Live data from Hacker News

iPhone Mirroring at work may expose employees’ personal information

sevcosecurity.com

41–50 of 80 posts

Re: iPhone Mirroring at work may expose employees’ personal information

#41

Earlier quoted context omitted.

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

IT in companies using Apple devices must be an absolutely miserable position.

Why, because there’s not as much work to do debugging installers and malware as there is with Windows?

Re: iPhone Mirroring at work may expose employees’ personal information

#42
post #37

Speaking of iPhone Mirroring: Doesn't this effectively downgrade two-factor authentication to a single factor for flows like "tap 'yes' on your phone to login"? I've been wondering if there is a way for iOS authenticator apps to opt out of mirroring, but haven't found anything so far.

Don’t think so. Push notification flows like this fall into the “something you have” category (which you still do when using mirroring) and additionally when done properly, they require biometrics verification to respond to the “tap yes”.

Re: iPhone Mirroring at work may expose employees’ personal information

#43

Earlier quoted context omitted.

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

I’d say generally for most people, at least anecdotally, their work laptop is their only laptop because they’re expensive and have good specs. Especially for Apple products (which is the majority of the share of hardware in this anecdote), it’s natural to want and expect the continuity between devices. Employers usually allow this or don’t explicitly forbid it, and most employees aren’t exactly security conscious or…

This is true for me. I have a personal desktop, but for mobility (laptop) my work issued MacBook M1 Pro is the only thing I have. There's no reason at all to purchase a personal laptop since my company is fully remote and they purchased the laptop from apple and had it directly sent to me, and have never required me to install any kind of monitoring software or control software on it at all.

Re: iPhone Mirroring at work may expose employees’ personal information

#44
post #4

Don’t you need to be signed in to the same iCloud account on both your laptop and phone to use this feature? That would mean that in order to encounter this issue you already need to be using a work account on a personal device, or vice versa. Since that’t the case I fail to see how this is a large vulnerability. The article doesn’t seem to address this point (possible I just missed this).

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

People got really angry at IT not allowing them personal Apple ID logins in several large companies I've been at :/

Re: iPhone Mirroring at work may expose employees’ personal information

#45

Earlier quoted context omitted.

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

IT in companies using Apple devices must be an absolutely miserable position.

I've worked IT for Mac only shops my entire career, I wouldn't say any of it has been miserable

Re: iPhone Mirroring at work may expose employees’ personal information

#46
post #41

Earlier quoted context omitted.

IT in companies using Apple devices must be an absolutely miserable position.

Why, because there’s not as much work to do debugging installers and malware as there is with Windows?

As a consultant, I work with Linux, macOS and Windows. Depends on the client and the project.

I can't remember last time I even heard about a malware in someone else's Windows machine, let alone my Windows machine. I don't know what you mean by debugging installers.

Sounds like an outdated opinion. Just like those "lol PHP bad" regurgitations and linking outdated articles about it.

Re: iPhone Mirroring at work may expose employees’ personal information

#47

Earlier quoted context omitted.

If your employer isn't requiring you to log in with a personal account on a work device (and they're not), and your personal data doesn't have anything you'd mind your employer seeing, then why not? Because then there's no slippery slope and you're making a conscious choice. A lot of people lead really boring lives and just want the convenience of using their personal e-mail on the work device. Their employer knowing…

Don't forget you don't own your work device and could lose access to it with zero notice. It's a personal pet peeve of mine that MacOS has no way to install with a "forget everything about iCloud" option. I love it for my personal devices but on a work device you quickly notice how it's got it's little hooks all over the OS.

There is an MDM option to disable iCloud, but I'm not sure if its possible to toggle without enrolling macOS into a managed system.

Re: iPhone Mirroring at work may expose employees’ personal information

#48
post #4

Don’t you need to be signed in to the same iCloud account on both your laptop and phone to use this feature? That would mean that in order to encounter this issue you already need to be using a work account on a personal device, or vice versa. Since that’t the case I fail to see how this is a large vulnerability. The article doesn’t seem to address this point (possible I just missed this).

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

I'll use my work computer to check personal email and do other personal stuff from time to time. I use a separate browser profile that clears its cache and cookies when I'm done. I don't recommend it necessarily, but I don't have any endpoint monitoring on my machine so I feel reasonably OK doing it.

Re: iPhone Mirroring at work may expose employees’ personal information

#49
post #30

The PSA should just be don't mix your personal and work devices.

Not that easy. I use my personal device for work - and if I didn't I would wish I did, when travelling...

I always take both devices when I need both. The M3 is annoyingly heavy, and I have to treat it better than I do my personal device, but it's not a major hassle.

Re: iPhone Mirroring at work may expose employees’ personal information

#50

Earlier quoted context omitted.

I sometimes see my coworkers with banking tabs open when they screen share. The level of trust is astounding.

It certainly sounds foolish at first, but what's the real risk? Is your employer really going transfer themselves your balance or snoop on your utility bills? Now if you loaded a crypto wallet on your work device, that would be another story..

I know there are bad actors trying to get into my company's network. They are a high visibility target and have fallen victim to ransomware attacks before. Even if I trusted my employer, I don't trust what else may be lurking there.
Post reply on HN