3 ms·
It would still need on-device authorisation to opt into MDM though. I can't just give Apple your serial number and tell them to start pushing updates to your de
by underwater 5y ago
It would still need on-device authorisation to opt into MDM though. I can't just give Apple your serial number and tell them to start pushing updates to your device, can I?
- gostsamo 5y agoAt the time of purchase, the vendor knows which machines the employer buys and assigns them the relevant privileges. When the machine is initially opened, it connects to Apple and is provided with the address of its mothership server. The MDM server then instructs the machine what to download and how to configure it. The user has just to unbox the machine and nothing else. This is convenient because it allows for downloading multiple apps, installation and configuration of certificates, setting password policies and many other actions that users are really prone to mess up, and that are wasting lots of sysadmin time if done manually one by one. If the user owns the machine, then there must be authorization and the MDM has much more limited, privacy-preserving scope.
- R0b0t1 5y agoI think they are asking if you could social engineer access to someone's laptop by knowing their serial and calling enterprise support. Seems to me like you could.
- gostsamo 5y ago@R0b0t1 No, you can't. The employer has proof of ownership because they buy the machine.
- underwater 5y agoThat's really surprising. I suppose it makes sense if it happens at the time of setting up the machine, and an explicit notice is given to the end user. That should circumvent any privacy and security issues.