16 ms·

Your devices and your employer

260 points by picture 5y ago

draw_down 5y ago
If you’re working a tech job, you almost certainly have the bucks to get the extra device. Personally, I think it’s a bit scummy that a business would ask employees to do work on a device they didn’t pay for, but that’s a digression. The long and short of it, I think, is that you should keep things separate because a job is not forever so you should remain prepared to leave, and to keep them from snooping in your personal business. Yeah yeah that probably won’t happen, but if you keep em separate you know it won’t. MDM and similar also give them the ability to wipe the device at any time, for reasons that could have absolutely nothing to with you. You know, as a precaution, of course. Just save yourself the headache.
- wccrawford 5y ago
  I'm of the opinion that until I retire, I do not have the "extra money" to do anything for my job out of my own pocket. They can pay me for their requirements if they go against my better judgement. My current job does not require that I put anything on my phone, though I've chosen to check my work email there. I could take it off at any time, though, without repercussions. They've treated me well, there's nothing in my contract about their data on my devices, and I like to keep up with what's going on. If any of that changed, I'd remove it from my phone.
gnicholas 5y ago
> I realize that many people do not have the option to just go and drop a couple hundred bucks on an additional phone and then add another $100/mo to their budget for the service. I'd never pay a monthly fee for a work-only device. If they give me a work-only device, it should come with a data plan. If they don't give me a work-only device but want me to sign over access to my personal device, then I'll use an old device and just use wifi. No way I'm paying a separate monthly fee because my employer puts me between a rock and a hard place. Also, MVNOs are $20/mo, not $100.
- deleted 5y ago
  [deleted]
- stronglikedan 5y ago
  I took that to mean, not everyone who is provided a corporate device can afford a separate personal device and plan. I've never heard of a corporate device coming without a plan paid by corporate.
  - gnicholas 5y ago
    Agree that corporate devices typically come with data plans. I took the $100 bit as a reference to the Lyft situation, where she was required to load a bunch of apps onto a mobile phone, but wasn't given a work device. So she bought a dedicated device with a one-time cost and apparently paid an ongoing monthly fee as well.
- deleted 5y ago
  [deleted]
- sigio 5y ago
  $2.50 here.... good thing to not be in the US :)
  - squarefoot 5y ago
    Can you be more specific? I pay over here €10/month (phone not included) for unlimited calls and text in all EU and many other places abroad plus 100GB (I have an old plan, now it's 120GB for the same price) locally with decent coverage, and consider myself lucky. Actually there are cheaper options, although those companies have been a lot less user friendly. With this one (iliad.it) at least I can use a prepaid card to avoid unpleasant surprises and cancel anytime in a click.
saagarjha 5y ago
What I don’t really understand is how we ended up at the point where invasive MDM is even acceptable. People mix their work and personal lives all the time: even if I take my work laptop home and use it, it would be a massive overreach to show up at my house and demand that I let them search it. Why do we accept the equivalent for phones? Ok, I put company email on my phone: you should be able to wipe just that and retain a copy (which, running a central server, you do of course). Why should you have any right to do more than that?
- jdbernard 5y ago
  Because collectively we've given up caring about digital privacy as a society. You and I and maybe most of the HN crowd care, but most people don't. Not really. This is just a reflection of that broader value system.
  - systemvoltage 5y ago
    Pardon me for the language, but it is fucked beyond repair. We've destroyed the planet. I wish to go back to analog life.
- p2detar 5y ago
  BYOD have clear separation of work and personal containers. Wiping all work stuff comes down to deleting the work profile from your personal device. This automatically removes all work related apps, accounts, media, etc.
  - Rd6n6 5y ago
    I don’t think that byod at every company separates things that completely
    - Sunspark 5y ago
      It doesn't. They can enforce password policies, etc. Best practice is to have a second device just for the company.
aluminussoma 5y ago
In California, most companies that require after hours duties because engineers are on-call, provide a company issued cell phone device because of California Labor Code section 2802: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=2802&lawCode=LAB https://leginfo.legislature.ca.gov/faces/codes_displaySectio... The companies that do not do that are exposing themselves to unnecessary legal risk in the future.
- toomuchtodo 5y ago
  Would be fun to know which companies aren't for reporting purposes.
hbrav 5y ago
The most interesting thing about this is the linked article about the employer that tried a bit of sharp practice to insert additional clauses into the NDA: https://rachelbythebay.com/w/2011/11/09/signs/ https://rachelbythebay.com/w/2011/11/09/signs/ There's definitely a few morals to this story (but note: not legal advice! I am not a lawyer!): 1. You should keep your own copy of anything you sign as part of your employment contract. 2. You should maybe keep a record of when you handed that to your employer ("I did in fact sign a copy of the NDA when I began my employment, and handed it to [person] on [date]. I hope this helps you to locate it.") 3. If the NDAs are so long that it would be impractical to visually diff them, you can just ask the company: "Can you please ask [name of company lawyer] to send me an email confirming that this is the same NDA that I signed at the beginning of my employment on [date]?" If they do, and then later rely on a clause that has been inserted, I suspect they would have a hard time convincing a court to enforce that clause. 4. In the author's situation, they sound like they were over a bit of a barrel economically and it's hard to push back in that situation. If you are willing to push back, remember that your employer is asking for something from you, i.e. a change to your contract. And if that change is that they can audit your personal devices, that is not a small concession! "This NDA does differ substantially from the one I originally signed, and would represent a significant change in the conditions of my employment. I understand if the company has new security concerns, and I am willing to work constructively to find an acceptable solution. For instance, if you are uncomfortable with me being able to access work e-mail on my personal device, you can issue me with a separate device over which you would have auditing rights."
- jessaustin 5y ago
  "I did in fact sign a copy of the NDA when I began my employment, and handed it to [person] on [date]. I hope this helps you to locate it." I'm not sure how important this is. Of course they still have the old NDA, and in any perjury situation they would readily admit that. Managers and (especially) HR people regularly "fib" (synonym of "lie") in hopes of distracting attention from the monstrous demands of capital. If an employee made a big stink, that employee would be reminded that employment is at-will and thus contingent on signing whatever is required at any time. The worst NDA amendments could possibly be contested in court, if one wants to spend five figures on attorneys. Probably a better way to avoid surprise "renegotiations" is to unionize...
vincent-manis 5y ago
I had a job where I lived on planes and in airports (this was just before smartphones existed). The first day on the job, I logged in to the corporate network. It told me bluntly `This is the BigCorp network; there is no right to privacy'. The entire time I was there, I travelled with two laptops. I don't blame BigCorp for their policies; their equipment, their rules. But I strongly recommend separating the use of business and personal devices. And, no, if an employer demanded I install an app on my personal phone, I'd refuse.
- duxup 5y ago
  >if an employer demanded I install an app on my personal phone, I'd refuse. I did that once. In very polite terms I told them that I like to keep personal and work activity separate as much as possible for personal and work security reasons and that if they issued me a phone with an app I'd be happy to carry it. I got a very positive response. Ultimately they didn't think it was worth issuing me a phone and everyone went on happily.
- dijit 5y ago
  > And, no, if an employer demanded I install an app on my personal phone, I'd refuse. It’s increasingly common for employers to give payslips via a smartphone app; which needs to be installed on a personal phone of course. I’m one of the very few people to make a stink about it. But they’ve accommodated me after a lot of back and forth.
  - belval 5y ago
    Do you really consider your payslips as work stuff? From a legal point of view it seems unlikely that they could claimed your device was used for work if it was used to transmit payslips. To me this doesn't seem comparable to having Slack/Email on your personal phone which means that some corporate possibly classified info made it to your device.
    - celticninja 5y ago
      It's the installation of a work specific app that would be the concern. We already know apps track behaviour, but your company knows exactly who you are and can track behaviour without aggregating it, thus getting a very clear view of what you do outside of work.
deleted 5y ago
[deleted]
discardable_dan 5y ago
