Don’t Put Your Work Email on Your Personal Phone

https://onezero.medium.com/dont-put-your-work-email-on-your-personal-phone-ef7fef956c2f

by 3x3matrix • 7 years ago

350 266 7 years ago

onezero.medium.com

NSAID• 7 years ago

When you add a work email address to your phone, you’ll likely be asked to install something called a Mobile Device Management (MDM) profile. Chances are, you’ll blindly accept it. (What other choice do you have?)

I use the Nine mail/calendar app[1] to keep all that contained. It integrates nicely with the native Android apps but keeps all of the security and control options within Nine itself. It looks like they are also beta testing an iOS app but I have no experience with that version of it.

For example, if the mail account security settings require a screen lock code, Nine will require a code to access the app but this won't affect the actual phone's unlock screen.

Similarly if a data wipe request is sent from the server it will only affect Nine.

[1] https://www.9folders.com/product/

tyingq3• 7 years ago

Looks cool, but requires ActiveSync to be on. I think a lot of stodgy companies are locking that down and requiring the native Outlook app and its (as mentioned) stealthly MDM stuff.

acidburnNSA• 7 years ago

Do you know if the Android org is cool with this? Like, is there an active arms race to prevent this kind of behavior, or is it condoned?

fencepost2• 7 years ago

You beat me to it. Nine also allows easy connection to multiple Exchange accounts, has a variety of other nice features and has been around long enough to have a very solid track record.

This kind of sandboxing is one of the things third party apps like this have always been known for, going all the way back to a really old one whose name in blanking on which I believe maintained its own entirely internal calendar, files, etc. (Dataviz maybe?)

Edit: this may still be useful for some people, but the work profiles introduced in Android 5+ may make it less relevant at least for anyone at enterprise scale or otherwise using MDM through a service provider.

amerine• 7 years ago

What if you have multiple iOS devices and you MDM one of them connected to the same iCloud account, what risk exposure do I have? The same?

erinaceousjones• 7 years ago

At least if your org is on Office365 and doesn't have too restrictive policies, you can get your email over standard IMAP. There also exist some nice man-in-the-middle proxies which pretend to exchange servers that you've implemented the policies they ask for.

I've got multiple "work" (one is a volunteering role) office365 exchange accounts on my personal phone, using [https://sites.google.com/site/bikomobi/exchained](exchained). Seems to work well. I'm sure the respective IT departments would give me a stern talking to, but there is nothing in either job that is of any sensitive nature whatsoever so their blanket "ask for admin permissions on my phone" policies can get fd, frankly.

tyingq3• 7 years ago

Experiences vary. Some stodgy F500's have IMAP and ActiveSync locked down in various ways that force you to run the Outlook app.

drunken-serval2• 7 years ago

The Outlook iPhone app doesn't require MDM.

blocke• 7 years ago

Tons of places outside of F500 are doing that. At work we just disabled IMAP for almost all O365 accounts and any other method of authentication that doesn't implement our two factor authentication. The rising number of compromised accounts because the user used the same password elsewhere, apparent bruteforce attacks, etal forced the issue.

Of course MDM is not required for any of this. Worst case is on Android you're forced to use Microsoft's Outlook app.

judge2020• 7 years ago

FYI: markdown hyperlinks are not supported on HN.

jessaustin• 7 years ago

True, but at the very least the parser should stop on "]". RFC 3986 doesn't allow square brackets in URIs.

spookyuser• 7 years ago

I've also used exchained but I find that I have to constantly restart it for my emails to work.

XorNot• 7 years ago

And this is why I really want a phone which can run virtualized Android environments.

phjesusthatguy310• 7 years ago

Yes, if it's important to your company for you to be able to receive any of their communications wherever you are, they can pay for a phone plus service to give to you for that purpose. Don't let them use your personal phone for that.

blfr• 7 years ago

But I still don't want to carry two phones.

Which is why I only redirect my company phone regular voice calls to the private one when I'm out of office. If it's urgent, call. If it's not, I'll get to it when I'm in the office.

phjesusthatguy310• 7 years ago

That is totally understandable, and I hope you don't get in trouble when law enforcement comes looking for your personal device that somehow got caught up in their list of devices to look for.

scarface743• 7 years ago

If it doesn’t require an MDM profile, I have no problem putting my work email on my personal phone. I don’t want to carry around two devices.

phjesusthatguy310• 7 years ago

That is totally understandable, and I hope you don't get in trouble when law enforcement comes looking for your personal device that somehow got caught up in their list of devices to look for.

bluedino• 7 years ago

Don't work anything on your personal anything.

kryogen1c2• 7 years ago

When you add a work email address to your phone, you’ll likely be asked to install something called a Mobile Device Management (MDM) profile

...what? The Outlook app containerizes your email accout specifically so that you dont have to do this. Your company can remotely wipe your work account and only your work account.

Of course MDM gives access to your phone - thats its whole purpose.

drunken-serval2• 7 years ago

MDM gets applied if you want to access your exchange server with the default iOS apps because those apps don't have remote management built in.

If you use the Microsoft apps, you don't need to have an MDM applied because those apps handle the remote management functionality themselves.

kryogen1c2• 7 years ago

Thats kind of my point. MDM has an administrative and capital cost. The Outlook app is free for everyone and doesnt get IT involved in your personal phone.

The use-case for MDM is not to get email on personal phones - thats the right tool for the wrong job. MDM is for simplifying the deployment and management of corporate phones.

RKearney• 7 years ago

No it does not (source: iOS device user and Exchange admin).

Adding an Exchange account to an iOS device optionally allows the Exchange client to enforce password and screen lock requirements, encryption, and allow for remote device wiping.

It does not have any access to device location, data, photos, contacts, or anything else you can think of outside of device passcode, encryption, and remote wiping.

An MDM profile is a completely separate thing from Exchange. Also, unless the iOS device is supervised (which has to be done at time of setup and would require wiping the device if you want to supervise one that's already setup) you're extremely limited in what you can do and see.

evantahler• 7 years ago

Or... just use the web app to check your mail. If you want notifications, this seems like a great use for PWA.

yoz-y• 7 years ago

Depends, some companies have mail accessible only from trusted devices web app or not.

saagarjha2• 7 years ago

On Android, there are tools that help prevent IT from reaching into your phone. If it’s allowed by your admin, you can create a separate “work” profile that contains sandboxed versions of your apps to avoid blurring the line between personal and work. The work profile can then be disabled on demand and flipped back on only when you need it, providing a level of control that iOS doesn’t yet allow.

This is changing with iOS 13 and the introduction of User Enrollment, which siloes off work data and adds restrictions to what corporate IT can access.

