3 ms·

> (Nobody at my office should have more than "P. McKenzie" and my phone number saved on their phone. Including full name, email address, a photo, my address, an

by wwortiz 16y ago

> (Nobody at my office should have more than "P. McKenzie" and my phone number saved on their phone. Including full name, email address, a photo, my address, and the like would give me a cause of action against the company if the phone was ever lost or if that information were misused.) That really can give you cause of action against a company? In a similar matter what if I had all of that information on my personal phone, am I correct in assuming that it shouldn't give you the right to sue if that information were released. (As it assumes you either gave me that information, or it was obtained through you in some way) And in the case of the email attachment, if you are sending radioactively sensitive customer data in any way through email isn't that the real problem and not that the phone could get out.

tptacek 16y ago
No, that's not the real problem. The transmission of sensitive information through corporate email is commonplace. Formally-classified protected information like HIPAA PI or payment card data shouldn't, of course, be emailed, but information that can be traced back to PI is sent routinely. Regardless of whether it should or shouldn't happen, IT controls people have to assume it will. The contract for syncing with a corporate Exchange server, in many places, simply requires you to allow your phone to be wiped. If you don't like it, don't sync with your company's Exchange server. What's so hard about that?
- hoop 16y ago
  > The contract for syncing with a corporate Exchange server, in many places, simply requires you to allow your phone to be wiped. > If you don't like it, don't sync with your company's Exchange server. What's so hard about that? The problem that the posts points out is that there's no warning about this "contract" whatsoever. No matter what mobile device I've ever used, I have never, ever had a dialog tell me that by syncing my phone with an Exchange server I'm letting my company's IT department hold my personal information by the balls. Additionally, we're talking about a lack of separation between two entities' data (personal & company-owned data). If I had a user access clause for my website, "by accessing content on this website I am granted full access to indiscriminately wipe any and all data on your device, belonging to me or not" and was given the capability to do it - that would be ludicrous. The only difference I see is that I'm not in an employer relationship with my users. Even still, an employer-employee relationship with a company does not grant them the right to delete any and all data on any device of mine. Also, since we're in HN (startup city, what?) who has ever worked for a startup that DISCOURAGED working from home on a personal laptop or having access to email 24x7? I've certainly never worked for one.
  - tptacek 16y ago
    We simply disallow people working on company projects with personal equipment. If I drank enough rye to kill the requisite number of brain cells required for me to allow people to sync their personal gear with our IT, I'd definitely tell people "we will be nuking your gear from orbit periodically as a precautionary measure".
  - yummyfajitas 16y ago
    Also, since we're in HN (startup city, what?) who has ever worked for a startup that DISCOURAGED working from home on a personal laptop or having access to email 24x7? The policy where I work is: linux laptop (I imagine BSD might also be ok), access to code is via sshfs (or TRAMP) only. I don't think this is that unusual.
  - bruceboughton 16y ago
    >> Additionally, we're talking about a lack of separation between two entities' data (personal & company-owned data). Yes, but this lack of separation is caused by the employee choosing to sync their work email with their personal device. Unless the employer requires this, then it's entirely the employees fault.
  - runjake 16y ago
    > The problem that the posts points out is that there's no warning about this "contract" whatsoever. But the post wrongly blames Microsoft and Exchange, when it's the person's workplace he should be blaming for supposedly not having clear enough policies.

by wwortiz 16y ago

tptacek 16y ago

No, that's not the real problem. The transmission of sensitive information through corporate email is commonplace. Formally-classified protected information like HIPAA PI or payment card data shouldn't, of course, be emailed, but information that can be traced back to PI is sent routinely. Regardless of whether it should or shouldn't happen, IT controls people have to assume it will. The contract for syncing with a corporate Exchange server, in many places, simply requires you to allow your phone to be wiped. If you don't like it, don't sync with your company's Exchange server. What's so hard about that?

hoop 16y ago
> The contract for syncing with a corporate Exchange server, in many places, simply requires you to allow your phone to be wiped. > If you don't like it, don't sync with your company's Exchange server. What's so hard about that? The problem that the posts points out is that there's no warning about this "contract" whatsoever. No matter what mobile device I've ever used, I have never, ever had a dialog tell me that by syncing my phone with an Exchange server I'm letting my company's IT department hold my personal information by the balls. Additionally, we're talking about a lack of separation between two entities' data (personal & company-owned data). If I had a user access clause for my website, "by accessing content on this website I am granted full access to indiscriminately wipe any and all data on your device, belonging to me or not" and was given the capability to do it - that would be ludicrous. The only difference I see is that I'm not in an employer relationship with my users. Even still, an employer-employee relationship with a company does not grant them the right to delete any and all data on any device of mine. Also, since we're in HN (startup city, what?) who has ever worked for a startup that DISCOURAGED working from home on a personal laptop or having access to email 24x7? I've certainly never worked for one.
- tptacek 16y ago
  We simply disallow people working on company projects with personal equipment. If I drank enough rye to kill the requisite number of brain cells required for me to allow people to sync their personal gear with our IT, I'd definitely tell people "we will be nuking your gear from orbit periodically as a precautionary measure".
- yummyfajitas 16y ago
  Also, since we're in HN (startup city, what?) who has ever worked for a startup that DISCOURAGED working from home on a personal laptop or having access to email 24x7? The policy where I work is: linux laptop (I imagine BSD might also be ok), access to code is via sshfs (or TRAMP) only. I don't think this is that unusual.
- bruceboughton 16y ago
  >> Additionally, we're talking about a lack of separation between two entities' data (personal & company-owned data). Yes, but this lack of separation is caused by the employee choosing to sync their work email with their personal device. Unless the employer requires this, then it's entirely the employees fault.
- runjake 16y ago
  > The problem that the posts points out is that there's no warning about this "contract" whatsoever. But the post wrongly blames Microsoft and Exchange, when it's the person's workplace he should be blaming for supposedly not having clear enough policies.