If my employer wants to contact me outside of work hours, they better provide me a phone.
- postalrat 5y ago
  A phone seems to be a pretty low price to give up your privacy and time.
- megous 5y ago
  OTOH, unless you power it off when not in use, it's still a spying device. Your own devices can at least be somewhat trusted.
ectopod 5y ago
> Well, if you end up using any amount of storage (like backing up the device), they are going to want you to pay for it. You'll probably end up typing in a credit card number and all of that stuff. I don't get this bit. Are you expected to pay for the cloud backup of your work laptop with your own money?
teeray 5y ago
The shameful thing is that there is no earthly reason why we need separate devices. There should be appropriate isolation mechanisms so that corp-ware stays in corp-land and personal crap stays over on its side of the fence. We have dual sim devices now, so we can even assign entirely separate plans to different device partitions. Separate devices just create more senseless e-waste.
- pydry 5y ago
  im not sure id trust the isolation to be done properly.
- danans 5y ago
  > There should be appropriate isolation mechanisms so that corp-ware stays in corp-land and personal crap stays over on its side of the fence This already exists and I use it every day: separate work and personal profiles on the same device or app. I think most browsers support this out of the box. My phone's work profile actually shuts off automatically on vacation days from work and I have to consciously enable it if I want to check work email or chat.
  - jessaustin 5y ago
    You might trust the isolation mechanisms, but that doesn't mean that all employers do.
    - yjftsjthsd-h 5y ago
      Okay? The original statement was, > The shameful thing is that there is no earthly reason why we need separate devices. There should be appropriate isolation mechanisms so that corp-ware stays in corp-land and personal crap stays over on its side of the fence. And we have that. Companies not trusting the tech is a separate problem.
    - deleted 5y ago
      [deleted]
    - deleted 5y ago
nayuki 5y ago
Somewhat related: https://news.ycombinator.com/item?id=28241753 https://news.ycombinator.com/item?id=28241753 "Apple explicitly asks employees to merge their personal and work accounts"
- rcarmo 5y ago
  That was flagged as bogus by a number of people from Apple.
  - deleted 5y ago
    [deleted]
rcarmo 5y ago
This is another reason why I Remote Desktop to corporate machines from my personal ones. Fully insulated access to corporate stuff (I turn off file and printer sharing, obviously, although they’re usually disabled anyway), but I get to use my monitors, keyboard, mouse, etc. and don’t have to physically plug in anything.
- lazypenguin 5y ago
  I would like to do the same but I don’t want to run my employers vpn software on my machine (they don’t need to see my local machines network traffic). Does your work not use a vpn?
  - yjftsjthsd-h 5y ago
    Depends on the VPN; at a previous job that used one, it was anyconnect, so I could just use openconnect on my local machine and never need anything that the company truly controlled locally
  - SourPatch 5y ago
    You could run it all inside a virtual machine.
- helsinki 5y ago
  Yes, but I wonder how invasive something like Citrix Remote Client is? I wonder what it sends back to the remote server?
kbenson 5y ago
What ever happened to the future we all predicted or were told was coming a few years ago where we ran our phones like a hypervisor, and could actually segregate different controlling accounts into separate phone VMs? I imagine it was probably because it was too power intensive. She's entirely right IMO with the advice. Separating work and personal time is already so hard to do in some cases, and having my phone be a pseudo-work communicator does not help with that problem in any way. Disentangling them at the end of a employment relationship is likely much much harder (luckily I've only had to deal with this minimally).
- fouc 5y ago
  I assume there's not a lot of incentive to give the end-user that sort of power over their devices
  - WrtCdEvrydy 5y ago
    BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Completely separated environment which allowed your work to just terminate the work environment remotely if you no longer needed access to it. You could even wipe the phone's work space when going through customs and remotely restore it from the BES Server.
    - kbenson 5y ago
      > BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Whether you think that's the best might depend on whether you're a an employee or employer. As an employee, I could see that being really annoying if someone pasted me a recreational link at work but I want to view it outside of a work context. For an employer that sounds like a nice way to keep data from leaking quite as easily though.
    - Sunspark 5y ago
      No, it was not completely separated. For example, admins could set a policy that required you to have a password on your personal space and could specify that it was a minimum # of digits, etc. I had a BB and this is one of the things that really soured me on BYOD. I didn't want a long alphanumeric password on my personal space that I had to change at the same frequency as the corporate password.
munk-a 5y ago
If a company offers me access to slack/email/whatever if I BYOD that's nice... but it's not something I'm going to take them up on unless 1) they're extremely young and don't have the infrastructure to manage things or 2) the responsibilities I'm taking on are so heavy that I feel the need to be always on call (and receive appropriate compensation). Otherwise, if you're hiring me as a developer, I will develop with all my effort during work hours... and then go home. If you occasionally need me to stay late to supervise an off-hours deploy that's cool - no worries... but if it ends up running 4+ hours over a normal work day I expect time in lieu (possibly just starting late the next day). I feel like I'm at the sort of ideal balance of defensiveness and compliance for an employee - I want to help make your company run better... but we signed an agreement on what I'll be compensated for that effort and what the expectations are and we'll stick to the agreement excepting sane and reasonable requests for minor deviations - a BYOD policy is not one of those. I am not pulling down half a mil - I don't even make six figures US - but I'm still expensive enough that a good work setup: computer, chair, keyboard that doesn't suck and phone if you need me to have it - are entirely incidental costs compared with my salary, employer taxes and health care costs. If you, as an employer, are going to try and make both of our lives more complicated over a one time 200$ cost to the company (and plan cost - which could be non-existent if wifi-only works for the phone) then you don't have your priorities straight (unless, again, you're like a three person startup then whatever - I get there's already way too much crap each person is trying to handle). I disagree with Rachel in the fact that I don't think it's ever a good idea to BYOD - even paying for it yourself. Cleaning company software off the device is going to be a pain - and it's going to be a pain when your employment ends which is a period in every job's life that could always use every advantage it can get to be drama free.
- nijave 5y ago
  It always blows my mind a company will pay an employee 5-6 figures (ish) (on top of all the other expenses an employer pays per employee) then refuse to hand out 3-4 figure equipment (cell phone + plan, performant workstation, etc) I think she was advocating for a completely separate BYOD/work device so the cleaning phase would be "wipe phone and sell on eBay" or simply "throw phone in the trash" (e.g. pay for a corporate-only device out of your salary)
brundolf 5y ago
> Around 2009 or 2010, the company decided to try to pull a fast one on some of us. They said that our original NDA somehow hadn't gotten signed (what?), and that we needed to re-sign it...Sure enough, they delivered, and sent me the original NDA. Note: they didn't send me AN original NDA they were using circa 2006 when I started. They sent me THE original NDA, complete with my signature from the day I started! Yes! > So then I started reading along, doing my best to do a 'diff' in wetware, and found that they had actually added some clauses. One of them amounted to 'taint' for your personal devices. Basically, if you signed in to your corp gmail from a device, they claimed the right to audit it at any point in the future. This kind of psychotic behavior is one reason I'll never work at a megacorp. I'm sure some smaller companies do it too, but it seems less common, and they won't have as many lawyers on retainer just waiting for the chance to justify their salary by pursuing it. And if I ever did find myself at a company that tried to pull something like this, I'd probably quit on the spot. I won't work in an environment where I'm having to constantly watch my back.
- abawany 5y ago
  I can confirm based on my experience that smaller companies do it this too. They may not have many lawyers on retainer but being small, they can (threaten to) walk you out immediately with no consequences, cut-and-paste irrelevant passages from other companies in the new NDA, and other assorted unnecessary nonsense.
- oogali 5y ago
  Don't just sign the last page. Initial every page. Always.
  - zhte415 5y ago
    This has always been required for the mega-contracts I've had to sign, which have sometimes spanned hundreds of pages. Not only initial each page, but to have the pages cascaded so there's initials running over the margin of consecutive pages - this was required.
- beh9540 5y ago