Tepix• 7 years ago

Exactly. It's surprising that the article doesn't mention iOS 13 and user enrollment which hopefully solves the issue.

flatiron• 7 years ago

i would laugh if appleconnect/switchboard gets around that somehow.

nerdjon• 7 years ago

I don't believe I ever actually accepted this on my iPhone.

But trying to search around I can't find anything about how to actually find out. Does anyone know?

I assume Settings >> General >> Profiles, but it is empty so not sure.

travelton2• 7 years ago

If your device is enrolled in MDM, it would be listed there in Profiles. So your device is probably not enrolled in an MDM policy.

Fradow• 7 years ago

you’ll likely be asked to install something called a Mobile Device Management (MDM) profile. Chances are, you’ll blindly accept it.

Say WHAT? That's the entire premise of the article. Any sane person who have even a vague idea of what a MDM is will answer with a resounding NO.

Is there actually serious companies who ask their employees to install a MDM on their personal phone? The moment you install a MDM on a phone, that phone is no longer your own, it now belongs to the company.

eeeeeeeeeeeee• 7 years ago

A nontechnical person won’t blink an eye. Those are still sane people, they simply don’t understand the threat like we do.

Same reason that recent issue with all the Chrome extensions happens. A lot of people blindly click OK, just like we’ve been trained to do on privacy policies as well.

saagarjha2• 7 years ago

Is there actually serious companies who ask their employees to install a MDM on their personal phone?

Every company that does BYOD?

davidf5602• 7 years ago

Can confirm; the Fortune 500 company I work for has pretty extensive support for BYOD. Managers can be stodgy about providing work phones, plus carrying two devices is a pain.

I use Android so I'm relying on the Android for Work sandboxing, but truthfully I don't know the exact details of what that does and does not allow my employer to access. It does bother me, but I don't feel like I have a whole lot of choice. Being able to respond to Google Chat messages at any time (when away for lunch, for example), is feeling more and more like a requirement/expectation.

Also, commuting on the train pretty much requires mobile Hangouts support (which Google effectively makes impossible to use via a website if you're on Android), unless you want to always be at your desk in the office prior to the first meeting each day.

ceejayoz• 7 years ago

Any sane person who have even a vague idea of what a MDM is will answer with a resounding NO.

Very few people have even a vague idea of what a MDM is.

travelton2• 7 years ago

Not sure how complete this list is, but here's Google's MDM knowledge base articles: https://support.google.com/a/answer/7036693

Mobile Reports: https://support.google.com/a/answer/6072773

Device Audit: https://support.google.com/a/answer/6350074

Mobile Alerts: https://support.google.com/a/answer/3230421

Edit: Furthermore, on iOS, you can go to Settings -> General -> Device Management -> <Select MDM Profile> -> More Details -> MDM Profile. The list of rights are listed there.

antidaily• 7 years ago

Anything sketchy? I dont have Google Device Management installed.

welly• 7 years ago

I feel like most/many articles such as this are targeted at large enterprises/organisations. I've never been asked to install anything like MDM on my phone for any company I've worked for if needing to/wanting to view work email on my phone. But then I've never worked for a company who has more than around 25 members of staff.

nness• 7 years ago

Company size and industry definitely play a significant role in the roll-out of managed device policies. Some organizations are required to pass specific ISO/IEC standard certifications with regards to their security policies. Managed-devices with remote-wipe capabilities being one such requirement.

kpwags• 7 years ago

This is certainly a very good reason to not put your work account on your personal phone, but my primary reason not to is that it's my device and I pay for the service. If my company needs me to be available beyond my 9-5 workday, they can pay for it.

If there's an emergency, they can always call, but I don't like being "always on".

stilley2• 7 years ago

I recently got a new job where the email is completely locked down (only accessible on a networked computer or via the awful outlook web interface). It's been awesome not getting work emails on my phone.

allthecybers• 7 years ago

Same here. If I have to VPN in I’m less inclined to look at email outside of work.

mooreds• 7 years ago

I used to have work email and slack on my phone. While it made some things easier (heading out in the work day and not blocking people who might need my input, for example), it also made me feel tethered. Slack in particular was very addictive to me (to be fair, not just work slack, but other slacks which I was on).

When I got a new phone, I simply didn't install the email or slack clients. It's led to occasional text messages, when I really needed to communicate with a team member, but all in all has been a fantastic experience. Highly recommended.

the_watcher• 7 years ago

One of the things I miss most about my previous BigCo job was only being able access work tools via my work phone. I could go on vacation and tell my team that I wasn't taking my work phone or computer (I needed a corporate VPN installed on my work computer to access anything internal) and everyone knew I was completely unreachable.

chipperyman573• 7 years ago

Why can you only access from a networked computer or OWA? Is the desktop outlook client more privileged than OWA? (I've never used either extensively)

derefr2• 7 years ago

If there's an emergency, they can always call, but I don't like being "always on".

Personally, I choose the opposite: you need to email me to tell me you want to call me (so that I’ll turn on my softphone app), otherwise you’ll just automatically go to voicemail (which will also go to my email.)

I notice that with Gmail’s inbox categories, you only get push-notified when something lands in Primary or Updates; so as long as you’ve trained the system to push the irrelevant/lifecycle stuff into the other categories, your phone won’t ding all that often. (Mine doesn’t, and I get a good amount of raw email.)

ceph_• 7 years ago

I can't believe anyone can handle having push notifications on email. I only read my email when I go to check it. For both work and personal.

I have hundreds of rules for email filtering. With most mailing lists never hitting my inbox. But it's still way too much for individual email push notifications.

VBprogrammer2• 7 years ago

I learned that lesson after losing too many days off to some emergency or other that I spotted on my emails.

Personally I need to be able to put everything to the side when I'm out of office.

ohithereyou3• 7 years ago

losing too many days off to some emergency

How do you even lose days off to some work emergency? If I was scheduled to be on vacation but I have to come in for some emergency, I don't lose those days, and you shouldn't either, since you never actually took those days off.

mti27• 7 years ago

Exactly- if work doesn't pay, they don't get to play on my phone. I'd be willing to check work email sporadically, and it's unfortunate that doing so in any capacity means allowing an unknown admin "wipe my phone" privileges. Companies don't handle that stuff with any sort of finesse and mistakes happen. Ultimately email on a phone may be a moot point for software developers: We use more independent chat apps like Slack, no one worries about texting you, and it's hard to do anything really more involved than messaging without opening your laptop (which probably is provided by work).

lugg2• 7 years ago

Slack, on my phone? Are you nuts?

