Live data from Hacker News

Don’t Put Your Work Email on Your Personal Phone

onezero.medium.com

71–80 of 278 posts

Re: Don’t Put Your Work Email on Your Personal Phone

#71

Earlier quoted context omitted.

Yes, and your device read the email, so now your device is in scope. It doesn't matter what else you did with your device and their data, they now have a reason to look through your device.

Would that mean if I were at a hotel and used their computer in a pinch to access the web client (not that I ever would - keyloggers) would that be in scope?

Probably, but do you care when it isn't your device?

Re: Don’t Put Your Work Email on Your Personal Phone

#72

If your employer subscribes to an ethical model which permits them to abuse MDM, viewing your web history and tracking your location, you need to do more than remove your personal device from their control. You must find a new employer—preferably while you make public this repulsive behavior.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else. Edit - looking at Settings->General->Profiles, there is one entry, which is…

If you don't have a profile there your device is not managed and they can't do what the article talks about.

Re: Don’t Put Your Work Email on Your Personal Phone

#73
If you have a recent Samsung phone there is a feature called 'Knox' that splits off your personal files from the work-related stuff. Knox is like a secure container that's fully isolated from the rest of the phone -- like a phone within a phone. Knox cannot access your personal files so the assertion that it can 'wipe your data' or spy on you would be incorrect (it only works with the container.)

What the article mentions about tracking is a legit concern though, IMO. Within a container it's still possible to access the GPS sensors. I'm not sure if the user can block this / opt-out? It's possible that an app may have to request permissions to use the GPS. In any case, I would say the situation is still better and more transparent on Samsung devices than this article would imply. I don't know about other devices but I can tell you Apple phones don't yet have an equivalent secure container solution (like Knox or Enclaves) so I'd be more concerned about the security situation on those devices.

Re: Don’t Put Your Work Email on Your Personal Phone

#74
post #16

Earlier quoted context omitted.

Experiences vary. Some stodgy F500's have IMAP and ActiveSync locked down in various ways that force you to run the Outlook app.

The Outlook iPhone app doesn't require MDM.

It can, and their MAM blurs some lines.

Re: Don’t Put Your Work Email on Your Personal Phone

#75

If your employer subscribes to an ethical model which permits them to abuse MDM, viewing your web history and tracking your location, you need to do more than remove your personal device from their control. You must find a new employer—preferably while you make public this repulsive behavior.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else. Edit - looking at Settings->General->Profiles, there is one entry, which is…

Anyone with admin access to Outlook 365 can do this stuff. Even in a large company that could mean a surprising group of people able to do this sort of spying with no technical restrictions to enforce policy (assuming there is an explicit policy, which in a smaller company is not a given.)

Re: Don’t Put Your Work Email on Your Personal Phone

#76

I'm a remote contractor. Usually, if my customer wants me to install some tracking software (recording you're present in front of PC, tracking mouse/keyboard activity, etc) I agree only on one term: they need to send me a machine with this software so I can use it while doing work. I lose customers this way, though most of the time people agree to not have this kind of software involved instead of rejecting offer alt…

> If I worked in an office environment and company wanted me to use tracking software I'd see no problems with it.

* Lack of trust that is uncalled for, especially if you are in a position with responsability anyway.

* Unappropriate tracking method for a creative work

Are two points that I see.

Re: Don’t Put Your Work Email on Your Personal Phone

#77

If your employer subscribes to an ethical model which permits them to abuse MDM, viewing your web history and tracking your location, you need to do more than remove your personal device from their control. You must find a new employer—preferably while you make public this repulsive behavior.

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else. Edit - looking at Settings->General->Profiles, there is one entry, which is…

Android tells you exactly what information MDM collects from your phone and exactly what restrictions have been placed on it. If your employer is collecting your browsing history, you would have known when you enabled their policy, and you can review their policy by opening the Device Policy app. https://lh3.googleusercontent.com/re65G-N_kR2HUCzd4IUjahS_7u...

Re: Don’t Put Your Work Email on Your Personal Phone

#80
post #49

Earlier quoted context omitted.

>There's not a way to track employee internet browsing history out of the box. Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage. Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying. I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort. (This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)

Not even sketchy. Monitoring how long techs take on calls is a requirement in some roles for quality assurance and training purposes. Company I worked for had GPS tracking that they used to make it show that one employee was visiting another employees wife because our home base was over street over. It was a funny prank until it wasn't.

For g suite location is under Mobile management. They list it as a find my phone type of feature. There's even a picture of it on their marketing.

Post reply on HN