No post body was provided.
Ask HN: Should employers pay for employees' phones if 2FA apps are required?
1–10 of 70 posts
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#2The way I see it, the one who pays for the phone keeps it when both parties "part ways"
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#3I do not mind as much using my own mobile if it is a TOTP standard that I do not need to install spyware for. I have already TOTP apps that I can add QR and it's not costly or difficult.
Any kind of third party internet required app? Do I required Microsoft Authenticator or Duo - always on push access, internet required, logs my phone's IP and location? They must pay for the device and the plan. If you want me enter MDM, Outlook, ActiveSync? They must pay for the device and the plan.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#4No, I don't think it would be necessary.
2FA via TOTP does not require a phone.
2FA via SMS does not require a phone, one can utilize a VOIP service that provides SMS.
2FA via hardware token - yes it should be provided for if needed in course of employment.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#5How about providing hardware security key instead? paid by employer in this case would be common.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#6Absolutely. I had the case, that a team member had a smartphone running on Graphene OS and was not able to run the required 2FA app Microsoft Authenticator. An employer must not dictate the type of phone that an employee owns privately and cannot even enforce the use of privately owned phones or other resources, if they are needed to fulfill the work contract. So I asked the company to provide a company phone to my team member, which they did, despite having a policy not to do so.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#7Please no. 0 chance I want my phone to be controlled by some enterprise device management crap.
Employers should provide a dedicated 2fa device (maybe a phone) if the employee wants but I can't think of the security case for employers to need to control / remote wipe the 2fa device since they could lock the account it is providing access to.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#8Our organization is using Office365.
Either by accident, or just defaults getting increasingly more tight, Outlook won't connect to the account unless I allow it to be a device administrator.
On my personal phone, that's a hard no. So I'm using the PWA for the occasions I NEED to check email.
But a TOTP app of my choice, implementing a standard RFC protocol? I think that's okay, on the condition that it does not mean my phone is in scope for any regulations the company is mandated to adhere to.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#9Does anything the employer require need MDM? If so then yes, in fact they need to provide the phone in that case. Otherwise no IMHO.
Re: Ask HN: Should employers pay for employees' phones if 2FA apps are required?
#10Our organization is using Office365. Either by accident, or just defaults getting increasingly more tight, Outlook won't connect to the account unless I allow it to be a device administrator. On my personal phone, that's a hard no. So I'm using the PWA for the occasions I NEED to check email. But a TOTP app of my choice, implementing a standard RFC protocol? I think that's okay , on the condition that it does not mea…
In the past I believe this was so that if the phone was lost it could be remote wiped for security.
I agree that's a hard no for personal devices though.