Live data from Hacker News

Apple explicitly asks employees to merge their personal and work accounts

twitter.com

261–270 of 361 posts

Re: Apple explicitly asks employees to merge their personal and work accounts

#261
post #183

Earlier quoted context omitted.

Personal devices could certainly be a part of discovery.

The company has no legal right to even know you have a personal device. You could just say you don't have one. Or just quit the company if they ask you to hand over a personal device.

It's almost always the other party in the lawsuit who is subpoenaing your past communications. Your employer is being forced by the court to retrieve these; it isn't their choice. It is in fact possible for your personal communications to get subpoenaed for a lawsuit related to your work. But, the other party will need some evidence that you had a conversation on a personal device that relates to the lawsuit. They can't just subpoena something like "all communications by employees relating to terms X and Y."

Usually your employer would prefer that you not hand over your personal device. Because the other party is looking for some sort of "smoking gun" where employees admit that they think some corporate behavior is bad or breaking the law. The penalties for not cooperating here are bad enough, though, that companies will generally cooperate. And the situations where it's a personal device are relatively rare, usually it's just corporate devices.

Quitting the company doesn't change anything. You can still be subpoenaed after you leave the company and the court can force you to turn things over.

Source: I'm not a lawyer but I have had my communications subpoenaed from my time at both Google and Facebook and I have complained to many corporate lawyers about how stupid these rules are while they politely explained to me how the system works

Re: Apple explicitly asks employees to merge their personal and work accounts

#262

Earlier quoted context omitted.

I work in healthcare. It blows my mind how many people use a work email for communication regarding medical appointments including results and very personal information. I’m a complete outlier in how conservative I am with this stuff and I’m nowhere near as fastidious as the HN gold standard.

It blows my mind how many healthcare providers routinely transfer sensitive information over insecure channels like email in the first place and ask the patients or carers involved to do the same. The most basic data protection regulations enshrined in law in my country are being openly violated, to say nothing of medical ethics and patient confidentiality.

In New Zealand the move to email comes after faxes were deemed insecure. It’s pretty much universally used, despite the issues.

Re: Apple explicitly asks employees to merge their personal and work accounts

#263

Create a firewall between your personal and professional time. Another name for this is “setting healthy boundaries”. Always create new accounts for anything work related -- GitHub, Apple ID, whatever. Don’t install work apps on your personal phone. Don’t enrol your personal phone in corporate MDM. If they want you to use a device for work, ask them to give you one. Don’t do personal stuff on your work devices. Don’t…

I agree with most of this, but I'm curious about the specific case of Github. If I join a company, are there any big dangers to just having them add my personal GH account to their organizations or private repos, and then if I leave the company they can remove me again? This seems to be how a lot of developers in my orbit do things. (I mean any dangers at the account/permissions/privacy level - separate from "having…

[deleted]

Re: Apple explicitly asks employees to merge their personal and work accounts

#264
I remember this story, this was the person how accused Apple of sexism because a superior gave her mild feedback about her presentations [1]. Shes also been very vocally negative about Apple on Twitter for months, airing internal complaints via Twitter [2]. And people have been spamming her tweets on HN for a while... in an attempt to build outrage I guess?

Color me real skeptical that she is telling the truth here.

[1] https://news.ycombinator.com/item?id=28066459

[2] https://www.ashleygjovik.com/ashleys-apple-story.html

Re: Apple explicitly asks employees to merge their personal and work accounts

#265

Earlier quoted context omitted.

Do people just assume she's telling a truthful story? I wonder that because I worked there for years and anything remotely like what she claims was implausible when I was there, and would have been immediately corrected with impunity had such occurred. I mean there's security all over and they're not in a managerial chain, so something seems very difficult about her claims to me. In saying that, maybe she did have so…

Perhaps this might help convince you: https://twitter.com/ashleygjovik/status/1426014545202479108

Thats a redacted screenshot by the person making the claim. Its not very convincing.

Re: Apple explicitly asks employees to merge their personal and work accounts

#267
post #259

Earlier quoted context omitted.

Thank you. Why is it that all examples in this thread use `.com` somewhere in the middle of the string used for the `host` field?

Personally I just found it natural to tack on a suffix. But you do you :)

Why is it natural? Do hosts usually have a suffix? Why?

Re: Apple explicitly asks employees to merge their personal and work accounts

#268
post #230

Earlier quoted context omitted.

You can call it anything you want save of whitespace (albeit I personally haven't tried emoji or other non-ASCII shenanigans :))

Thank you. Why is it that all examples in this thread use `.com` somewhere in the middle of the string used for the `host` field?

I guess if you have a more complex matrix of personas and remote servers (not only GH), structure and predictability becomes more important than terseness.

But again, it's just personal preference.

Re: Apple explicitly asks employees to merge their personal and work accounts

#269
There's a lot of people up in arms about this–either because they are mad because Apple is forcing employees to merge their accounts, or that they think this is completely false because this is not strictly required. As always, the real truth is somewhere in the middle.

Apple does not mandate that you use your personal iCloud on your work device. You can absolutely make a fresh account (from a new Gmail or something) and use that to sign in, and then throw it away once you have left. Some employees do this: it's possible, but fairly difficult.

However, it is also true that many (dare I say most?) employees do sign into their work devices with personal Apple IDs. Why? Because there are several fairly strong pressures for them to do so. New hire training has natural variation, but often the person will tell you to "just sign in" to when the iCloud screen shows up on your new computer, without explaining (sometimes not even knowing) that this doesn't have to be an account you actually use, and many people do so thinking it is required to go forwards in the setup process. And Apple rewards you for linking your account: you'll get iCloud storage and access to all of Apple's apps for free.

But that's not all: there's a very strong culture at Apple of "dogfooding": using the beta software for yourself to try it out and file bugs against it. Doing this effectively all but requires having an account you actually use, and for many this is the main reason why they only have one work phone rather than two phones. Plus, on Apple devices if you're not signed into an account that you share elsewhere, a lot of things will not work: your Apple Watch will not sync or unlock the device, you can't listen to your Apple Music, the iMessages your coworker sends you to pick a spot of lunch are not going to be seen.

Obviously, it is always easy to tell an employee that they should trade privacy for convenience. But my point is that the culture explicitly pushes you in this direction, and Apple themselves are pretty bad about employee privacy. They've developed a full BYOD MDM solution that keeps your work data separate from your personal data, so companies can just access or delete that, but they don't actually use it internally. And you think you're being cool with your two iPhones that you bring to work? Nope, any device you bring onto the premises is subject to search, even if you have never MDMed it and only use it for personal work. So they, too, are way behind on where they should be with regards to maximizing privacy. It's regrettable that this employee found this out the hard way–but she certainly will not be the last, and I think it's entirely valid to call out Apple for not moving forwards as other companies have.

Re: Apple explicitly asks employees to merge their personal and work accounts

#270

Earlier quoted context omitted.

Okay, that makes a lot more sense. To be frank, this twitter thread seems sensationalist if reality is closer to "I didn't bother to create a separate work account" rather than "Apple asked me to merge my personal account".

The original complaint also seems to put the blame on Apple but I would have to think that letting people start deleting stuff in discovery is not allowed, even if you swear it's personal and irrelevant to the case.

I'm curious about this. It's 'not allowed' explicitly by the judge? Can the employee be charged with 'evidence tampering' even if the judge didn't issue any order that explicitly prohibits the employee from deleting their files?
Post reply on HN