  What I don’t understand about this is they were most likely an at-will employee. So the company could have just said “new policy, sign it”. I had an employer do this - I was working there a few years, owner came in and said “we’re doing background checks, fill this out and sign it”. I asked what happened if something came back on it, and he said that I’d be fired.
nindalf 5y ago
> Basically, when you quit, you have to go through this process of getting your number released from their mega-account with ATT or whatever, and that's just one more bit of turmoil in a time when you just want to be done with it. I did this about a month ago at the same company Rachel is talking about. It was dead simple. I created a task where I mentioned my personal email account. The next day they mailed me a porting key, which I relayed to my new carrier. It started working within a day. Haven't had an issue so far. I always felt that some of the writing on this blog had a tendency to make mountains out of mole hills. I can't say for sure about the rest of it, but this is definitely a mole hill.
- gnicholas 5y ago
  Agree that it's not hard to port numbers. I think the larger potential issue is if you are working for a smaller company that is not as smooth with these transactions, or if you end up with an acrimonious situation where — whoops, we forgot to give you the porting key and now your phone number has been lost and there's literally no way to pull it back.
  - nindalf 5y ago
    Like I said, it might be different at other companies. I only pointed out at the specific company Rachel mentioned, the process is smooth.
- wafflespotato 5y ago
  As someone who no longer shares devices / numbers / ... with employers partly due to NDA shenanigans in the same vein as in this article and when I left that company they tried to make my life as difficult as possible and tried to withhold compensation and so on. Sure, in the happy path porting number is easy. But this assumes that * the company will be ok with you porting it out (and not just hold onto it out of spite, which I believe the company I worked for might have done) * the company will handle that kind of tickets in a reasonable amount of time * the company will not need to escalate this sort of request to levels where they will then be ignored * the company will be technically competent to handle this sort of request I'm not saying that all or even most companies will have these problems but the issue is that if the first thing you do when joining the company is port your number over, how can you know what the internal company culture is and if they will make it feasible for you to get your number back later on? This also ignores the big selling point of keeping your work accounts / numbers separate: being able to disconnect. Just being able to put your work laptop and phone away and know that you won't get called has it's own fairly large value.
ubermonkey 5y ago
I'm astonished some companies push the "user your own phone, which we now basically can control" angle. I mean, that's really shitty. I've been working for the same small software shop (single owner, and I trust him) for 14 years, so the entire development of the modern mobile ecosystem happened while I've been in this job. I use a personal laptop for all my work. I do this because I have Strong Preferences, and there's no way for the company to interfere with my computer. I can say this because (a) I trust the guy and (b) it's not actually possible for our corporate stuff to affect my personal stuff. (My computer isn't on the domain, for one thing; for another, we've all increasingly moved to "remote desktop into a VM in the colo" as a work pattern, even the devs, because it puts us all closer to the app servers and database servers. What device we use to reach the corporate environment is increasingly irrelevant.) But this is a post about what OTHER people should do. Most people aren't in my position. Anybody who works for a big corporation -- which I define as "anywhere your boss has a boss" -- should absolutely assume that Bullshit and Chicanery Will Ensue at some point, and treat your personal computing security accordingly. Don't cross the streams if you can at all avoid it. If you must, minimize exposure.
- vcxnxgj 5y ago
  careful. you're massively opening yourself up by using a personal machine for work. use hardware they own, with your configuration.
  - ubermonkey 5y ago
    How? Understanding what I do is not something most people can do, and understanding I work 100% remote (as does our entire company), and understanding there is no way IT policy in our org can affect my hardware: How?
    - cryptonector 5y ago
      Subpoenas?
    - mrgordon 5y ago
      I believe the other poster is saying that by sending a work email from your laptop or probably even by connecting to the company servers through it, your device could be theoretically investigated as part of a lawsuit. If you don’t use it for email and just type SSH on it then admittedly they probably won’t have much to find, but they could still get access.
itronitron 5y ago
I guess I have been lucky to work in groups that were fairly focused on operational and personal security which requires quite a bit of separation between business and personal. Although the larger organization always has broad-brush security measures that lump it all together. Pretty sure my next phone will be a feature phone.
ShroudedNight 5y ago
> I also was given a PCI Express (see, I told you this was a long time ago) cellular device which would let me get online with the company laptop from anywhere it had service. Was this supposed to be PCMCIA or ExpressCard? It's not obvious to me how describing a laptop peripheral as being PCI Express-based is particularly effective at highlighting its anachronistic nature.
- rachelbythebay 5y ago
  Ah! You are in fact correct. It's so long ago, I screwed up the term for it. ExpressCard it is. In the words of everyone who's ever done a small fix, "reload".
killjoywashere 5y ago
This seems quaint to me. The real reason to not use a personal device for work is discovery. As soon as you do work someone can trace back to that device, there’s the potential for someone to seek a warrant for that device. Even if it’s some chucklehead you don’t even know within the corporation who’s being investigated, all you had to do was send an email to someone they sent an email to. And now the courts can demand your stuff. Let’s assume everything everyone does is perfectly legal, it’s still a massive inconvenience tax, and that alone is a good reason to not do it. I carry two phones and two machines (Corp laptop, personal iPad). They want me, they can give me the machines to contact me.
- websites2023 5y ago
  Yep. This has already bitten one employee of Apple: https://twitter.com/ashleygjovik/status/1428495420917837826?s=21 https://twitter.com/ashleygjovik/status/1428495420917837826?... It's a damn shame, and a good reason to never, ever mix work and personal devices.
nickjj 5y ago
The device discussion is really interesting on so many levels. Especially for non-phones and remote working. Let's say you live in a studio apartment and you have your own personal workstation set up how you like it. That would be a desktop workstation, couple of monitors, adjustable standing desk, some chair that you like, internet, etc.. Now a company wants to hire you and they want you to use a company issued laptop. This becomes a serious physical burden on both yourself and your limited space. Using a laptop without external monitors is horrible posture but if you're in a studio apartment you might not have enough space to use a completely separate desk, chair, couple of monitors, keyboard, mouse, etc.. We'll ignore the money aspect of having 2 distinct set ups which in the grand scheme of things isn't too big of a deal. There's not too many reasonable options here. The company's policy might not allow you to bring your own device and even if they let you use your personal computer, allowing them to audit that or install some remote desktop sharing software that they have free reign over would be total madness. It's also not that painless to quickly switch around HDMI (or even worse DVI) monitor cables. I suppose you could rig some type of HUB that lets you flip a switch to control which computer your monitors, keyboard, mouse, headphones, microphone, etc. are active for. This way you can use your desk setup for both, but now you can't use them at the same time which has its own set of issues. There's also issues like wanting to copy files from your personal machine to the work machine. So you might think ok I'll just allow SSH connections locally but now you've linked both machines to a point where having separation is useless, or maybe you decide to use an external drive that you can swap between both. In either case the work machine has been tainted.
- treesknees 5y ago
  You don't need to be a single bachelor in a studio apartment to have this problem. I'd argue most people who worked from home due to lockdowns have ran into this. My home office, while adequate, wasn't exactly setup to be writing code and hosting meetings in for 8 hours a day. I'm certainly not going to go out and buy a desk and chair just for my work laptop... I ended up buying a nicer desk and monitor stand. As someone else pointed out, I purchased a KVM switch to flip my monitor between personal and work machines. After a year of this I've just moved to setting my personal laptop to the side for music/email/etc and stopped using the KVM switch. It really wasn't a big deal and I wouldn't call it all that interesting.
EamonnMR 5y ago
I worked for a healthcare company where the deal was you could get email on your phone but only if you installed am app that would allow IT to remote-wipe your whole device at their discretion. I declined.
indigodaddy 5y ago