If you want me after hours you call. Thats the only option you have.

supergeek133• 7 years ago

No joke, we recently went to a BYOD model with no "assistance". I'm expected to be available 24/7 in most cases. So I'm refusing to be available until I get some compensation.

ianai• 7 years ago

Expect to be fired. That’s, unfortunately, the labor market reality.

wikibob• 7 years ago

It's a very competitive labor market. For employers.

If you are highly skilled, you are highly in demand. Therefore, demand good treatment.

Tech industry compensation has never been higher: http://levels.fyi/comp.html

Google pays for on-call hours. You are credited with 33.3% time for each hour on call if you have a 30 minute response requirement, and 66.6% time for each hour on call if you have a 5 minute response requirement. These can be taken as extra holiday, or cashed out. [0]

[0] Among other public sources: https://www.reddit.com/r/cscareerquestions/comments/41v0ol/i...

djsumdog2• 7 years ago

I'd leave. Unless you're a contractor who gets paid a lot and equipment costs are expected in that contract (similar to plumbers, carpenters, etc.) there is no reason for a full-time/salaried employ to purchase their own IT equipment. That's just insane.

crazygringo• 7 years ago

If my company needs me to be available beyond my 9-5 workday, they can pay for it.

If you're salaried then they are paying you for it based on the job requirements, it's part of the job and one of the things that separates hourly employees from salaried ones.

Unless you're talking about the cost of your cell plan or device? But even then, a lot of companies will pay for your plan and subsidize part/all of your device if they have a legitimate work reason to need to contact you and expect a fairly quick response outside the office.

EDIT: To be clear I'm referring to US law/practices. The entire point of salaried as opposed to hourly work is that it is based on performance rather than hours, and it's up to you and your employer to come to agreement on what performance means. At some companies salary might be for 40 hours, at others it's for 60 or 80 regularly. It's your own responsibility to find out before taking the job, and decide for yourself what you're willing to provide or not.

djsumdog2• 7 years ago

I worked for a University that paid cell phone plan steepens back in 2012. In Illinois, it now required by law for employers to pay cell expensive if they're required for work.

tharax• 7 years ago

No they are _not_. Salary is for 40 hours a week, +/- 5 hours depending on temporary circumstances.

Salary is not 40 hours working + 128 hours on call per week.

dancek• 7 years ago

Depends on the jurisdiction. I think there's a clear separation of work time and free time in most of Europe. Here in Finland an employee can never be forced to work over their daily working time (usually 7.5h between 8-5); doing so is always voluntary, though of course pressuring exists. For force majeure circumstances there's the legal concept of emergency work, but that's very rarely invoked.

celticmusic• 7 years ago

no.

Salary is a payment schedule, that's it. Anything else requires contractual agreement.

The fact that you think it gives companies the right to demand irregular hours is more about your mindset than reality.

CydeWeys• 7 years ago

Meanwhile, in Europe, they have employee protection laws that outright prevent these practices. If you need someone to be available outside of work hours, you need to pay them extra for it, similar to how overtime is mandated in the US for hourly workers.

Wish we had those laws here. Fortunately I work at a company where I am compensated extra for my oncall shifts that take place outside of normal work hours -- it ends up being a few extra tens of thousands of dollars per year. That should be the mandated standard though, not just for those who are lucky.

pwthornton2• 7 years ago

My company pays for my service but not my phone, so I'm in a gray area here.

vecplane• 7 years ago

Heads up, if your company is paying for your service, they can see who you're calling and texting.

I'm not saying that's unreasonable, but I've heard of employees getting caught leaking by communicating through cell plans paid for by the employer.

TimTheTinker• 7 years ago

My company pays a $75/month BYOD stipend. It's more than enough to cover the phone bill.

kinkrtyavimoodh• 7 years ago

So it would be ok if your employer paid 60 bucks a month to foot your phone bill? Be careful what you wish for.

ohithereyou3• 7 years ago

This is precisely why I make it clear that I do not want a work phone. My mobile number is published in the global address book for emergencies, but otherwise if I'm not at work then I'm not working, and I do my best to not think about work when I'm not working. Having a block of metal and plastic specifically to intrude into my free time for the benefit of my employer is not something that I am interested in.

conradfr• 7 years ago

Basically I have my Gmail work account on my phone but I'm syncing it manually, only when I want/need to consult it.

stunt• 7 years ago

Yes, I do the same for the same reason. Fetch Manually instead of default Push or Fetch.

anotherevan• 7 years ago

Mine syncs automatically, but there is no notification sound, only the visual indicator in the status bar. That works for me.

glvn• 7 years ago

The counter to this is that oftentimes I'm at work and not at my computer so I need access to my email/calendar on a mobile device. This doesn't happen often enough for me to warrant a work phone but happens often enought to where it would be a pain to always go back to my computer to pull that up.

My solution so far has been to just use the outlook web app. Sure it's not as nice as the app but it lets me get to the info I need while also preventing me from having to install any sort of profiles on my device, as an added bonus I do not allow the site to send me notifications so I do not have to worry about being bothered off-hours.

kstrauser• 7 years ago

Yeah, my last job wanted me to install their rootkit/spyware on my personal phone for the privilege of being able to check my work email at night. I resolved this by letting my manager know how to contact me after hours in the event of an absolute emergency, and that otherwise I'll check my messages at the office when I get in to work.

Pfhreak• 7 years ago

Interesting that this was just about spying, when the real reason to keep work email off your phone (imo) is to maintain work life balance. If I can access my work email on my phone, I will access my work email on my phone. Constantly. I'm bad enough with my phone and my personal email.

Everywhere I've worked I've told my manager I turn off work when I leave (unless I'm oncall). I've never had this be a concern, across three large companies.

folkrav• 7 years ago

I just use Android 7+'s work profile feature - basically a walled garden for MDM - and turn off work notifications on nights and weekends. After that it's just a matter of a tiny speck of self-control (unless you're workaholic, it's not that hard _not_ to open a work app) and I don't get annoyed by work stuff despite it being setup on my personal device.

davidf5602• 7 years ago

Having work apps on your phone is not mutually exclusive to having work/life balance though.

I have work apps on my personal device primarily for when I'm away from my desk during work hours. I disable notifications etc. outside of work hours.

I wouldn't say I'm really happy with it, but it does permit me some freedom to be away from my desk without the risk of missing something important during the day. It's a trade-off I've decided I'm willing to make.

Work also provides guest wifi which is conveniently configured by the Android for Work profile, so data usage while at the office isn't really a concern.

geocrasher• 7 years ago

A lot of my workmates have Slack installed on their phones as well, and I won't do it. I have a life, and when I'm not working, I'm busy living it. No thanks.

Kaotique• 7 years ago

Weird title. It has nothing to do with e-mail. It is the MDM that is the problem.

jofer• 7 years ago

This "stop and think" warning is very good, but let's be honest, in many roles you can't say "no" anymore. Most companies require a significant subset of employees to use their personal device for work and have corporate accounts active on it.

