Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iPhone Mirroring at work may expose employees’ personal information

sevcosecurity.com

Post reply on HN
Print view View original

21–30 of 80 posts

Re: iPhone Mirroring at work may expose employees’ personal information

#21

Post by tiahura »

crazygringo wrote: post #8
seneca wrote: post #6

It's incredible to me how many people log into personal account on work devices. People should really research the amount of data security tools harvest.

If your employer isn't requiring you to log in with a personal account on a work device (and they're not), and your personal data doesn't have anything you'd mind your employer seeing, then why not? Because then there's no slippery slope and you're making a conscious choice. A lot of people lead really boring lives and just want the convenience of using their personal e-mail on the work device. Their employer knowing…

HN readers seem to be very concerned about spies and perverts that might get caught because they naively used X tech.

Re: iPhone Mirroring at work may expose employees’ personal information

#22

Post by GavinGruesome »

accrual wrote: post #16
sigio wrote: post #3

Duh, don't mix work and private devices / data

Right. I don't even let my work laptop onto my home LAN. It's hardwired into its own /30 VLAN and can only see the gateway and internet.

So it is on your home LAN, just on a different VLAN than your infra. (which makes sense)

Re: iPhone Mirroring at work may expose employees’ personal information

#23

Post by threetonesun »

crazygringo wrote: post #8
seneca wrote: post #6

It's incredible to me how many people log into personal account on work devices. People should really research the amount of data security tools harvest.

If your employer isn't requiring you to log in with a personal account on a work device (and they're not), and your personal data doesn't have anything you'd mind your employer seeing, then why not? Because then there's no slippery slope and you're making a conscious choice. A lot of people lead really boring lives and just want the convenience of using their personal e-mail on the work device. Their employer knowing…

Don't forget you don't own your work device and could lose access to it with zero notice. It's a personal pet peeve of mine that MacOS has no way to install with a "forget everything about iCloud" option. I love it for my personal devices but on a work device you quickly notice how it's got it's little hooks all over the OS.

Re: iPhone Mirroring at work may expose employees’ personal information

#24

Post by accrual »

GavinGruesome wrote: post #22
accrual wrote: post #16

Earlier quoted context omitted.

Right. I don't even let my work laptop onto my home LAN. It's hardwired into its own /30 VLAN and can only see the gateway and internet.

So it is on your home LAN, just on a different VLAN than your infra. (which makes sense)

Right, shares the same PHY/layer 1, but logically separated at layer 2. :)

Re: iPhone Mirroring at work may expose employees’ personal information

#25

Post by elliotec »

zippergz wrote: post #17
dml2135 wrote: post #4

Don’t you need to be signed in to the same iCloud account on both your laptop and phone to use this feature? That would mean that in order to encounter this issue you already need to be using a work account on a personal device, or vice versa. Since that’t the case I fail to see how this is a large vulnerability. The article doesn’t seem to address this point (possible I just missed this).

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

I’d say generally for most people, at least anecdotally, their work laptop is their only laptop because they’re expensive and have good specs. Especially for Apple products (which is the majority of the share of hardware in this anecdote), it’s natural to want and expect the continuity between devices.

Employers usually allow this or don’t explicitly forbid it, and most employees aren’t exactly security conscious or willing to sacrifice convenience. So it’s not that shocking to me, but it is weird that there isn’t more education or rules around it.

Re: iPhone Mirroring at work may expose employees’ personal information

#26

Post by gnu8 »

SketchySeaBeast wrote: post #13
seneca wrote: post #6

It's incredible to me how many people log into personal account on work devices. People should really research the amount of data security tools harvest.

I sometimes see my coworkers with banking tabs open when they screen share. The level of trust is astounding.

You will probably find that your corporate TLS MitM proxy excludes financial institutions so that employees can do their banking without any doubt that their own company would respect the confidentiality of their finances. If not, your cybersecurity team needs some help.

Re: iPhone Mirroring at work may expose employees’ personal information

#27

Post by likeabatterycar »

So the threshold of concern by a "security" company is "they might audit your apps and find out you're gay!"

Yet not a single concern about tethering an iPhone (with an external connection) to a PC on the company's internal network, bypassing all firewalls, proxies, and other protections. That is grounds for immediate dismissal at some places.

I expect security people to think more like network engineers and less like teenagers gossiping in the canteen.

Re: iPhone Mirroring at work may expose employees’ personal information

#28

Post by mastercheif »

bilekas wrote: post #18
dml2135 wrote: post #4

Don’t you need to be signed in to the same iCloud account on both your laptop and phone to use this feature? That would mean that in order to encounter this issue you already need to be using a work account on a personal device, or vice versa. Since that’t the case I fail to see how this is a large vulnerability. The article doesn’t seem to address this point (possible I just missed this).

From here : https://support.apple.com/en-us/120421 > If your Mac asks whether to require Mac login to access your iPhone, choose Ask Every Time or Authenticate Automatically. You can change this later in iPhone Mirroring settings on your Mac. Seems its an app setting to have this protected or not ?

- iPhone Mirroring system requirements

-- Your iPhone and Mac are signed in to the same Apple Account using two-factor authentication.

Post reply on HN