It is insanity that a company as “big” as Lyft is not providing a Corp phone to employees and forcing them to install and connect to so many work related apps and network elements on their own non-work-supplied phone. Absolute insanity.
- nijave 5y ago
  Not only that, they're expecting you to install beta Lyft to use it for dog fooding before they roll it out
  - qq4 5y ago
    That's the second time I've seen that phrase in this thread. What does dog fooding mean in this context? Is it that dogs will eat anything? I don't understand.
    - sgerenser 5y ago
      “Dog fooding” comes from “to eat [one’s] own dogfood.” An analogy to a dog food producer claiming their product is so good that it’s tested by their (human) employees.
      - indigodaddy 5y ago
        The term has been around in IT for quite a long time too. It predates my career in tech for sure. I just read Showstopper! published in 1994, and the term was used in that book referencing when the NT developers were directed to use Windows NT on their systems way early on in the dev landscape of NT.
phdelightful 5y ago
My employer doesn't even really allow personal electronic devices on the network, though there is some provision for visitors of course. So if you need a phone they have to provide you one, same for a computer. The same security constraints also basically prohibit accessing work stuff from a personal device. We can't even get webmail, we have to access a managed desktop-as-a-seevice and get our email from there if we are on a personal device. And the facility is big enough that cell service sucks. I really appreciate the work/life firewall. Impossible to work on personal devices, impossible to use personal devices at work. And the security posture of them can be different
- helsinki 5y ago
  Speaking of managed remote desktops, I wonder how much localhost data the Citrix client sends to the company’s server?
  - phdelightful 5y ago
    A fair question. It's VMware Horizon client or something like that in this case.
heroHACK17 5y ago
Recently joined a FAANG and did this same thing last week. 0 chance I'd install company software on my personal device.
slyall 5y ago
Just today (possibly related) someone else tweeted: Sooo, #Apple has pics of my boobs. During a discovery thing 3yr ago, legal forced me to hand-over all my texts. They refused to let me delete anything, even "fully personal," even when I said "by fully personal I mean nudes." They said they're in their "permanent evidence locker" I questioned this aggressively. Apple R&D pressures us to have one iPhone for work & personal (so we can "live on" / dogfood). I said, if there's texts that aren't with employees and have nothing to do with work, I should be able to delete them or at least attachments. "Nope." https://twitter.com/ashleygjovik/status/1428495420917837826 https://twitter.com/ashleygjovik/status/1428495420917837826
- cryptonector 5y ago
  You need three sets of personal devices to work at Apple then? Who knew.
- sneak 5y ago
  Apple already had her (and everyone else who iMessages) nudes: iCloud Backup is not e2e and is on by default and escrows either the iMessage plaintext or the iMessage sync keys to Apple, encrypted with Apple keys. Apple can read all of the stuff you text or iMessage if you (and all the people you text with) haven't disabled iCloud Backup. This goes for every iOS device in the world, not just Apple corporate ones. They even have my nudes (despite my not using iMessage, SMS, or iCloud) because I send them sometimes on Signal to people who save them in their iOS camera roll and have iCloud still enabled by default. (iCloud Photos, like iCloud Backup, is also not e2e.) (If your employer is pressuring you to do something you are not legally required to do and don't want to, it should immediately sound alarm bells and harder personal boundary defense.)
  - chii 5y ago
    > If your employer is pressuring you to do something you are not legally required to do and don't want to One should always put a price on actions your employer wants you to do, so that there's an economic back pressure. For example, if an employer forces you to use work phone as a personal phone for dogfooding purposes, you must extract a price out of your employer for giving up this privacy. Or quit, if the price the employer is too high for an employer to pay.
lamontcg 5y ago
This is why unions exist
deleted 5y ago
[deleted]
Terretta 5y ago
> Even now, if I go to the app store, the little icon for FB and their many other apps still says [GET] instead of the little cloud download thingy that means "you had this already". … and … > There is one thing I need to mention for anyone going the separate iCloud account route on corp devices: you probably should make sure you have it logged in from a personal Mac or something like that, or some other place where you can have passcodes sent. The reason is that if you should quit, you lose access to the authorized devices (phone, laptop) which will receive auth codes. > Assuming you ever want to turn that off, you're going to need some way into the account. If you don't have a way to approve the login and provide the passcode, fixing that is going to be rather difficult. > For this reason, you'll probably want to go create a separate non-admin account on your Mac, then associate it with that "burner" iCloud account, and just let it sit there. Don't use that account on the machine for anything else. Then, if you ever need to get back in and shut things down to stop the autopay stuff, you'll have a way. Use iCloud Family and make child accounts for corp devices. As the “parent” account, you control the “child” account, even if the company controls the device, and you can allow the child account to use the apps or music you own, track where the device goes, etc. etc..
- srswtf123 5y ago
  This feels like a solid tip, thank you. One question: can you specify separate payments methods per child account? It would be useful to have, for instance a personal Amex & corp Amex setup on the parent, and only the corp Amex available to the child.
  - lylo 5y ago
    Not sure you can. Possible to have multiple payment methods on the parent account which might be a workaround? https://discussions.apple.com/thread/6638275 https://discussions.apple.com/thread/6638275
barney54 5y ago
If companies want you to install certain apps on a phone, then they should be paying for the phone. It's that simple. I had a crazy boss 15 years ago who read our email. I learned after that to separate work and personal email. The same should be true for devices.
tehjoker 5y ago
> If you're like the younger version of me and can't afford to pick up another phone just to keep your work and personal lives separate, you may have to make some compromises in the name of not rocking the boat with your employer. If this happens, don't feel too bad about it. Every day, people have to suck it up and deal with relatively sketchy treatment from their employers, and can't speak up without fear of reprisal. Great reason to join a union.
- coffeefirst 5y ago
  Or, you know, we could also get the most egregious behavior banned. Once again these are technical solutions chasing a regulatory problem. Does it work? Sure, if you have the time, the money, the sophistication, and do everything perfectly in advance of an unlikely event. If you want to help most people, update the rules.
  - bwilliams18 5y ago
    [1]https://topclassactions.com/lawsuit-settlements/employment-labor/are-california-employers-required-to-reimburse-employees-for-cell-phone-use https://topclassactions.com/lawsuit-settlements/employment-l...
  - tehjoker 5y ago
    Unions aren't a technical solution. They are the natural opposing force. The state and corporations are nearly one, they cooperate, sometimes at the expense of individual companies to maintain labor peace.
    - coffeefirst 5y ago
      Right, I should have started with "And" instead of "Or." The rest of this thread is full of technical solutions. Unions are an excellent tactic for this.
khazhoux 5y ago
I’ve had two phones in my pocket the last 6 years. How this isn’t the obvious way to go is beyond me. I would cringe every time someone took a photo of Top Secret plans on whiteboard, where they get mixed right in with pics of their kid’s birthday party.
jrockway 5y ago
Yeah, it's never felt good to me to mix work and personal devices. I used to travel a lot and took two laptops with me; the work-issued laptop, and my own laptop. Work was done on the work laptop, everything else was done on my own. I heard rumors that screenshots were taken occasionally on work laptops, so I didn't really trust it for anything. I have no idea of those rumors were true. (Both were Chromebook Pixels, hilariously, and honestly the personal one was running my own build of Chrome OS so if Google wanted to spy on me, they could probably sneak the code past me. It's a big codebase.) I think the more interesting case is the growing startup. I mix work and personal, because work doesn't require any special software. I push code to Github and message people on Slack. But the day will come when for compliance reasons we need to be able to state that nobody who accessed production had a virus, or whatever, and I think that will be very interesting. Either we'll have to ask people to install what will be perceived as spyware, or we'll have to buy everyone a "work computer", which will probably be less powerful than whatever personal computer they have. I personally hate maintaining two computers -- I don't have the space for two desks, and I don't enjoy making the same customizations to both (no, dotfiles on Github doesn't cover everything unless I make a NixOS image with all the ancillary software I use). But, I also don't enjoy spyware on my personal computer. So I guess all I can do is hope that it never comes up as a compliance strategy -- but you know what they say: hope is not a strategy! ;)

