4 ms·

> Apple also noted that one of the big reasons users fear corporate BYOD programs is because they think the IT admin will erase their entire device when the enr

by Kalium 7y ago

> Apple also noted that one of the big reasons users fear corporate BYOD programs is because they think the IT admin will erase their entire device when the enrollment ends — including their personal apps and data. Yes. This is a true thing that users fear. It tends to happen because they're using phones that don't allow any more constrained option. It's nice to see iOS catching up with Android in this.

GordonS 7y ago
I've had InTune and also some VMWare device management installed on my device in the past, and during installation you do get a warning that your admins will be able to delete everything on your device. It kind of makes sense for them to do that if your device is stolen, but I still just don't like handing over control of my device like that. They typically also enforce other annoying policies, such as not allowing rooted devices, not allowing swipe patterns and requiring a PIN/password. The VMWare one even required that all browsing went through their shitty browser app (and presumably they got all my history). Again, some of this makes sense from an enterprise point of view, but as a user it's annoying and feels invasive.
- Kalium 7y ago
  Oh, it definitely feels annoying and invasive. Without sandboxing, the options are invasive MDM (because that's the only kind possible) and no MDM at all. I once watched an employer go from unwilling to adopt MDM to requiring it for accessing substantive systems on personal devices. The CEO lost his phone, and suddenly appreciated what MDM was good for. Users were given a choice: MDM, sandboxed if they had a device with modern technology, or no significant access on personal devices. A lot of users had phones that didn't offer sandboxing, so myself and several others found ourselves explaining quite often that there literally was no option available where remote wipe wasn't possible. If they didn't like that, well, they didn't actually need access from their phones, so... Anyway. I'm quite glad Apple is starting to actually catch up a bit.
jiveturkey 7y ago
I didn't read TFA fully but I suppose from your quote, what they didn't say was what corporate IT fears. I don't know how many corps care about this, but when I did that kind of job, I refuse to have my corp have access to a user's personal data, and be able to brick their personal device, etc. It's not acceptable from a privacy POV and not acceptable from an employee backlash POV. Anyway it was an easy choice because we never had sensitive data that could make it to a phone/tablet. In an environment more like that, I would probably have instituted some kind of privacy waiver that an employee would have to sign in order to BYOD (apple brand). That probably wouldn't fly today, in europe. GDPR and all that.
- ghaff 7y ago
  In addition, customers are starting to require their vendors who have access to their data institute MDM. So it's increasingly MDM or two separate devices.
  - jiveturkey 7y ago
    The requirements I've read (obvi not comprehensive superset) all require this only for, as you say, access to their data. If you're not accessing the customer data via mobile device, you don't need MDM. I say my view of it isn't comprehensive, but a requirement that all devices be under MDM even if those devices don't have access to customer data, is quite an overreach.
    - ghaff 7y ago
      That may be, but at many companies, many if not the majority of their employees are going to have access to some information that their customers consider confidential. As a result, it's easier to have a blanket policy. Given the general situation with data breaches and so forth, I wouldn't be shocked if, down the road, more and more companies decide that there's just too much risk with BYOD and require employees to use locked-down company-provided devices.
      - jiveturkey 7y ago

by Kalium 7y ago

GordonS 7y ago

I've had InTune and also some VMWare device management installed on my device in the past, and during installation you do get a warning that your admins will be able to delete everything on your device. It kind of makes sense for them to do that if your device is stolen, but I still just don't like handing over control of my device like that. They typically also enforce other annoying policies, such as not allowing rooted devices, not allowing swipe patterns and requiring a PIN/password. The VMWare one even required that all browsing went through their shitty browser app (and presumably they got all my history). Again, some of this makes sense from an enterprise point of view, but as a user it's annoying and feels invasive.

Kalium 7y ago
Oh, it definitely feels annoying and invasive. Without sandboxing, the options are invasive MDM (because that's the only kind possible) and no MDM at all. I once watched an employer go from unwilling to adopt MDM to requiring it for accessing substantive systems on personal devices. The CEO lost his phone, and suddenly appreciated what MDM was good for. Users were given a choice: MDM, sandboxed if they had a device with modern technology, or no significant access on personal devices. A lot of users had phones that didn't offer sandboxing, so myself and several others found ourselves explaining quite often that there literally was no option available where remote wipe wasn't possible. If they didn't like that, well, they didn't actually need access from their phones, so... Anyway. I'm quite glad Apple is starting to actually catch up a bit.

jiveturkey 7y ago

I didn't read TFA fully but I suppose from your quote, what they didn't say was what corporate IT fears. I don't know how many corps care about this, but when I did that kind of job, I refuse to have my corp have access to a user's personal data, and be able to brick their personal device, etc. It's not acceptable from a privacy POV and not acceptable from an employee backlash POV. Anyway it was an easy choice because we never had sensitive data that could make it to a phone/tablet. In an environment more like that, I would probably have instituted some kind of privacy waiver that an employee would have to sign in order to BYOD (apple brand). That probably wouldn't fly today, in europe. GDPR and all that.

ghaff 7y ago
In addition, customers are starting to require their vendors who have access to their data institute MDM. So it's increasingly MDM or two separate devices.
- jiveturkey 7y ago
  The requirements I've read (obvi not comprehensive superset) all require this only for, as you say, access to their data. If you're not accessing the customer data via mobile device, you don't need MDM. I say my view of it isn't comprehensive, but a requirement that all devices be under MDM even if those devices don't have access to customer data, is quite an overreach.
  - ghaff 7y ago
    That may be, but at many companies, many if not the majority of their employees are going to have access to some information that their customers consider confidential. As a result, it's easier to have a blanket policy. Given the general situation with data breaches and so forth, I wouldn't be shocked if, down the road, more and more companies decide that there's just too much risk with BYOD and require employees to use locked-down company-provided devices.
    - jiveturkey 7y ago