If they want to install anything on my phone other than apps I choose to install for my own convenience they better give me a work phone.
this post was submitted on 22 Jan 2024
650 points (94.5% liked)
People Twitter
5263 readers
1779 users here now
People tweeting stuff. We allow tweets from anyone.
RULES:
- Mark NSFW content.
- No doxxing people.
- Must be a tweet or similar
- No bullying or international politcs
- Be excellent to each other.
founded 1 year ago
MODERATORS
Exactly this. Any employer trying to put private devices into their MDM is totally unprofessional anyway… Most MDMs allow access to the GPS Data and have a remote wiping function, it would be a privacy mess for the employee AND employer.
Years ago, I worked in the IT department at a university that brought in an MDM for accessing work email on personal devices with a policy of wiping the phone if you got your unlock code wrong 3 times. I refused to use it on my personal device and told the head of the department that it was far too risky as you could accidentally do this with the phone in your pocket. He disagreed, but less than a week later, this exact thing happened to him, got his unlock wrong 3 times, phone wiped, no backup done. He still refused to change the policy even with the inconvenience it caused him. I just laughed.
One of my colleges had MDM enabled for staff and students alike. (I realize this is likely a configuration problem, rather than malice or whatever)
The number of students who, nonetheless, did it… mind boggling.
Remote wipe? Lawl fuck no. Not worth the risk that some asshole has a bad day and wipes them all for fun.
I can understand it for certain things but.. frankly there should be some sort of like.. laws? About what your employer can require of you. Sure, company phone go for it, idgaf. But if they would need to remote wipe a device, maaaaaaaybe they shouldn’t be allowed to let employees use their own. You want full control, company, you get to pay for that with another phone, phone line, etc. (extra bonus, most people won’t carry the work phone when they are off work, so they are less reachable for unpaid labor :) )
"You need to install this on your phone"
"Oh I don't have a phone"
I used to have Teams and Outlook on my phone, so I was accessible for work at almost any time. I know a lot of people think that's dumb, but I was an hourly employee so I never minded the occasional work ping after hours, since I didn't mind getting paid to reply with a few sentences from my couch. It worked out well for both me and my company.
Then they decided to make MDM mandatory on your phone to access Teams and Outlook. I declined the install and removed both apps from my phone. Now I can easily miss IMs for weeks at a time if I don't open a 2nd laptop to check them. I'm more disconnected than I've ever been, which is probably better for my mental health. I don't bill as much as I used to, but that's fine for me.
I eventually caved and installed stuff on a Pixel 1.
If they wanted a phone with security updates they would have given me one.
The solution for their use should have been standard TOTP and/or yubikey. But apparently some vendor came in with a fancy PowerPoint for their proprietary project.
load more comments
(1 replies)
We have never, and will never, integrate someone's personal phone into our infrastructure. Everyone gets a company phone. If you want to use the company phone as your personal phone, or the phone you use to cheat on your husband, that's your call. Just don't complain to me when video of you pleasuring yourself end up backed up to our cloud storage and discovered by IT when tracking down large files eating up storage. (Yes that happened.)
Yeah the whole thing is kinda dumb on both ends. From the employees perspective it's ridiculous to allow the company have any level of control over a device they own. From the company's perspective, why would you want to allow access and/or have information that's the company's property on a device the company doesn't own?
If I have a password for key company infrastructure stored on my personal phone, then the company fires me... well that seems like a problem a company would want to avoid. It could happen in any scenario, but significantly less likely if I have to turn in my company phone when my employment ends.
But hey the company saves a few bucks on buying phones and that helps the quarterly profits I guess.
That's the whole point of work profiles and company owned devices. This Joelle just has no idea what she's talking about.
You literally can't "just install an MDM" to your phone in the way that allows a company complete access to your device. Both iOS and Android require that either the device is new or the device is factory reset. Then and only then can the device have MDM enabled as a "Company Owned Device" e.g. complete access.
The other way, is through "Work Profiles", it's an isolated and sandboxed partition. The "Work side" has no access to anything on the personal side and the personal side has no access to anything on the work side. On Android the work side has its own Play Store, its own Chrome, its own apps. (In fact, if you're rooted you can hijack the work profiles feature for yourself if you want to install apps you'd rather keep isolated, like TikTok).
If I issue a wipe command to a phone with a work profile, only the work profile gets wiped and the personal side is untouched. An employer utilizing work profiles only has visibility and control within the work profile, the rest of the phone might as well not exist
Hell, Android even gives you the ability to restrict the Work Profiles to work hours so all the work apps go dormant after 5
So with MDM, the company can essentially wipe that device remotely in the case that something like that occurs. Not that it's the best option. Still think companies should just provide the hardware. But that's the protection in that case.
load more comments
(5 replies)
My previous employer was acquired and the new owner required jumping through these kinds of hoops to use company email or Teams on our phones.