260 points by picture 5y ago

If you’re working a tech job, you almost certainly have the bucks to get the extra device. Personally, I think it’s a bit scummy that a business would ask employees to do work on a device they didn’t pay for, but that’s a digression. The long and short of it, I think, is that you should keep things separate because a job is not forever so you should remain prepared to leave, and to keep them from snooping in your personal business. Yeah yeah that probably won’t happen, but if you keep em separate you know it won’t. MDM and similar also give them the ability to wipe the device at any time, for reasons that could have absolutely nothing to with you. You know, as a precaution, of course. Just save yourself the headache.

wccrawford 5y ago
I'm of the opinion that until I retire, I do not have the "extra money" to do anything for my job out of my own pocket. They can pay me for their requirements if they go against my better judgement. My current job does not require that I put anything on my phone, though I've chosen to check my work email there. I could take it off at any time, though, without repercussions. They've treated me well, there's nothing in my contract about their data on my devices, and I like to keep up with what's going on. If any of that changed, I'd remove it from my phone.

gnicholas 5y ago

> I realize that many people do not have the option to just go and drop a couple hundred bucks on an additional phone and then add another $100/mo to their budget for the service. I'd never pay a monthly fee for a work-only device. If they give me a work-only device, it should come with a data plan. If they don't give me a work-only device but want me to sign over access to my personal device, then I'll use an old device and just use wifi. No way I'm paying a separate monthly fee because my employer puts me between a rock and a hard place. Also, MVNOs are $20/mo, not $100.

deleted 5y ago
[deleted]
stronglikedan 5y ago
I took that to mean, not everyone who is provided a corporate device can afford a separate personal device and plan. I've never heard of a corporate device coming without a plan paid by corporate.
- gnicholas 5y ago
  Agree that corporate devices typically come with data plans. I took the $100 bit as a reference to the Lyft situation, where she was required to load a bunch of apps onto a mobile phone, but wasn't given a work device. So she bought a dedicated device with a one-time cost and apparently paid an ongoing monthly fee as well.
deleted 5y ago
[deleted]
sigio 5y ago
$2.50 here.... good thing to not be in the US :)
- squarefoot 5y ago
  Can you be more specific? I pay over here €10/month (phone not included) for unlimited calls and text in all EU and many other places abroad plus 100GB (I have an old plan, now it's 120GB for the same price) locally with decent coverage, and consider myself lucky. Actually there are cheaper options, although those companies have been a lot less user friendly. With this one (iliad.it) at least I can use a prepaid card to avoid unpleasant surprises and cancel anytime in a click.

saagarjha 5y ago

What I don’t really understand is how we ended up at the point where invasive MDM is even acceptable. People mix their work and personal lives all the time: even if I take my work laptop home and use it, it would be a massive overreach to show up at my house and demand that I let them search it. Why do we accept the equivalent for phones? Ok, I put company email on my phone: you should be able to wipe just that and retain a copy (which, running a central server, you do of course). Why should you have any right to do more than that?

jdbernard 5y ago
Because collectively we've given up caring about digital privacy as a society. You and I and maybe most of the HN crowd care, but most people don't. Not really. This is just a reflection of that broader value system.
- systemvoltage 5y ago
  Pardon me for the language, but it is fucked beyond repair. We've destroyed the planet. I wish to go back to analog life.
p2detar 5y ago
BYOD have clear separation of work and personal containers. Wiping all work stuff comes down to deleting the work profile from your personal device. This automatically removes all work related apps, accounts, media, etc.
- Rd6n6 5y ago
  I don’t think that byod at every company separates things that completely
  - Sunspark 5y ago
    It doesn't. They can enforce password policies, etc. Best practice is to have a second device just for the company.

aluminussoma 5y ago

In California, most companies that require after hours duties because engineers are on-call, provide a company issued cell phone device because of California Labor Code section 2802: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=2802&lawCode=LAB https://leginfo.legislature.ca.gov/faces/codes_displaySectio... The companies that do not do that are exposing themselves to unnecessary legal risk in the future.

toomuchtodo 5y ago
Would be fun to know which companies aren't for reporting purposes.

hbrav 5y ago

The most interesting thing about this is the linked article about the employer that tried a bit of sharp practice to insert additional clauses into the NDA: https://rachelbythebay.com/w/2011/11/09/signs/ https://rachelbythebay.com/w/2011/11/09/signs/ There's definitely a few morals to this story (but note: not legal advice! I am not a lawyer!): 1. You should keep your own copy of anything you sign as part of your employment contract. 2. You should maybe keep a record of when you handed that to your employer ("I did in fact sign a copy of the NDA when I began my employment, and handed it to [person] on [date]. I hope this helps you to locate it.") 3. If the NDAs are so long that it would be impractical to visually diff them, you can just ask the company: "Can you please ask [name of company lawyer] to send me an email confirming that this is the same NDA that I signed at the beginning of my employment on [date]?" If they do, and then later rely on a clause that has been inserted, I suspect they would have a hard time convincing a court to enforce that clause. 4. In the author's situation, they sound like they were over a bit of a barrel economically and it's hard to push back in that situation. If you are willing to push back, remember that your employer is asking for something from you, i.e. a change to your contract. And if that change is that they can audit your personal devices, that is not a small concession! "This NDA does differ substantially from the one I originally signed, and would represent a significant change in the conditions of my employment. I understand if the company has new security concerns, and I am willing to work constructively to find an acceptable solution. For instance, if you are uncomfortable with me being able to access work e-mail on my personal device, you can issue me with a separate device over which you would have auditing rights."

jessaustin 5y ago
"I did in fact sign a copy of the NDA when I began my employment, and handed it to [person] on [date]. I hope this helps you to locate it." I'm not sure how important this is. Of course they still have the old NDA, and in any perjury situation they would readily admit that. Managers and (especially) HR people regularly "fib" (synonym of "lie") in hopes of distracting attention from the monstrous demands of capital. If an employee made a big stink, that employee would be reminded that employment is at-will and thus contingent on signing whatever is required at any time. The worst NDA amendments could possibly be contested in court, if one wants to spend five figures on attorneys. Probably a better way to avoid surprise "renegotiations" is to unionize...

vincent-manis 5y ago

I had a job where I lived on planes and in airports (this was just before smartphones existed). The first day on the job, I logged in to the corporate network. It told me bluntly `This is the BigCorp network; there is no right to privacy'. The entire time I was there, I travelled with two laptops. I don't blame BigCorp for their policies; their equipment, their rules. But I strongly recommend separating the use of business and personal devices. And, no, if an employer demanded I install an app on my personal phone, I'd refuse.

duxup 5y ago
>if an employer demanded I install an app on my personal phone, I'd refuse. I did that once. In very polite terms I told them that I like to keep personal and work activity separate as much as possible for personal and work security reasons and that if they issued me a phone with an app I'd be happy to carry it. I got a very positive response. Ultimately they didn't think it was worth issuing me a phone and everyone went on happily.
dijit 5y ago
> And, no, if an employer demanded I install an app on my personal phone, I'd refuse. It’s increasingly common for employers to give payslips via a smartphone app; which needs to be installed on a personal phone of course. I’m one of the very few people to make a stink about it. But they’ve accommodated me after a lot of back and forth.
- belval 5y ago
  Do you really consider your payslips as work stuff? From a legal point of view it seems unlikely that they could claimed your device was used for work if it was used to transmit payslips. To me this doesn't seem comparable to having Slack/Email on your personal phone which means that some corporate possibly classified info made it to your device.
  - celticninja 5y ago
    It's the installation of a work specific app that would be the concern. We already know apps track behaviour, but your company knows exactly who you are and can track behaviour without aggregating it, thus getting a very clear view of what you do outside of work.

