immediately made their personal equipment, etc. in scope for the investigation and they c…

Is this only true for using some company provided app or even a dedicated email app? What about just going to webmail on a browser on a phone? Does that have the same implication?

This is true for any work interaction on your personal device. You aren't going to win arguing technicalities with someone executing a search warrant.

The only safe and sane thing to do is refuse to have any work touch devices you own, and likewise don't let any of your personal affairs touch work systems.

Post reply on HN