It may not be true for you personally, but I bet it is for most people who have on-call rotations.

Features like Android's separate profiles are critical. We need similar sandboxing on all platforms. I don't think we can change the 24/7 availability culture, but we can change things from a software side to make it less onerous.

galangalalgol• 7 years ago

my friend group works for 3 different f500s and all three hand out locked down iPhones for work use only. it's clunky, but I like it better.

cannonedhamster3• 7 years ago

A company cannot force you to use your hardware to run their business at least not without compensation. Having a phone number that can be paged is significantly different than installing MDM software that can track literally everywhere you go, wipe your phone without your permission, etc. If a company is saying you "must" install something in your personal device without any compensation on top of your regular paycheck this is incorrect. If you use your own car for work you're typically compensated with mileage or you can write it off on your taxes.

salixrosa• 7 years ago

I've often thought that if everyone, or even a majority, said "no", then we could have better policies. As it is, I've been the only person at my last two workplaces to object, and there's no way they're going to put in the effort to work with me.

So it is that I've given permission to confiscate my personal cellphone in the case of a breach. Otherwise, I literally couldn't do my job -- not because of anything particular about our field or technology, but because it was easier to set things up the way they are. We could spend a few days changing our alert structures, etc, and no-one would have to have "sensitive" data on their personal phones. But that's not going to happen for one employee.

souterrain3• 7 years ago

If your employer subscribes to an ethical model which permits them to abuse MDM, viewing your web history and tracking your location, you need to do more than remove your personal device from their control.

You must find a new employer—preferably while you make public this repulsive behavior.

alistairSH2• 7 years ago

How does one know if an employer is abusing MDM? Honest question... I have no idea. I just point my iPhone's mail app at our Outlook 365 server and that's it - I assume that installs a profile that allows them some remote access (I believe they can remote wipe the phone, but maybe not), but no idea how to tell if they're doing anything else.

Edit - looking at Settings->General->Profiles, there is one entry, which is for connecting to my Olympus camera. Nothing for the office.

souterrain3• 7 years ago

Ask. Since this often affects larger enterprises, start at the help/service desk. If that doesn't get you an answer, try Information Assurance or Information Security departments. Lastly, most large orgs have a Privacy office.

During all communications, make it clear what your concerns are; perhaps even link to articles like this one.

Corporations that care about customer and employee privacy will take such inquiries seriously.

blaird• 7 years ago

I worked at a security startup where installing Slack/email on our personal phones (BYOD policy) was possible via an MDM (but was optional, we weren't forced). I don't know every detail, but many of our engineers were naturally spooked and did lots of checking to make sure no packets flowed to the VPN from apps not within the MDMs control (just slack and mail).

I personally was fine with this as I don't want to carry two devices, I like being able to check in via Slack (especially if I was on call), and we had several folks who had our security/IT team under a lot of scrutiny proving this wasn't overly invasive.

It helped that we were a small startup, so our IT and security teams were 20 feet away :)

Aeolun2• 7 years ago

If you installed MDM, it’s probably been fairly clear. The iOS warning is kind of scary as I remember.

Also found under Settings -> General -> Device Management.

cannonedhamster3• 7 years ago

Generally MDM software swallows up everything. It's been a while since I managed an MDM instance but we could track everywhere the employee went by default and when I suggested we turn it off there wasn't an option nor did management want to. We could see every app pretty much everything on the device. I will never install MDM on my phone after managing it. I've also seen phones accidentally wiped. Back up your phones.

discordance• 7 years ago

If you don't have a profile there your device is not managed and they can't do what the article talks about.

lukeschlather• 7 years ago

Anyone with admin access to Outlook 365 can do this stuff. Even in a large company that could mean a surprising group of people able to do this sort of spying with no technical restrictions to enforce policy (assuming there is an explicit policy, which in a smaller company is not a given.)

lern_too_spel• 7 years ago

Android tells you exactly what information MDM collects from your phone and exactly what restrictions have been placed on it. If your employer is collecting your browsing history, you would have known when you enabled their policy, and you can review their policy by opening the Device Policy app. https://lh3.googleusercontent.com/re65G-N_kR2HUCzd4IUjahS_7u...

ptero2• 7 years ago

This generally is a reasonable advice, but companies change policies. Even if MDM policy today sounds benign (although IT departments make mistakes, too) it can morph into something much more invasive in the near future, "because cyber". MDM on my personal phone is the line I personally would not cross. My 2c.

bronco21016• 7 years ago

My employer and I are bound by a working agreement negotiated through my union. The contract has privacy protections for many different types of personal information and data that could potentially be accessed or collected by the company. Think location data, data at rest on both personal and company devices, and network traffic.

Here’s the big issue I still have even with all of these ‘legal’ protections. The definitions are not highly technical and thus open to interpretation. Also, to my knowledge none of the clauses have been tested in the real world. How in the world am I supposed to feel secure that a legal agreement stops them from doing what is still technically possible? Even if they can’t use the data collected against me as admissible evidence in a disciplinary action what’s to stop them from collecting data anyway and then if they find something they don’t like they harass me in other ways?

The issue is in MDM systems. Until we design them in a way preventing access to certain classes of information through technical means then no type of agreement or ethical code is safe. The device must be treated as hostile. We can’t simply rely on ‘ethics’ because, as we’ve seen play out time after time in America, corporations lose no sleep over saying one thing and doing another.

closeparen• 7 years ago

I declined corporate MDM on my personal phone. I’m confident that abuse of my data would be against policy, but I don’t feel like taking the risk that our technical controls can or will guarantee adherence to policy. At the end of the day, whatever agreements are in place, someone has access.

I’ll take that kind of risk with i.e. Google employees and my Google searches, because it’s fundamentally necessary to provide me good search. There is just no reason to do it with my corporate security team and personal SMS.

odyssey7• 7 years ago

Agreed. MDM usually gets set up when you're a new hire and may not know what the organization is really like yet. Additional note: it's a shame Glassdoor is so easy for employers to game.

cj3• 7 years ago

Our company uses G Suite's Advanced MDM on a G Suite Enterprise account. I administer its configuration.

Unless I'm missing something, there's not an obvious way to "spy" on employees, which this article is claiming. Perhaps it's possible, but if it is, it would require a lot of deliberate effort to accomplish. For example, there's not an out of the box way to track employee location. There's not a way to track employee internet browsing history out of the box.

TLDR: using G Suite Advanced MDM, there are not out of the box solutions for tracking or spying on employees in the ways suggested in the article. It might be technically possible, but to accomplish it, your company would need to make a (large) deliberate effort to do this.

helen___keller2• 7 years ago

There's not a way to track employee internet browsing history out of the box.

Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage.

Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

cj3• 7 years ago

Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying.

I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort.

(This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)

avh02• 7 years ago

If I remember correctly, even the isolated work profile can add certificates on android. Probably the only reason I don't use that either.

mathie25• 7 years ago

Same, we use gsuite MDM for BYOD just to ensure that personnel's devices have basic security configurations (e.g. encryption, lock screen, etc.) Beyond that, this MDM is quite limited to what's possible to accomplish.

xorcist• 7 years ago

Being able to push software installs is a pretty basic feature of MDMs. Is that not the case with G Suite?

ptero2• 7 years ago

TLDR: "do not put work email on personal phone, as the company may ask you to install mobile device management (MDM) to manage your device, which gives them opportunity to spy / control".

This conflates two different things: work email and MDM on personal phone. While I would never install company MDM on my personal phone, many organizations allow you to access work email from personal phone, no MDM strings attached. My 2c.

pmlnr• 7 years ago

This is not about work email, this is about MDM software. The title is confusing.

carlob• 7 years ago

There are a lot of companies that require you to enable MDM before you can setup an email account, I've seen it on android back in the day when I had a smartphone.

FWIW when that happened I just started using the cruddy web interface.

bootsz• 7 years ago

While I sympathize with the privacy concerns, carrying two phones around is pretty much a dealbreaker for me.

cascom• 7 years ago

It can be annoying sometimes, but honestly it can also be pretty cathartic to leave your work phone behind when you go for a bike ride, or out to dinner with friends etc.

Havoc• 7 years ago

Our IT policy is pretty broad and obnoxious so i just carry two phones. Couldn’t be arsed to try and keep things separately with policy and software.

Communitivity• 7 years ago

I had to deal with this a number of years ago, and my response was "If you want MDM on the device to enable mail, then you buy me a separate device. Otherwise, I will access mail when I am at my corporate laptop or on the web via VPN." Never let them MDM your personal device, because they will possibly auto-wipe your phone if something proprietary or secret leaks out via email and you are on the distro.

ok_coo• 7 years ago

At my current org, it was hinted to us that if we tied (email forwards, etc.) or added any work account to a personal device, that the personal accounts and device could be subject to audits.

Don't mix your work and personal stuff. Keep it separate, keep it safe.

robben1234• 7 years ago

I'm a remote contractor. Usually, if my customer wants me to install some tracking software (recording you're present in front of PC, tracking mouse/keyboard activity, etc) I agree only on one term: they need to send me a machine with this software so I can use it while doing work. I lose customers this way, though most of the time people agree to not have this kind of software involved instead of rejecting offer altogether.

If I worked in an office environment and company wanted me to use tracking software I'd see no problems with it. But it should be installed on a company provided phone. Which in the best case I'd leave at office off work, or in other cases - carry home and store it there.

Double_a_922• 7 years ago

If I worked in an office environment and company wanted me to use tracking software I'd see no problems with it.

* Lack of trust that is uncalled for, especially if you are in a position with responsability anyway.

* Unappropriate tracking method for a creative work

Are two points that I see.

flurdy• 7 years ago

Tracking software?! I often have remote contracts and have never been suggested to install any presence or keyboard activity trackers. Sounds horrible. You are a professional, not a teenager.

I think that would be such a red flag for me of how everything else is at that client that I would never agree to the contract in the first place.

Since most of my clients allow BYOD I sometimes get asked to ensure I have antivirus etc installed. Which is ok as long as they don't dictate which software. So far that has been fine for all clients.

I have some clients that insist on a locked-down laptop to access some parts of their network, and they happily send me one that I use it for mostly email only. Having tracking software on it would be pointless as it would only show 5 minutes of email checking activity every 2-3 hours.

Unless by tracking you mean webcam and slack status? That seems acceptable to me. And as I mostly encourage(insist) that my teams use webcams when they are remote pairing etc it would be hypocritical of me to say otherwise.

bklyn11201• 7 years ago

Upwork is a giant freelancer market. They pitch their tracking software as protection for both sides: proof of work.

https://www.upwork.com/hiring/for-freelancers/using-the-upwo...

sgt• 7 years ago

That's crazy. What kind of companies are these, or rather; what kind of country is this? North Korea?

Aeolun2• 7 years ago

I did the opposite. Put all my personal stuff on my work phone. No way am I going to carry around two of those bulky monsters. The only bad part is that a bunch of my online identities are now directly coupled to work, unless I can convince them to let me keep the phone if I ever leave.

what-the-grump• 7 years ago

Dont put your work email on your phone, because it comes a discovery item in court including all your texts, emails, etc. MDM aside.

y04nn• 7 years ago

I've seen the same thing with Chrome. If you log into Gmail it automatically link the browser with the corporate account for all Google services. And if you go on the settings page (chrome://settings/) it shows "Your Browser is Managed by Your Organization". This allow the manager to automatically install extensions, filter websites... I removed the auto managed browser while being connected and it wasn't an easy task unfortunately.

Uptrenda• 7 years ago

If you have a recent Samsung phone there is a feature called 'Knox' that splits off your personal files from the work-related stuff. Knox is like a secure container that's fully isolated from the rest of the phone -- like a phone within a phone. Knox cannot access your personal files so the assertion that it can 'wipe your data' or spy on you would be incorrect (it only works with the container.)

What the article mentions about tracking is a legit concern though, IMO. Within a container it's still possible to access the GPS sensors. I'm not sure if the user can block this / opt-out? It's possible that an app may have to request permissions to use the GPS. In any case, I would say the situation is still better and more transparent on Samsung devices than this article would imply. I don't know about other devices but I can tell you Apple phones don't yet have an equivalent secure container solution (like Knox or Enclaves) so I'd be more concerned about the security situation on those devices.

lgunsch• 7 years ago

This is true of Android work profiles too. The MDM solutions I've seen use Android work profiles underneath, so your never in risk of your work accessing personal photos or data. The work profile and all work apps are in the septate container.

timwis• 7 years ago

I'm surprised it's not more common for phones to support two sims and have an almost dual boot like separation of them (more like desktop computers having multiple user accounts)

Double_a_922• 7 years ago

My boss had his phone completely wiped because his kids tried to unlock it a couple of times. Apparently we had that behaviour programmed as a company policy...

jimmaswell• 7 years ago

Seems like I have Company Portal installed but it's not activated, and the permissions don't mention being able to look at browsing history. Just "Erase all data", "Monitor unlock attempts" and some things like that. Some lesser things on "Outlook Device Policy" which is also not activated. PingID, Outlook, and Amazon Workspaces are on here.

ggregoire• 7 years ago

Anyway, you probably don't have a role in your organization that requires you to check your work emails outside of the office.

dkersten• 7 years ago

Why anyone would allow an employer to install MDM software on their personal device is beyond me.