deleted 5y ago

[deleted]

discardable_dan 5y ago

If my employer wants to contact me outside of work hours, they better provide me a phone.

postalrat 5y ago
A phone seems to be a pretty low price to give up your privacy and time.
megous 5y ago
OTOH, unless you power it off when not in use, it's still a spying device. Your own devices can at least be somewhat trusted.

ectopod 5y ago

> Well, if you end up using any amount of storage (like backing up the device), they are going to want you to pay for it. You'll probably end up typing in a credit card number and all of that stuff. I don't get this bit. Are you expected to pay for the cloud backup of your work laptop with your own money?

teeray 5y ago

The shameful thing is that there is no earthly reason why we need separate devices. There should be appropriate isolation mechanisms so that corp-ware stays in corp-land and personal crap stays over on its side of the fence. We have dual sim devices now, so we can even assign entirely separate plans to different device partitions. Separate devices just create more senseless e-waste.

pydry 5y ago
im not sure id trust the isolation to be done properly.
danans 5y ago
> There should be appropriate isolation mechanisms so that corp-ware stays in corp-land and personal crap stays over on its side of the fence This already exists and I use it every day: separate work and personal profiles on the same device or app. I think most browsers support this out of the box. My phone's work profile actually shuts off automatically on vacation days from work and I have to consciously enable it if I want to check work email or chat.
- jessaustin 5y ago
  You might trust the isolation mechanisms, but that doesn't mean that all employers do.
  - yjftsjthsd-h 5y ago
    Okay? The original statement was, > The shameful thing is that there is no earthly reason why we need separate devices. There should be appropriate isolation mechanisms so that corp-ware stays in corp-land and personal crap stays over on its side of the fence. And we have that. Companies not trusting the tech is a separate problem.
  - deleted 5y ago
    [deleted]
  - deleted 5y ago

nayuki 5y ago

Somewhat related: https://news.ycombinator.com/item?id=28241753 https://news.ycombinator.com/item?id=28241753 "Apple explicitly asks employees to merge their personal and work accounts"

rcarmo 5y ago
That was flagged as bogus by a number of people from Apple.
- deleted 5y ago
  [deleted]

rcarmo 5y ago

This is another reason why I Remote Desktop to corporate machines from my personal ones. Fully insulated access to corporate stuff (I turn off file and printer sharing, obviously, although they’re usually disabled anyway), but I get to use my monitors, keyboard, mouse, etc. and don’t have to physically plug in anything.

lazypenguin 5y ago
I would like to do the same but I don’t want to run my employers vpn software on my machine (they don’t need to see my local machines network traffic). Does your work not use a vpn?
- yjftsjthsd-h 5y ago
  Depends on the VPN; at a previous job that used one, it was anyconnect, so I could just use openconnect on my local machine and never need anything that the company truly controlled locally
- SourPatch 5y ago
  You could run it all inside a virtual machine.
helsinki 5y ago
Yes, but I wonder how invasive something like Citrix Remote Client is? I wonder what it sends back to the remote server?

kbenson 5y ago

What ever happened to the future we all predicted or were told was coming a few years ago where we ran our phones like a hypervisor, and could actually segregate different controlling accounts into separate phone VMs? I imagine it was probably because it was too power intensive. She's entirely right IMO with the advice. Separating work and personal time is already so hard to do in some cases, and having my phone be a pseudo-work communicator does not help with that problem in any way. Disentangling them at the end of a employment relationship is likely much much harder (luckily I've only had to deal with this minimally).

fouc 5y ago
I assume there's not a lot of incentive to give the end-user that sort of power over their devices
- WrtCdEvrydy 5y ago
  BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Completely separated environment which allowed your work to just terminate the work environment remotely if you no longer needed access to it. You could even wipe the phone's work space when going through customs and remotely restore it from the BES Server.
  - kbenson 5y ago
    > BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Whether you think that's the best might depend on whether you're a an employee or employer. As an employee, I could see that being really annoying if someone pasted me a recreational link at work but I want to view it outside of a work context. For an employer that sounds like a nice way to keep data from leaking quite as easily though.
  - Sunspark 5y ago
    No, it was not completely separated. For example, admins could set a policy that required you to have a password on your personal space and could specify that it was a minimum # of digits, etc. I had a BB and this is one of the things that really soured me on BYOD. I didn't want a long alphanumeric password on my personal space that I had to change at the same frequency as the corporate password.

munk-a 5y ago

If a company offers me access to slack/email/whatever if I BYOD that's nice... but it's not something I'm going to take them up on unless 1) they're extremely young and don't have the infrastructure to manage things or 2) the responsibilities I'm taking on are so heavy that I feel the need to be always on call (and receive appropriate compensation). Otherwise, if you're hiring me as a developer, I will develop with all my effort during work hours... and then go home. If you occasionally need me to stay late to supervise an off-hours deploy that's cool - no worries... but if it ends up running 4+ hours over a normal work day I expect time in lieu (possibly just starting late the next day). I feel like I'm at the sort of ideal balance of defensiveness and compliance for an employee - I want to help make your company run better... but we signed an agreement on what I'll be compensated for that effort and what the expectations are and we'll stick to the agreement excepting sane and reasonable requests for minor deviations - a BYOD policy is not one of those. I am not pulling down half a mil - I don't even make six figures US - but I'm still expensive enough that a good work setup: computer, chair, keyboard that doesn't suck and phone if you need me to have it - are entirely incidental costs compared with my salary, employer taxes and health care costs. If you, as an employer, are going to try and make both of our lives more complicated over a one time 200$ cost to the company (and plan cost - which could be non-existent if wifi-only works for the phone) then you don't have your priorities straight (unless, again, you're like a three person startup then whatever - I get there's already way too much crap each person is trying to handle). I disagree with Rachel in the fact that I don't think it's ever a good idea to BYOD - even paying for it yourself. Cleaning company software off the device is going to be a pain - and it's going to be a pain when your employment ends which is a period in every job's life that could always use every advantage it can get to be drama free.

nijave 5y ago
It always blows my mind a company will pay an employee 5-6 figures (ish) (on top of all the other expenses an employer pays per employee) then refuse to hand out 3-4 figure equipment (cell phone + plan, performant workstation, etc) I think she was advocating for a completely separate BYOD/work device so the cleaning phase would be "wipe phone and sell on eBay" or simply "throw phone in the trash" (e.g. pay for a corporate-only device out of your salary)

brundolf 5y ago

> Around 2009 or 2010, the company decided to try to pull a fast one on some of us. They said that our original NDA somehow hadn't gotten signed (what?), and that we needed to re-sign it...Sure enough, they delivered, and sent me the original NDA. Note: they didn't send me AN original NDA they were using circa 2006 when I started. They sent me THE original NDA, complete with my signature from the day I started! Yes! > So then I started reading along, doing my best to do a 'diff' in wetware, and found that they had actually added some clauses. One of them amounted to 'taint' for your personal devices. Basically, if you signed in to your corp gmail from a device, they claimed the right to audit it at any point in the future. This kind of psychotic behavior is one reason I'll never work at a megacorp. I'm sure some smaller companies do it too, but it seems less common, and they won't have as many lawyers on retainer just waiting for the chance to justify their salary by pursuing it. And if I ever did find myself at a company that tried to pull something like this, I'd probably quit on the spot. I won't work in an environment where I'm having to constantly watch my back.

abawany 5y ago
I can confirm based on my experience that smaller companies do it this too. They may not have many lawyers on retainer but being small, they can (threaten to) walk you out immediately with no consequences, cut-and-paste irrelevant passages from other companies in the new NDA, and other assorted unnecessary nonsense.
oogali 5y ago
Don't just sign the last page. Initial every page. Always.
- zhte415 5y ago
  This has always been required for the mega-contracts I've had to sign, which have sometimes spanned hundreds of pages. Not only initial each page, but to have the pages cascaded so there's initials running over the margin of consecutive pages - this was required.
beh9540 5y ago
What I don’t understand about this is they were most likely an at-will employee. So the company could have just said “new policy, sign it”. I had an employer do this - I was working there a few years, owner came in and said “we’re doing background checks, fill this out and sign it”. I asked what happened if something came back on it, and he said that I’d be fired.

