4 ms·

Google had wiped her personal phone when it suspended her Everyone take note: BYOD isn’t for your benefit.

mc32 7y ago
This. BYOD is a very bad idea. It has no upside for the user. It’s all for the benefit of the employer in multiple ways. Don’t do it.
- Ididntdothis 7y ago
  Agreed. For a while my company allowed Office 365 access from my cell phone without installing anything but now they require inTune and reserve the right to wipe phones but promise to never do it. I guess I will stop using Outlook on my phone...
- adrr 7y ago
  I'd rather not have to carry two mobile phones around which would be the alternative to BYOD. BYOD is fine if the MDM software does profiles and allows the separation of company data and personal data. That way the company can only wipe its own data and not the personal data.
  - ummonk 7y ago
    Don't carry your work phone around when you're off hours.
alistairSH 7y ago
Does a remote wipe also wipe out cloud backups? Couldn't the employee simply restore from a backup (cloud or on-disk)?
- shadowgovt 7y ago
  A corp wipe shouldn't touch personal data, so that should hypothetically be possible. If they can't, my guess is it's because cloud backup was disabled (and corp wipe will conservatively blow away the local camera cache because there's no way to know if any photos contained corp-sensitive data). Worth keeping in mind the target use-case of corp wipe: a hostile agent has taken control of a corporate asset. Application of policy to minimize the risk to the corporation, i.e. blowing away all cache that could be reached without an additional private user credential into a personal account, should be expected.
post_break 7y ago
Google offers two versions of this wipe. The whole phone, and only employer data. Wonder if they did the whole phone on accident, malice, or they are trying to say they "wiped" the phone but only removed employer data.
- izacus 7y ago
  That only works on Android, if you have an iPhone, you always give your phone over to the employer.
- BickNowstrom 7y ago
  Another (to me more plausible) option: The employee was unable/unwilling to separate the personal from work. So the "personal" data included (or could have reasonable suspicion of including) employer data.
TallGuyShort 7y ago
What exactly does Google do for BYOD? I use my personal phone for work, but I've simply added my work GSuite account as one of the accounts on the phone, in addition to my personal one. I can access work email, use work's 2FA, but at no point in time (as far as I know) does work have the ability to, say, delete files from the device or from my personal backup accounts. Are Google employees allowing something far more intrusive, or am I underestimating my exposure when I have multiple Google accounts configured on my Android phone?
- wil421 7y ago
  It sounds your device isn’t managed by an MDM. Did you accept a new cert from work and a bunch of scary messages when adding the account? If you accept the MDM you will give root accesses to your company’s MDM system. Basically giving them as much access as Find My iPhone or whatever the android equivalent. Location tracking, remote wiping the phone, access to texts and calls...everything. Yes they could access your texts/calls/emails everything.
- asdfasgasdgasdg 7y ago
  If your employer wants, they can predicate the use of a work profile and your corporate assets on the installation of a device policy. This policy can give them extensive capabilities on your device, including wiping the device. If you installed a device policy, you may be underestimating your employer's capabilities. Otherwise, you're fine.
  - izacus 7y ago
    Work profile can't wipe the whole device. Setting up the MDM profile as primary profile does allow that - but it's very clearly communicated.
    - asdfasgasdgasdg 7y ago
      But work profile can require the installation of a device policy, right? I know I have a device policy installed, and I can't think why I would have done that if setting up the work profile didn't require it. Although as it happens the policy I have on my device only allows wiping the work profile, as you say.

mc32 7y ago

This. BYOD is a very bad idea. It has no upside for the user. It’s all for the benefit of the employer in multiple ways. Don’t do it.

Ididntdothis 7y ago
Agreed. For a while my company allowed Office 365 access from my cell phone without installing anything but now they require inTune and reserve the right to wipe phones but promise to never do it. I guess I will stop using Outlook on my phone...
adrr 7y ago
I'd rather not have to carry two mobile phones around which would be the alternative to BYOD. BYOD is fine if the MDM software does profiles and allows the separation of company data and personal data. That way the company can only wipe its own data and not the personal data.
- ummonk 7y ago
  Don't carry your work phone around when you're off hours.

alistairSH 7y ago

Does a remote wipe also wipe out cloud backups? Couldn't the employee simply restore from a backup (cloud or on-disk)?

shadowgovt 7y ago
A corp wipe shouldn't touch personal data, so that should hypothetically be possible. If they can't, my guess is it's because cloud backup was disabled (and corp wipe will conservatively blow away the local camera cache because there's no way to know if any photos contained corp-sensitive data). Worth keeping in mind the target use-case of corp wipe: a hostile agent has taken control of a corporate asset. Application of policy to minimize the risk to the corporation, i.e. blowing away all cache that could be reached without an additional private user credential into a personal account, should be expected.

post_break 7y ago

Google offers two versions of this wipe. The whole phone, and only employer data. Wonder if they did the whole phone on accident, malice, or they are trying to say they "wiped" the phone but only removed employer data.

izacus 7y ago
That only works on Android, if you have an iPhone, you always give your phone over to the employer.
BickNowstrom 7y ago
Another (to me more plausible) option: The employee was unable/unwilling to separate the personal from work. So the "personal" data included (or could have reasonable suspicion of including) employer data.

TallGuyShort 7y ago

What exactly does Google do for BYOD? I use my personal phone for work, but I've simply added my work GSuite account as one of the accounts on the phone, in addition to my personal one. I can access work email, use work's 2FA, but at no point in time (as far as I know) does work have the ability to, say, delete files from the device or from my personal backup accounts. Are Google employees allowing something far more intrusive, or am I underestimating my exposure when I have multiple Google accounts configured on my Android phone?

wil421 7y ago
It sounds your device isn’t managed by an MDM. Did you accept a new cert from work and a bunch of scary messages when adding the account? If you accept the MDM you will give root accesses to your company’s MDM system. Basically giving them as much access as Find My iPhone or whatever the android equivalent. Location tracking, remote wiping the phone, access to texts and calls...everything. Yes they could access your texts/calls/emails everything.
asdfasgasdgasdg 7y ago
If your employer wants, they can predicate the use of a work profile and your corporate assets on the installation of a device policy. This policy can give them extensive capabilities on your device, including wiping the device. If you installed a device policy, you may be underestimating your employer's capabilities. Otherwise, you're fine.
- izacus 7y ago
  Work profile can't wipe the whole device. Setting up the MDM profile as primary profile does allow that - but it's very clearly communicated.
  - asdfasgasdgasdg 7y ago
    But work profile can require the installation of a device policy, right? I know I have a device policy installed, and I can't think why I would have done that if setting up the work profile didn't require it. Although as it happens the policy I have on my device only allows wiping the work profile, as you say.