S_A_P• 7 years ago

Good advice for many reasons, but unless you let your company root your device, they cant track you and your behavior.

jshowa3• 7 years ago

I don't put it in my phone because it gives the company an out to turn your phone into an IT BYOD asset. This makes it subject to a wipe if you ever left the company.

carrja99• 7 years ago

While you're at it, leave slack off your personal phone too.

kemiller20025• 7 years ago

Funny story (well OK, not so funny), I worked at a company where the FBI decided to pay a visit and investigate some potential naughtiness performed by members of the senior staff. They asked questions such as "Do you use your cell phone and personal email for company matters." Guess what a lot of them said, "Yep, have to." That immediately made their personal equipment, etc. in scope for the investigation and they confiscated it. Interestingly enough, any crime discovered while in pursuit of another crime can also be prosecuted. (Guess how they leverage people to flip.)

After hearing about that, I never attach anything work related to my personal equipment. There is too much liability. Anytime that anyone even whispers about me using anything I own for company use, the answer is a resounding "No." You honestly, don't know who you are really working with/for and what they are actually like.

eschneider• 7 years ago

Nothing focuses the mind on sensible email retention policies like working at a company where all the email got subpoenaed.

twic2• 7 years ago

And since discovery processes are often leaky, pPart of the onboarding at my company is the lesson that you shouldn't write anything in an email that you wouldn't be happy to have splashed all over the Wall Street Journal.

So, for example, we try to choose names for applications that aren't going to give people the wrong idea, eg don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderManager.

OrangeMango• 7 years ago

If you use your home computer to RDP into your work computer, what would be the correct answer to the question? The "work" occurs on the company-owned computer, but you are typing on the keyboard of your personally-owned computer.

ghostbrainalpha2• 7 years ago

That's a good question. But as long as you don't save any files on your personal computer, it is just a transport device like a car that gets you to work.

I'm guessing the law isn't that forward thinking though. Maybe I should keep a <$200 mini-PC, just to RDP into work so I have no problem giving up that machine.

qrbLPHiKpiux• 7 years ago

Logically, to me, it doesn't count. But lawyers and courts have a real twisted sense of logic and will indict their way around this to get your data off of your personal device.

kevinmgranger• 7 years ago

The correct answer is whatever your lawyer says.

tolstoshev• 7 years ago

"I plead the fifth" or "I'd like a lawyer" or silence.

Spooky23• 7 years ago

The details of what you claim to do, are irrelevant -- you can produce work product on the personal computer (ie. writing down a note in textedit, etc)

Thriptic• 7 years ago

I am not a lawyer, but from what I understand from a forensics class I took, personal devices can be in scope in the US if:

* A warning banner is displayed when you connect to the VPN / network / asset that states that use of the resource voids your expectation of privacy, you consent to monitoring, and you acknowledge they can inspect personal devices etc

* You signed a policy document acknowledging that they can monitor you and that connecting to a company resource brings your personal device in scope of monitoring and seizure

* You committed a crime, the police become involved, and a search warrant is issued.

If you do not sign such a policy document, they do not have evidence of a criminal (ie not civil) infraction, and they do not display a warning banner, then you can claim reasonable expectation of privacy (meaning you were ignorant of their policy), refuse a search, and there isn't much they can do to my knowledge. In this specific case you would have to talk to a lawyer, but I would just be safe and use only work assets for work.

bhandziuk• 7 years ago

Is this only true for using some company provided app or even a dedicated email app? What about just going to webmail on a browser on a phone? Does that have the same implication?

colechristensen2• 7 years ago

This is true for any work interaction on your personal device. You aren't going to win arguing technicalities with someone executing a search warrant.

The only safe and sane thing to do is refuse to have any work touch devices you own, and likewise don't let any of your personal affairs touch work systems.

mpeg• 7 years ago

And that's why you don't talk to police; they could have just said no or refused to answer to make it harder for the investigators.

colechristensen2• 7 years ago

If the FBI comes in your office with a warrant and you refuse to speak I'm guessing they'll be taking your phone anyway and/or arresting you. Making things harder for investigators often means making things harder for yourself too. Winning an argument about your personal device's admissibility in court six months later isn't really winning is it?

Railsify2• 7 years ago

"...don't know who you are really working with..." this resonates with me, I recently left a company of finding out that the recently hired VP was the Presidents favorite bar tender, he was also trying to coax her into a relationship. The VP had also backdated her resume and was claiming to have been at the company about 4 years prior to her actual arrival.

ChuckMcM2• 7 years ago

The back dating no doubt matched a back dated stock option grant that would allow her to claim that she was fully vested.

That is just fraud and the board of directors should be all over it (they would have visibility into the hiring of executive staff). Now if the company has no board, or the board is composed entirely of founders, this sort of stuff slides by. Best to avoid working in the future with anyone associated with the senior staff in future companies.

thisisit• 7 years ago

Recently my employer has pushed for Okta Identity management. And somewhere in that plan they somehow thought appropriating employee personal phones was a good idea. Now we can't login to certain internal apps without a mobile device because Okta needs one time password/accepting push notification. And the otp/push notification should necessarily happen on a mobile device. Given that company hasn't provided any mobile devices to employees, everyone is forced to use their personal phones.

Any ideas on what happens in such cases?

benburleson• 7 years ago

Respond that you have no mobile phone to use for this notification.

harlanji• 7 years ago

I ask for a phone if my duty requires it. If they won't provide it then they don't want the job done very badly and if they fire you then unemployment should cover it. Each granted claim increases their unemployment insurance premium if I understand correctly, so there is some disincentive to just fire you--it's probably cheaper to get the phone. (This is in California, SF Bay Area).

nesky• 7 years ago

My company recently required the use of a specific 2FA app that I didn't use in order to validate credentials on our laptops when accessing our VPN. I don't personally like having to put an app on my phone however, using an app to validate identity and using an app too conduct business are two very different things. I'm still considering requesting a physical token though...

ben7799• 7 years ago

We use Okta where I work but we are allowed to install Okta Verify without installing the MDM profile.

If we want to do work email on our phone, we do have to submit to MDM. 99% of the employees I know refused to allow MDM on their personal phone, and the company was OK with that. They made a few managers carry work issued 2nd phones.

We also use Slack and are allowed to use that without MDM so that works for a lot of us.