nindalf 5y ago

> Basically, when you quit, you have to go through this process of getting your number released from their mega-account with ATT or whatever, and that's just one more bit of turmoil in a time when you just want to be done with it. I did this about a month ago at the same company Rachel is talking about. It was dead simple. I created a task where I mentioned my personal email account. The next day they mailed me a porting key, which I relayed to my new carrier. It started working within a day. Haven't had an issue so far. I always felt that some of the writing on this blog had a tendency to make mountains out of mole hills. I can't say for sure about the rest of it, but this is definitely a mole hill.

gnicholas 5y ago
Agree that it's not hard to port numbers. I think the larger potential issue is if you are working for a smaller company that is not as smooth with these transactions, or if you end up with an acrimonious situation where — whoops, we forgot to give you the porting key and now your phone number has been lost and there's literally no way to pull it back.
- nindalf 5y ago
  Like I said, it might be different at other companies. I only pointed out at the specific company Rachel mentioned, the process is smooth.
wafflespotato 5y ago
As someone who no longer shares devices / numbers / ... with employers partly due to NDA shenanigans in the same vein as in this article and when I left that company they tried to make my life as difficult as possible and tried to withhold compensation and so on. Sure, in the happy path porting number is easy. But this assumes that * the company will be ok with you porting it out (and not just hold onto it out of spite, which I believe the company I worked for might have done) * the company will handle that kind of tickets in a reasonable amount of time * the company will not need to escalate this sort of request to levels where they will then be ignored * the company will be technically competent to handle this sort of request I'm not saying that all or even most companies will have these problems but the issue is that if the first thing you do when joining the company is port your number over, how can you know what the internal company culture is and if they will make it feasible for you to get your number back later on? This also ignores the big selling point of keeping your work accounts / numbers separate: being able to disconnect. Just being able to put your work laptop and phone away and know that you won't get called has it's own fairly large value.

ubermonkey 5y ago

I'm astonished some companies push the "user your own phone, which we now basically can control" angle. I mean, that's really shitty. I've been working for the same small software shop (single owner, and I trust him) for 14 years, so the entire development of the modern mobile ecosystem happened while I've been in this job. I use a personal laptop for all my work. I do this because I have Strong Preferences, and there's no way for the company to interfere with my computer. I can say this because (a) I trust the guy and (b) it's not actually possible for our corporate stuff to affect my personal stuff. (My computer isn't on the domain, for one thing; for another, we've all increasingly moved to "remote desktop into a VM in the colo" as a work pattern, even the devs, because it puts us all closer to the app servers and database servers. What device we use to reach the corporate environment is increasingly irrelevant.) But this is a post about what OTHER people should do. Most people aren't in my position. Anybody who works for a big corporation -- which I define as "anywhere your boss has a boss" -- should absolutely assume that Bullshit and Chicanery Will Ensue at some point, and treat your personal computing security accordingly. Don't cross the streams if you can at all avoid it. If you must, minimize exposure.

vcxnxgj 5y ago
careful. you're massively opening yourself up by using a personal machine for work. use hardware they own, with your configuration.
- ubermonkey 5y ago
  How? Understanding what I do is not something most people can do, and understanding I work 100% remote (as does our entire company), and understanding there is no way IT policy in our org can affect my hardware: How?
  - cryptonector 5y ago
    Subpoenas?
  - mrgordon 5y ago
    I believe the other poster is saying that by sending a work email from your laptop or probably even by connecting to the company servers through it, your device could be theoretically investigated as part of a lawsuit. If you don’t use it for email and just type SSH on it then admittedly they probably won’t have much to find, but they could still get access.

itronitron 5y ago

I guess I have been lucky to work in groups that were fairly focused on operational and personal security which requires quite a bit of separation between business and personal. Although the larger organization always has broad-brush security measures that lump it all together. Pretty sure my next phone will be a feature phone.

ShroudedNight 5y ago

> I also was given a PCI Express (see, I told you this was a long time ago) cellular device which would let me get online with the company laptop from anywhere it had service. Was this supposed to be PCMCIA or ExpressCard? It's not obvious to me how describing a laptop peripheral as being PCI Express-based is particularly effective at highlighting its anachronistic nature.

rachelbythebay 5y ago
Ah! You are in fact correct. It's so long ago, I screwed up the term for it. ExpressCard it is. In the words of everyone who's ever done a small fix, "reload".

killjoywashere 5y ago

This seems quaint to me. The real reason to not use a personal device for work is discovery. As soon as you do work someone can trace back to that device, there’s the potential for someone to seek a warrant for that device. Even if it’s some chucklehead you don’t even know within the corporation who’s being investigated, all you had to do was send an email to someone they sent an email to. And now the courts can demand your stuff. Let’s assume everything everyone does is perfectly legal, it’s still a massive inconvenience tax, and that alone is a good reason to not do it. I carry two phones and two machines (Corp laptop, personal iPad). They want me, they can give me the machines to contact me.

websites2023 5y ago
Yep. This has already bitten one employee of Apple: https://twitter.com/ashleygjovik/status/1428495420917837826?s=21 https://twitter.com/ashleygjovik/status/1428495420917837826?... It's a damn shame, and a good reason to never, ever mix work and personal devices.

nickjj 5y ago

The device discussion is really interesting on so many levels. Especially for non-phones and remote working. Let's say you live in a studio apartment and you have your own personal workstation set up how you like it. That would be a desktop workstation, couple of monitors, adjustable standing desk, some chair that you like, internet, etc.. Now a company wants to hire you and they want you to use a company issued laptop. This becomes a serious physical burden on both yourself and your limited space. Using a laptop without external monitors is horrible posture but if you're in a studio apartment you might not have enough space to use a completely separate desk, chair, couple of monitors, keyboard, mouse, etc.. We'll ignore the money aspect of having 2 distinct set ups which in the grand scheme of things isn't too big of a deal. There's not too many reasonable options here. The company's policy might not allow you to bring your own device and even if they let you use your personal computer, allowing them to audit that or install some remote desktop sharing software that they have free reign over would be total madness. It's also not that painless to quickly switch around HDMI (or even worse DVI) monitor cables. I suppose you could rig some type of HUB that lets you flip a switch to control which computer your monitors, keyboard, mouse, headphones, microphone, etc. are active for. This way you can use your desk setup for both, but now you can't use them at the same time which has its own set of issues. There's also issues like wanting to copy files from your personal machine to the work machine. So you might think ok I'll just allow SSH connections locally but now you've linked both machines to a point where having separation is useless, or maybe you decide to use an external drive that you can swap between both. In either case the work machine has been tainted.

treesknees 5y ago
You don't need to be a single bachelor in a studio apartment to have this problem. I'd argue most people who worked from home due to lockdowns have ran into this. My home office, while adequate, wasn't exactly setup to be writing code and hosting meetings in for 8 hours a day. I'm certainly not going to go out and buy a desk and chair just for my work laptop... I ended up buying a nicer desk and monitor stand. As someone else pointed out, I purchased a KVM switch to flip my monitor between personal and work machines. After a year of this I've just moved to setting my personal laptop to the side for music/email/etc and stopped using the KVM switch. It really wasn't a big deal and I wouldn't call it all that interesting.

