Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iPhone Mirroring at work may expose employees’ personal information

sevcosecurity.com

Post reply on HN
Print view View original

61–70 of 80 posts

Re: iPhone Mirroring at work may expose employees’ personal information

#61

Post by Onavo »

emptiestplace wrote: post #53
RDaneel0livaw wrote: post #43

Earlier quoted context omitted.

This is true for me. I have a personal desktop, but for mobility (laptop) my work issued MacBook M1 Pro is the only thing I have. There's no reason at all to purchase a personal laptop since my company is fully remote and they purchased the laptop from apple and had it directly sent to me, and have never required me to install any kind of monitoring software or control software on it at all.

"Directly from Apple" does not preclude monitoring and control, but it would've notified you on first boot if it were MDM enrolled.

Most tech companies (except some really big ones or those with compliance requirements) are quite flexible around this issue.

Re: iPhone Mirroring at work may expose employees’ personal information

#62

Post by mrweasel »

delfinom wrote: post #40
zippergz wrote: post #17

Earlier quoted context omitted.

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

IT in companies using Apple devices must be an absolutely miserable position.

Depends on what you mean by "IT". If you're thinking like fleet management for thousands of desktops, then it's probably not a bunch of people having a good time. On the other hand, trying to do fleet management for Windows desktops isn't much fun either.

Re: iPhone Mirroring at work may expose employees’ personal information

#63

Post by illiac786 »

lxgr wrote: post #60
unsnap_biceps wrote: post #57

Earlier quoted context omitted.

Pairing requires bluetooth, streaming requires WiFi, https://support.apple.com/en-us/120421 Under iPhone Mirroring system requirements Your iPhone and Mac are signed in to the same Apple Account using two-factor authentication. Your iPhone and Mac have Bluetooth and Wi-Fi turned on. Your iPhone is not sharing its cellular connection (Personal Hotspot is not in use). Your Mac is not sharing its internet connection or…

Wi-Fi needs to be turned on, but the connected network is irrelevant, similar to AirDrop.

Interesting that it works no matter the WiFi. But it’s still not tethering.

Lots of people who are entitled to a corporate smartphone also have a single phone with two sims for work/personal, because of the same reasons: cheaper, more convenient, large data plans on corporate device. These devices are MDM enrolled and the company will at least check what apps are installed.

Re: iPhone Mirroring at work may expose employees’ personal information

#64

Post by Havoc »

accrual wrote: post #16
sigio wrote: post #3

Duh, don't mix work and private devices / data

Right. I don't even let my work laptop onto my home LAN. It's hardwired into its own /30 VLAN and can only see the gateway and internet.

Unless you believe your employer to be malicious I doubt this brings any real world benefit

Re: iPhone Mirroring at work may expose employees’ personal information

#67

Post by [deleted] »

dml2135 wrote: post #4

Don’t you need to be signed in to the same iCloud account on both your laptop and phone to use this feature? That would mean that in order to encounter this issue you already need to be using a work account on a personal device, or vice versa. Since that’t the case I fail to see how this is a large vulnerability. The article doesn’t seem to address this point (possible I just missed this).

[deleted]

Re: iPhone Mirroring at work may expose employees’ personal information

#68

Post by happyopossum »

dml2135 wrote: post #56
lxgr wrote: post #34

Earlier quoted context omitted.

I don't think iPhone Mirroring requires both devices being on the same (or in fact any) Wi-Fi network. It does however require them to be signed in to the same iCloud account.

I’ve noticed this as well, but actually not sure how the feature works if not over the LAN. Is it bluetooth? Or synced over icloud?

It's direct peer-to-peer wifi

Re: iPhone Mirroring at work may expose employees’ personal information

#69

Post by oyashirochama »

EricE wrote: post #58
RDaneel0livaw wrote: post #43

Earlier quoted context omitted.

This is true for me. I have a personal desktop, but for mobility (laptop) my work issued MacBook M1 Pro is the only thing I have. There's no reason at all to purchase a personal laptop since my company is fully remote and they purchased the laptop from apple and had it directly sent to me, and have never required me to install any kind of monitoring software or control software on it at all.

Good luck when your laptop gets scooped up in discovery/litigation. After having been through lawsuits at work there is ZERO chance of me ever putting anything personal on work equipment.

Duplication and backups are a requirement of life IMO.

Re: iPhone Mirroring at work may expose employees’ personal information

#70

Post by emptiestplace »

Onavo wrote: post #61
emptiestplace wrote: post #53

Earlier quoted context omitted.

"Directly from Apple" does not preclude monitoring and control, but it would've notified you on first boot if it were MDM enrolled.

Most tech companies (except some really big ones or those with compliance requirements) are quite flexible around this issue.

I would qualify that "tech companies that don't know what they're doing wrt IT". Apple does have some features to allow a bit of flexibility, but unless you do all of your work via VDI or similar, I'd consider non-MDM devices to be a huge red flag,
Post reply on HN