8 ms·
This is such critical advice, particularly if you work for a company that does remote hardware management. You could be fired tomorrow, and your access to your
by timr 5y ago
This is such critical advice, particularly if you work for a company that does remote hardware management.
You could be fired tomorrow, and your access to your hardware revoked instantly. Apple devices, in particular, allow IT to remote lock your laptop. Whatever you had stored on the drive is lost to you, available to your employer, and you can't do anything about it.
Don't mix business and personal hardware.
- pageandrew 5y agoIf you got the laptop in a sealed Apple box (purchased by employer), and set up macOS yourself, created your own admin user and everything, does this remote access still apply?
- deleted 5y ago[deleted]
- gostsamo 5y agoYes, it does. The employer has registered in front of Apple the serial number and Apple considers the device theirs. MDM on an employer's laptop allows them full control. If the device is owned by the user, then the MDM is more limited.
- GekkePrutser 5y agoIt's actually the vendor that registers Macs. Only iOS devices can be registered to Apple DEP manually. Macs can't, only the vendor can do so, whether it's Apple or whoever else.
- underwater 5y agoAre you saying the employer can take control of the device without ever having physical access to it? That sounds like a massive privacy and security issue. Do you have more information?
- gostsamo 5y agoI was researching MDM more than an year ago, but keep in mind that we are talking for an employer's machine. Here is the overview: https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/web https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/...
- underwater 5y agoIt would still need on-device authorisation to opt into MDM though. I can't just give Apple your serial number and tell them to start pushing updates to your device, can I?
- gostsamo 5y agoAt the time of purchase, the vendor knows which machines the employer buys and assigns them the relevant privileges. When the machine is initially opened, it connects to Apple and is provided with the address of its mothership server. The MDM server then instructs the machine what to download and how to configure it. The user has just to unbox the machine and nothing else. This is convenient because it allows for downloading multiple apps, installation and configuration of certificates, setting password policies and many other actions that users are really prone to mess up, and that are wasting lots of sysadmin time if done manually one by one. If the user owns the machine, then there must be authorization and the MDM has much more limited, privacy-preserving scope.
- rz2k 5y agoIn that case you should know whether a management profile[1] has been installed, but you shouldn't assume you can simply create another admin account. [1] https://support.apple.com/guide/server/intro-to-profile-manager-apd0e2214c6/mac https://support.apple.com/guide/server/intro-to-profile-mana...
- Hamuko 5y agoIf I don't see a Profiles section in my System Preferences, does this mean that my employer has a very high level of trust in me?
- mike_d 5y agoIt means your employer has a very low level of security and you should be genuinely concerned about any personal or financial information you gave them during your hiring.
- jcims 5y agoThis entirely depends on what you do from that point forward. Are you using a VPN provided by your employer? Are you installing any screen sharing or collaboration apps for work? You'll need to understand what each of these are capable of in order to fully understand your exposure.
- tomjen3 5y agoMany services allow you to log out of either all or a specific session on another computer.
- wvenable 5y agoAndroid has work profiles separate from personal profiles -- I find that a reasonable compromise. Having work emails/chat/etc on my phone has been a great benefit -- it means I can be untethered from desk but not miss anything important.
- andrewshadura 5y agoReasonable countries don't allow companies to fire employees immediately, hence access cannot possibly be revoked instantly.
- mike_d 5y agoJust because you aren't fired instantly doesn't mean your access can't be revoked. The company just says "your new job is to stare at the login screen until HR can schedule a meeting with you."
- ImaCake 5y agoI live in Australia, which generally has decent (but slowly eroding) workplace protections. But I managed to get fired and walked out of the building with zero notice. So I would not count on this even in a country with traditionally strong labour laws.
- jfrunyon 5y agoI would say that not allowing a company to fire someone immediately, say, if they're looking at porn on their work computer during work time in front of the entire work office, is unreasonable.
- meepmorp 5y agoWhat country on earth won't allow an employer to lock you out of everything and escort you to the door if they deem it necessary for their security? Employed or not, your access isn't under your control.
- GekkePrutser 5y agoThis is what (public or personal) cloud is for. Nothing lost. Helps too if the laptop breaks or is stolen. Though I would prefer to see stricter separation like Android Work profile on computers too.
- andmalc 5y agoChromebooks provide separate logins for personal and Workspace/GSuite accounts. As for what happens if your Chromebook is stolen and you've not selected the option to lock it when the lid is closed, Workspace/GSuite accounts can be remote wiped, personal ones cannot. Perhaps with the upcoming Workspace Individual plan, remote wiping of personal accounts will be possible too.
- ec109685 5y agoYes, agreed. Apple does a good job letting you know what your company has access to, and if you use iCloud / Personal GMail, your stuff stays with you after you leave.
- underwater 5y agoSaying "instantly" is under selling it. It literally happens before you are fired. IT will have disabled you ability to access files before you have been informed it is happening.
- deleted 5y ago[deleted]
- eikenberry 5y agoCouldn't you pop the drive out, wipe and format it, then put it back in?