EamonnMR 5y ago

I worked for a healthcare company where the deal was you could get email on your phone but only if you installed am app that would allow IT to remote-wipe your whole device at their discretion. I declined.

indigodaddy 5y ago

It is insanity that a company as “big” as Lyft is not providing a Corp phone to employees and forcing them to install and connect to so many work related apps and network elements on their own non-work-supplied phone. Absolute insanity.

nijave 5y ago
Not only that, they're expecting you to install beta Lyft to use it for dog fooding before they roll it out
- qq4 5y ago
  That's the second time I've seen that phrase in this thread. What does dog fooding mean in this context? Is it that dogs will eat anything? I don't understand.
  - sgerenser 5y ago
    “Dog fooding” comes from “to eat [one’s] own dogfood.” An analogy to a dog food producer claiming their product is so good that it’s tested by their (human) employees.
    - indigodaddy 5y ago
      The term has been around in IT for quite a long time too. It predates my career in tech for sure. I just read Showstopper! published in 1994, and the term was used in that book referencing when the NT developers were directed to use Windows NT on their systems way early on in the dev landscape of NT.

phdelightful 5y ago

My employer doesn't even really allow personal electronic devices on the network, though there is some provision for visitors of course. So if you need a phone they have to provide you one, same for a computer. The same security constraints also basically prohibit accessing work stuff from a personal device. We can't even get webmail, we have to access a managed desktop-as-a-seevice and get our email from there if we are on a personal device. And the facility is big enough that cell service sucks. I really appreciate the work/life firewall. Impossible to work on personal devices, impossible to use personal devices at work. And the security posture of them can be different

helsinki 5y ago
Speaking of managed remote desktops, I wonder how much localhost data the Citrix client sends to the company’s server?
- phdelightful 5y ago
  A fair question. It's VMware Horizon client or something like that in this case.

heroHACK17 5y ago

Recently joined a FAANG and did this same thing last week. 0 chance I'd install company software on my personal device.

slyall 5y ago

Just today (possibly related) someone else tweeted: Sooo, #Apple has pics of my boobs. During a discovery thing 3yr ago, legal forced me to hand-over all my texts. They refused to let me delete anything, even "fully personal," even when I said "by fully personal I mean nudes." They said they're in their "permanent evidence locker" I questioned this aggressively. Apple R&D pressures us to have one iPhone for work & personal (so we can "live on" / dogfood). I said, if there's texts that aren't with employees and have nothing to do with work, I should be able to delete them or at least attachments. "Nope." https://twitter.com/ashleygjovik/status/1428495420917837826 https://twitter.com/ashleygjovik/status/1428495420917837826

cryptonector 5y ago
You need three sets of personal devices to work at Apple then? Who knew.
sneak 5y ago
Apple already had her (and everyone else who iMessages) nudes: iCloud Backup is not e2e and is on by default and escrows either the iMessage plaintext or the iMessage sync keys to Apple, encrypted with Apple keys. Apple can read all of the stuff you text or iMessage if you (and all the people you text with) haven't disabled iCloud Backup. This goes for every iOS device in the world, not just Apple corporate ones. They even have my nudes (despite my not using iMessage, SMS, or iCloud) because I send them sometimes on Signal to people who save them in their iOS camera roll and have iCloud still enabled by default. (iCloud Photos, like iCloud Backup, is also not e2e.) (If your employer is pressuring you to do something you are not legally required to do and don't want to, it should immediately sound alarm bells and harder personal boundary defense.)
- chii 5y ago
  > If your employer is pressuring you to do something you are not legally required to do and don't want to One should always put a price on actions your employer wants you to do, so that there's an economic back pressure. For example, if an employer forces you to use work phone as a personal phone for dogfooding purposes, you must extract a price out of your employer for giving up this privacy. Or quit, if the price the employer is too high for an employer to pay.

lamontcg 5y ago

This is why unions exist

deleted 5y ago

[deleted]

Terretta 5y ago

> Even now, if I go to the app store, the little icon for FB and their many other apps still says [GET] instead of the little cloud download thingy that means "you had this already". … and … > There is one thing I need to mention for anyone going the separate iCloud account route on corp devices: you probably should make sure you have it logged in from a personal Mac or something like that, or some other place where you can have passcodes sent. The reason is that if you should quit, you lose access to the authorized devices (phone, laptop) which will receive auth codes. > Assuming you ever want to turn that off, you're going to need some way into the account. If you don't have a way to approve the login and provide the passcode, fixing that is going to be rather difficult. > For this reason, you'll probably want to go create a separate non-admin account on your Mac, then associate it with that "burner" iCloud account, and just let it sit there. Don't use that account on the machine for anything else. Then, if you ever need to get back in and shut things down to stop the autopay stuff, you'll have a way. Use iCloud Family and make child accounts for corp devices. As the “parent” account, you control the “child” account, even if the company controls the device, and you can allow the child account to use the apps or music you own, track where the device goes, etc. etc..

srswtf123 5y ago
This feels like a solid tip, thank you. One question: can you specify separate payments methods per child account? It would be useful to have, for instance a personal Amex & corp Amex setup on the parent, and only the corp Amex available to the child.
- lylo 5y ago
  Not sure you can. Possible to have multiple payment methods on the parent account which might be a workaround? https://discussions.apple.com/thread/6638275 https://discussions.apple.com/thread/6638275

barney54 5y ago

If companies want you to install certain apps on a phone, then they should be paying for the phone. It's that simple. I had a crazy boss 15 years ago who read our email. I learned after that to separate work and personal email. The same should be true for devices.

tehjoker 5y ago

> If you're like the younger version of me and can't afford to pick up another phone just to keep your work and personal lives separate, you may have to make some compromises in the name of not rocking the boat with your employer. If this happens, don't feel too bad about it. Every day, people have to suck it up and deal with relatively sketchy treatment from their employers, and can't speak up without fear of reprisal. Great reason to join a union.

coffeefirst 5y ago
Or, you know, we could also get the most egregious behavior banned. Once again these are technical solutions chasing a regulatory problem. Does it work? Sure, if you have the time, the money, the sophistication, and do everything perfectly in advance of an unlikely event. If you want to help most people, update the rules.
- bwilliams18 5y ago
  [1]https://topclassactions.com/lawsuit-settlements/employment-labor/are-california-employers-required-to-reimburse-employees-for-cell-phone-use https://topclassactions.com/lawsuit-settlements/employment-l...
- tehjoker 5y ago
  Unions aren't a technical solution. They are the natural opposing force. The state and corporations are nearly one, they cooperate, sometimes at the expense of individual companies to maintain labor peace.
  - coffeefirst 5y ago
    Right, I should have started with "And" instead of "Or." The rest of this thread is full of technical solutions. Unions are an excellent tactic for this.

khazhoux 5y ago

I’ve had two phones in my pocket the last 6 years. How this isn’t the obvious way to go is beyond me. I would cringe every time someone took a photo of Top Secret plans on whiteboard, where they get mixed right in with pics of their kid’s birthday party.

jrockway 5y ago

Yeah, it's never felt good to me to mix work and personal devices. I used to travel a lot and took two laptops with me; the work-issued laptop, and my own laptop. Work was done on the work laptop, everything else was done on my own. I heard rumors that screenshots were taken occasionally on work laptops, so I didn't really trust it for anything. I have no idea of those rumors were true. (Both were Chromebook Pixels, hilariously, and honestly the personal one was running my own build of Chrome OS so if Google wanted to spy on me, they could probably sneak the code past me. It's a big codebase.) I think the more interesting case is the growing startup. I mix work and personal, because work doesn't require any special software. I push code to Github and message people on Slack. But the day will come when for compliance reasons we need to be able to state that nobody who accessed production had a virus, or whatever, and I think that will be very interesting. Either we'll have to ask people to install what will be perceived as spyware, or we'll have to buy everyone a "work computer", which will probably be less powerful than whatever personal computer they have. I personally hate maintaining two computers -- I don't have the space for two desks, and I don't enjoy making the same customizations to both (no, dotfiles on Github doesn't cover everything unless I make a NixOS image with all the ancillary software I use). But, I also don't enjoy spyware on my personal computer. So I guess all I can do is hope that it never comes up as a compliance strategy -- but you know what they say: hope is not a strategy! ;)