4 ms·

As a counterpoint, I do recommend installing your own Supervised MDM profile onto your iOS device. This will: - prevent the installation of any other MDM profi

As a counterpoint, I do recommend installing your own Supervised MDM profile onto your iOS device. This will: - prevent the installation of any other MDM profiles (such as a work profile) - allow you to pair-lock your device, which will prevent any forensic tools from accessing your device (for instance if it gets taken by police or at a border crossing, even if you're forced to give up your password, they won't be able to image your device or do other scans). iOS security researcher (now Apple employee) Jonathan Zdziarski has a blog post on it: "Counter-Forensics: Pair-Lock Your Device with Apple’s Configurator": https://www.zdziarski.com/blog/?p=2589 https://www.zdziarski.com/blog/?p=2589

banku_brougham 9y ago
sweet tip, than you! this is the reason I read HN. queue the long nested thread of technical objections, policy objections, legal objections, objections on behalf of web publishers just trying to make it in this difficult internet and need your data to monetize, ...
lilyball 9y ago
IIRC in iOS 11 (if not earlier?) Apple changed it so forensic tools can't suck data off your phone unless you enter your password while the phone is attached to the computer. Previously if you unlocked your phone, they could then carry it off to their computer, attach it, and start vacuuming up your info. But now unless it's already attached to the computer before you unlock it, you know they can't do that.
- tinus_hn 9y ago
  You can easily be forced to enter your password while you are in the ‘constitution free zone’ though.
uselpa 9y ago
I've done this years ago and am very happy with it. However I don't recommend this to everybody (especially non-techies) since you cannot restore a backup to a different physical device, so changing your phone requires a re-installation from scratch.
matmann2001 9y ago
Is there any sort of analogue for this with Android devices?
- qmarchi 9y ago
  Mostly, many MDM providers support a system known as "Android for Work" or more genericly "Work Profile" which separates your device into two profiles and very little data passes between the two. I've been doing some testing on my end on how well the separation is using Google's "Android Enterprise" MDM which you can setup yourself (for free), then put your Employer's MDM inside a Work Profile.

banku_brougham 9y ago

sweet tip, than you! this is the reason I read HN. queue the long nested thread of technical objections, policy objections, legal objections, objections on behalf of web publishers just trying to make it in this difficult internet and need your data to monetize, ...

lilyball 9y ago

IIRC in iOS 11 (if not earlier?) Apple changed it so forensic tools can't suck data off your phone unless you enter your password while the phone is attached to the computer. Previously if you unlocked your phone, they could then carry it off to their computer, attach it, and start vacuuming up your info. But now unless it's already attached to the computer before you unlock it, you know they can't do that.

tinus_hn 9y ago
You can easily be forced to enter your password while you are in the ‘constitution free zone’ though.

uselpa 9y ago

I've done this years ago and am very happy with it. However I don't recommend this to everybody (especially non-techies) since you cannot restore a backup to a different physical device, so changing your phone requires a re-installation from scratch.

matmann2001 9y ago

Is there any sort of analogue for this with Android devices?

qmarchi 9y ago
Mostly, many MDM providers support a system known as "Android for Work" or more genericly "Work Profile" which separates your device into two profiles and very little data passes between the two. I've been doing some testing on my end on how well the separation is using Google's "Android Enterprise" MDM which you can setup yourself (for free), then put your Employer's MDM inside a Work Profile.