My wife has to carry a 2nd phone for work, she's got 2 iPhones and it's very annoying, but preserves the separation.

uvesten• 7 years ago

For this specific case, you can actually use other otp apps such as Google Authenticator with okta. See https://help.okta.com/en/prod/Content/Topics/Security/MFA.ht... You'll also have to unselect push notifications somewhere, don't remember exactly where, but it was apparent in the ui.

wtmt2• 7 years ago

Can't you ask for a key fob OTP code generator device? Employees who work at sensitive client sites in many cases wouldn't be allowed to connect their phones to the Internet and may have restrictions placed on the usage of it. A separate hardware key generator (which is really a second factor) could possibly help (depending on the situation and need).

jammygit• 7 years ago

Authy as a chrome extension?

joering25• 7 years ago

After hearing about that, I never attach anything work related to my personal equipment. There is too much liability.

Wait, didn't you just softly admit to some (any?) wrongdoing?

ComputerGuru• 7 years ago

Not even remotely. It’s good legal sensibility to avoid opening yourself up to unnecessary liability and investigation.

kemiller20025• 7 years ago

The simple truth is, everyone breaks the law. I don't mean willingly, there are tons of laws that exist that even well versed attorneys are not aware of. You accidentally downloaded a song you didn't pay for? We'll that's a criminal wrong doing. You did it over the internet? Somehow we'll tack on a wire fraud charge while we're at it, because we're sure we can convince a grand jury to at least allow us to try you. Now you're looking at a massive fine, and say 5-10 years. Sure you don't want to help us? By the way, if you've never been on the other end of an FBI agent interrogation, it's scary. Like really scary. I had a friend once show me briefly what it's like, and I never want to come near that again.

Here's the thing about lawsuits, even if you're innocent, you're still probably ruined. It's not like on T.V., lawsuits take years, even criminal ones. If you encounter a law enforcement agent (say a prosecutor), that wants to make a career off of something you're involved in, you're screwed. At best, you'll probably be bankrupt and emotionally destroyed. Imagine this, they bring charges against you, and if you get a public intoxication, or heaven forbid a DUI, you go to jail for the next 3 years while awaiting trial and for something that you might not have even committed. Don't believe me, read a case document on conditions of release. They list off a ton of things that can send you back to jail while awaiting trial.

jaclaz• 7 years ago

Hmmm, I don't think, if the allegations/accusations were "serious enough" that if (actually having never used the personal devices for work) someone had replied "No, never" they would have taken your word as good, i.e. they would have probably said "OK, now let's check if that is true" and confiscated the devices as well.

Please also understand that when you say "No, never" to a FBI agent, you myst be pretty sure that it is accurate, as if they (still hypothetically) find even a single interaction they could accuse you to lying to a government officer.

Anyway, yours is the right approach, never, and I mean never mix personal with work relatd activities.

X6S1x6Okd1st• 7 years ago

This appears to be why you shouldn't put an MDM on your phone.

I have my work slack and email on my phone, just with notifications turned off on both. There was nothing about installing an MDM.

languagehacker• 7 years ago

This headline's a little sensationalist. There are a lot of workplaces that don't use MDM.

Don't put your employer's MDM on your own phone. Make them buy you a work phone.

phnofive• 7 years ago

The title is misleading; MDM should not be equivocated with “work email”.

anoncow• 7 years ago

I have two phones. My work email is installed on my work phone. My personal phone doesn’t get used much. Sometimes I leave it at home.

mywacaday• 7 years ago

Sneaky medium, I used to have a paid account and the page looked like I couldn't read the article until i resumed the paid membership. Signed out and clicked on the link again and was able to read the article. Account deleted!

HankB99• 7 years ago

How many companies provide a company phone and allow the employee to use it for personal stuff? I thought that was the norm. I would question any company that expected me to provide my own phone to perform their tasks. Of course if they paid me enough, this would be negotiable.

Regardless, if I installed their remote monitoring S/W on my phone or used their phone, I would abandon any expectation of privacy on that device.

tristor• 7 years ago

I work from home/remotely. For years I've followed a simple policy. I don't use work devices for personal use, and I don't connect my personal devices to any work accounts. I've never had an employer that's had a problem with this, and the most I've ever heard is comments about how I'm just inconveniencing myself because I carry two phones, two laptops. But the reality is, it's been extremely beneficial when I've had to work in compliance sensitive companies for exactly the reasons listed here and then some, and it's a minor inconvenience.

If you're a tech worker you can afford to buy your own personal equipment for personal use. If the company needs you to have equipment to do work, they can purchase it for you. Simple as that.

shalmanese• 7 years ago

I love having a work laptop that only has work on it but I've never been able to have a personal laptop that doesn't eventually get all the work stuff onto it at some point.

What do you do if you're lying in bed watching a movie when you remember that you need to schedule a meeting with X for tomorrow at 11am? Do you get out of your warm bed and pull out your work laptop and add the calendar entry and then climb back into bed or do you just pause the movie, log in to your work calendar and make the entry real quick before resuming the movie?

The closest I've ever had to making this a reality was when my work computer was an iMac so I'd just leave it on 24/7 and RDP into it from home (I lived within WiFi distance of the office so all this was done via LAN). Even then, when the work stuff was going to take more than ~5 minutes, I'd still end up doing it natively from my home computer rather than deal with RDP lag.

edit: I also really struggle with what IM programs to keep on my work laptop these days. Medium of communication doesn't map cleanly onto work/personal contacts so I either deal with friends pinging me while at work or missing vital messages from people expecting a business response/having long professional conversations using a phone keyboard.

stevenwliao• 7 years ago

What do you do if you're lying in bed watching a movie when you remember that you need to schedule a meeting with X for tomorrow at 11am?

Carry your work phone to bed and use the calendar app.

ohithereyou3• 7 years ago

What do you do if you're lying in bed watching a movie when you remember that you need to schedule a meeting with X for tomorrow at 11am?

I schedule it when I get in the office at 8 AM.

I also really struggle with what IM programs to keep on my work laptop these days. Medium of communication doesn't map cleanly onto work/personal contacts so I either deal with friends pinging me while at work or missing vital messages from people expecting a business response/having long professional conversations using a phone keyboard.

My advice is to separate your work and friend accounts. You can have whatever messengers you need for work on your work laptop, but make sure that none of your accounts you share with friends are logged in on that machine. Same for your personal machines - only log in the accounts for friends. Then you don't have that problem.

In most cases, all you need is an email address to make a new account, and you can slowly move all of your friends over to this new account where friends and work do not overlap.

RHSeeger• 7 years ago

When you add a work email address to your phone, you’ll likely be asked to install something called a Mobile Device Management (MDM) profile.

My wife was asked to do this, and (and a discussion with me explaining what that means) she told them they could buy her a phone if they wanted that.

The company I work for does not require it, and I agree to have email and slack on my phone. They don't reach out to me on off hours unless there's a very good reason.