As an end result, everybody stopped using those on their phones. Once the laptop lid was shut, work wouldn't be bothering you until you open it the next day. Sometimes stupid things can lead to good outcomes.
Yup, to get email on your phone my employer makes you download something or other that in the fine print says they reserve the right to wipe your phone, if necessary. I saw that and now I don't have email on my phone. It's great.
load more comments
(1 replies)
Yeah this exact scenario happened where I used to work. The only time it's an inconvenience is if we're all in person for a tech summit or something, but having the personal contacts of a few co-workers let's me check in on any plans I might have missed.
Nowadays my phone is too old to even run slack, so I'd require work to buy me a new, separate work phone anyway.
But truth be told, it's amazing being unreachable. I logged on to the work slack today Monday morning, and found out that the company had an all hands on deck show stopper bug last Friday ~1730 lol not for me it wasn't. I was walking my dog enjoying the brisk winter air, completely oblivious until I logged back on this morning to read the postmortem. 😌
If your employer expects you to access corporate resources or be available to respond / on-call out of hours, then they should issue you a corporate device to do so.
load more comments
(2 replies)
These people really don’t know how MDM solutions work.
Can you elaborate? I have simple mdm on my work phone and would like to know exactly what they see and can do
Not that I am hiding anything. It’s more curiosity at this point
Posted from my personal phone
I have a little experience with Microsoft’s intune and there are different ways to register devices. Someone feel free to correct me because I don’t feel like logging in to double check. Company owned devices have more control and can restrict apps, lock, full wipe, etc. Personal or “bring your own” devices are much less restricted. I can’t lock, wipe, or restrict apps. For the personal devices, it’s more about giving secure access to the companies resources and not really controlling the device. I work for a small business and only use this to setup access to non important documents for employees in the field so I know just enough to be dangerous.
load more comments
(8 replies)
While it has not yet been enforced, my employer has an MDM. Because I do not want to violate this policy or install something that gives my employer access to my device, I do not use my personal device for work and I do not have a work device other than my laptop.
This has given me some interesting perspectives.
- I do not need to be connected at all times.
- I can walk away.
- They pay me for work hours, not for my free time.
- I can easily disconnect every night and weekend, even emergencies in my area can wait.
Seems people think things are much more urgent than they should be or actually are.
I wish I could get my partner to see it this way.. they work in IT and manage the MDM tho, and the other person with access has been partner’s friend and colleague for over 10 years, so partner is confident it’ll all be fine.
Such a dumb mindset for someone who constantly complains of being burnt out.. like no shit you are burned out, you check work emails all day/night, and handle them regardless of time..
Which companies are requiring that employees install apps on personal devices? Feels like it should be illegal coercion if true.
Don't pay attention to this Joelle person, she has no idea what she's talking about (Or does and is spreading misinformation intentionally)
You literally can't "just install an MDM" to your phone in the way that allows a company complete access to your device. Both iOS and Android require that either the device is new or the device is factory reset. Then and only then can the device have MDM enabled as a "Company Owned Device" e.g. complete access.
The other way, is through "Work Profiles", it's an isolated and sandboxed partition. The "Work side" has no access to anything on the personal side and the personal side has no access to anything on the work side. On Android the work side has its own Play Store, its own Chrome, its own apps. (In fact, if you're rooted you can hijack work profiles for yourself if you want to install apps you'd rather keep isolated, like TikTok).
If I issue a wipe command to a phone with a work profile, only the work profile gets wiped and the personal side is untouched.
Hell, Android even gives you the ability to restrict the Work Profiles to work hours so all the work apps go dormant after 5
In fact, if you're rooted you can hijack work profiles for yourself if you want to install apps you'd rather keep isolated, like TikTok
You can use Shelter to enable this functionality without root.
load more comments
(9 replies)
load more comments
(7 replies)
It depends how the MDM is implemented. If it allows locking and wiping the entire device, no. If it makes a sandbox for the work stuff, and it only grant them access to control, lock and wipe that sandbox then I don't mind.
That's what we do for personal devices, corporate devices are fully managed/supervised.
Yeah my work MDM is setup this way with Android Enterprise. Everything work-related is isolated to that area and there is no other access to the full device. I can even have all those apps shut off after-hours or when on vacation so I don't get notifications during personal time. My boss knows to text/call me if there is something urgent that comes up.
Software is imperfect and you shouldn't trust that future updates will not add that ability.
Typically, the app needs to ask for permissions like that, though. On Android, they need to ask to become a "Device admin", and they need to specify what specifically they'll use that access for. I imagine (though I'm unsure since it's never happened to me) they need to ask to update those permissions if they want their uses to change.
load more comments
(1 replies)
load more comments
(1 replies)
You want me to check email outside of work hours …. Better provide me a phone and money for that.
load more comments
(1 replies)
This is a woefully misinformed post..
If it was a phone supplied by my employer and I used it only for work, then sure. Otherwise fuck no.
Your bosses make you do this? For me I just installed Teams and Outlook, and even that was voluntary.
Just* lol
Like I said I didn’t have to, it’s just convenient to be able to keep an eye on teams when I am slacking off yknow
load more comments
(6 replies)
If you have work stuff on your personal device, any legal proceedings against the company might mean your personal device is taken as evidence, all of the data in it will get examined and you might only get it back years later.
So even if only for legal reasons, never have company stuff in a personal device, quite independently of there being some fancy tech or other to virtually partition it.
Setting aside the issue of whether this post is overstating the risk of MDM software on a personal phone, I had a tangentially related experience that might provide a tip for anyone who's in a similar situation.
I like to have the convenience of checking my work messages and chats on my personal phone, so I have Teams and Outlook installed and using my work account.
When I first went to sign in to my work account on Outlook, I got this message like "Outlook needs to run with administrator privileges in order to provide the necessary security for this account" and shunted me off to some system settings to approve the permissions. Big nope.
So I tried Outlook Lite, and it made no such demands and works perfectly. So for anyone else who's run into this, try Outlook Lite! I hope this helps somebody.
load more comments
(4 replies)
I wouldn't do this. Sandbox sounds good, but that kind of access is just to shady to want anywhere near my device.
I've never had to download an app for work. But I wouldn't deal with an MDM at all without a gun pointed at me.
"I don't have a smartphone"
MDM when configured properly only get a specific section of your phone that's separate from your personal use section, so they don't see your apps and personal data.
Correct. Having configured one, this is laughable.
Not a chance in fucking hell I'd give my boss my phone password ..... Edit: Yes i did read the whole fucking article bold of you to assume i didn't... Ya know the old adage ass u me? Yep someone is an ass and it aint me
load more comments
(1 replies)
I’ve been using Google’s native MDM. I can’t do any of those on a personal device. The only thing I can do with a personal phone used for work is wipe the android for a work profile off of it. If you’re using a company device, I cannot do any of that. The only thing I can do is wipe the entire phone and that’s it.
100%
I used to do MDM at my last company. The post here is very misinformed on how it works.
All companies can do is wipe your phone and configure settings. They cannot read what's on the phone, except for the stuff in the work profile and even then it's limited.
I have a corporate phone with a personal and work profile set up and have no issues browsing porn. That's how confident I am.
The only risk is if you're on a regular cellular network, your company could ask the mobile network to send the sites you visit. But if you're VPNing or on your home wifi, that won't tell them much.
How does Android protect against this?
Also can you have different profiles for this? Would that require two SIM slots? I don't play around with profiles so I have no idea.
MDM admin here. I’m much more familiar with iOS, but newer versions of Android will completely sandbox work profiles from the personal side. Work stuff will be encrypted and the admins cannot access anything outside of that.
Yep. Work profile and apps are completely disparate, and it's actually kind of tough to transfer any data across the boundary even if you wanted to. Any time I need to send a picture to my work Slack I have to remind myself to use the work profile camera app.
It's the same tech that powers the Secure Folder thing in Android devices. My older S8 was on Android 8 or 9 and still had this functionality, so I'm not sure how old you'd have to go to have a less secure setup.
I think this mastodon post is inaccurate.
load more comments
(2 replies)
I don't have an exhaustive understanding of how it works and limits data, but on my android, it essentially has two partitions, one for personal and one for work. They do not share data. In order to take and share a photo on my work Teams chat, it has to be taken either from within teams or with the camera app on the work partition. It cannot access my personal gallery. I have Teams on my personal partition from an old job that I still help out from time to time, and the same exact Teams app installed on my work partition. They are not connected in any way. The only thing that doesn't require me to put in a pin to access on my work parition are the notifications.
Most of the limitations I experience from my side are in my own access to work resources. I can't say with confidence that those same limitations go both ways. But it does seem like that is probably the case.
load more comments
(1 replies)
view more: next ›