_bxg1• 7 years ago

I only have my work Slack, not email, on my phone because of this.

Something I've wondered: why do they only do this for native email? Why can I use Slack without it? In college even our student email accounts had MDM (which was pretty silly), but I worked around it by just viewing my email in the web browser. Are locally-stored emails somehow more vulnerable than my browser cache and the messages stored in the Slack app, or are those just loopholes?

giobox• 7 years ago

Remember 10 years ago when people were predicting/building technology to let our phones run multiple "virtual" phone instances on a hypervisor, solving the work phone/play phone single device dilemma?

I'd still freaking love this feature ten years later. I don't want app level segregation of work and play, I want them in entirely different "instances" of my phone.

https://arstechnica.com/information-technology/2011/09/samsu...
https://virtualizationreview.com/articles/2009/01/01/the-nex...
https://gizmodo.com/vmware-for-mobile-devices-lets-you-run-w...

fghtr• 7 years ago

I guess you just need a GNU/Linux phone for that. Librem 5 is the hope.

deftnerd• 7 years ago

I wish that there was some movement on that feature as well, but with time new possible implementations have become available on desktop environments that I would like see extended to mobile.

Application Streaming [1] is getting pretty solid, and I would love to see an integrated mobile solution for that.

It would be a good way to have the easy access to applications, but keep the code, manage the security, and keep the data on the server.

It wouldn't allow access to data when offline, but I think that's actually a benefit when it comes to security. It could also be used by corporations to quickly secure lost devices since there would be no cached data, as well as lock down access at certain places such as when crossing the US border or when employees are on vacation (in other countries, especially). [1] https://en.wikipedia.org/wiki/Application_streaming

Izkata2• 7 years ago

Android has supported multiple independent user profiles for a few years now, including an ad-hoc Guest one that erases stuff when no longer used.

drcube• 7 years ago

I've had a couple employers offer to transfer my personal number to my work-provided cell phone. I said no thanks, and carried two phones around instead. But it was a surprisingly popular option among my coworkers. They'd rather let their boss own their personal, everyday smartphone than carry around two phones.

neilv• 7 years ago

Thinking ahead to the next time I need it (I haven't tested this), I was looking into current respectful options for people who are on-call in some way.

Considerations included not interrupting personal time or reminding people of work unnecessarily, location privacy, certainly not doing MDM of personal devices, security simplicity, etc.

The most interesting option was the old-school one-way radio alpha/numeric pager. It turns out that the Boston hospitals still use these heavily, as do some EMTs, and they're considered much more reliable than cellular- and WiFi-connected smartphones.

I'm imagining people on-call have their pager on, and it's only used for emergencies. There would be a couple/few numeric codes for the few different appropriate possibilities of importance/urgency/nature/modality, and what you should do. The most usual code might mean get on email/chat ASAP. Another code might mean phone devops ASAP. Code "666" apocalypse might mean call a car service immediately, get on phone/email/chat while you wait, don't delay to groom or anything.

As a matter of culture, all of the codes are worth bothering someone in their personal time. For example, maybe there's no code for "hey, if you have a second, it would save me half an hour if...". (Of course, we have to not raise the importance/urgency bar too much, or people might end up staying on chat or something, because the pager's bar is higher than their own.)

twic2• 7 years ago

When my company wanted to issue me with a work phone, i looked for the most pager-like thing around. The only reason i would ever use it is to receive alerts when i'm on call, and to do 2FA to connect my laptop to the VPN, so i would like it to have small size, long battery life, and a loud speaker. I couldn't find anything at all like that.

algaeontoast• 7 years ago

This should also apply for work slack.

At this point, especially if I’m working at a company that isn’t a startup, I will not work somewhere that expects me to have slack available at “all times”. After hours if I’m not on call I simply do not respond.

For this reason I’ll never do dev ops work haha

lixtra• 7 years ago

One option is to use Blackberry Work[1] which gives your it department just control over an encrypted container, not the whole phone.

[1] https://www.blackberry.com/us/en/forms/campaigns/q2_19/byo

marssaxman• 7 years ago

Well, yeah. Was this not obvious? Are people actually doing this?

If an employer wants me to be reachable by phone they can give me a work phone. Why would I voluntarily turn my personal phone into a work phone?

jonny789• 7 years ago

Similar could be the case, when an office gmail account is used by a number of employees for viewing & replying official emails.

One employee who is logged in using office gmail in his/her android phone. The person (other employee) knowing the password can easily view most of the phone activity by visiting https://activity.google.com (which includes search history with location).

daveslash• 7 years ago

I actually gave up my smart phone a year ago. I've been with a feature phone (Nokia 3310) for a full year now. My position at work is this: "Given that I'm at my workstation 85% of my day, if I'm important enough to need to check e-mail 'on the go' or outside of work, I'm important enough for the company to get me a second phone - one dedicated to work and work only."

mortenjorck• 7 years ago

Maybe I have never worked a corporate-enough job to see this, but at all the tech companies I’ve worked at, the idea of requiring an MDM profile on your personal phone to access work email would be more or less unthinkable. I’ve known engineers to balk at installing a simple, no-permissions-required multi-factor authentication client; I can only imagine the revolt that would ensue were they asked to consent to remote management.

rconti• 7 years ago

Or, you could check to see if any of this applies to you, rather than panicking. Blogpost would have been helpful had it provided more detail:

https://support.apple.com/en-us/HT202837

tgsovlerkhgsel• 7 years ago

Misleading title. Should be "Don't put your work's MDM on your personal phone".

wtmt2• 7 years ago

These tools often allow administrators to pry into how the phone is used as well, retrieving call logs, SMS history, and in the most extreme cases, full logs of web browsing.

I doubt any of these (call logs, SMS, web history) are possible on iOS even with an MDM profile installed, unless it's call logs from the company's own VoIP app or web history from its own browser app. SMS? Nope. On Android all these are possible for any app that's given the permissions, even without MDM.

Can anyone who knows more validate or confirm the veracity of this claim in the article?

burnte• 7 years ago

When I came in to my current company last year, the only way to get work email was by enrolling your phone in our "company portal" which was based on MS's Intune, part of their 365 offering, which by the way is horrible. There was no IT director and the lawyer and CFO who drove the plan had draconian rules, so bad that only a few people ever enrolled, and those who did regretted it, as their phones would be wiped several times as unqualified people "poked around" in the system. Exchange and outlook alone can handle email data safely with remote wipe of company data without total MDM and device 0wnership. I changed to that immediately, and in the past year we've needed to wipe only two people's phones, and it went without a hitch. MD is a tool that frequently is more than required for the situation.

Don’t Put Your Work Email on Your Personal Phone

Related Stories