3 ms·

What ever happened to the future we all predicted or were told was coming a few years ago where we ran our phones like a hypervisor, and could actually segregat

What ever happened to the future we all predicted or were told was coming a few years ago where we ran our phones like a hypervisor, and could actually segregate different controlling accounts into separate phone VMs? I imagine it was probably because it was too power intensive. She's entirely right IMO with the advice. Separating work and personal time is already so hard to do in some cases, and having my phone be a pseudo-work communicator does not help with that problem in any way. Disentangling them at the end of a employment relationship is likely much much harder (luckily I've only had to deal with this minimally).

fouc 5y ago
I assume there's not a lot of incentive to give the end-user that sort of power over their devices
- WrtCdEvrydy 5y ago
  BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Completely separated environment which allowed your work to just terminate the work environment remotely if you no longer needed access to it. You could even wipe the phone's work space when going through customs and remotely restore it from the BES Server.
  - kbenson 5y ago
    > BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Whether you think that's the best might depend on whether you're a an employee or employer. As an employee, I could see that being really annoying if someone pasted me a recreational link at work but I want to view it outside of a work context. For an employer that sounds like a nice way to keep data from leaking quite as easily though.
  - Sunspark 5y ago
    No, it was not completely separated. For example, admins could set a policy that required you to have a password on your personal space and could specify that it was a minimum # of digits, etc. I had a BB and this is one of the things that really soured me on BYOD. I didn't want a long alphanumeric password on my personal space that I had to change at the same frequency as the corporate password.
yjftsjthsd-h 5y ago
I'm pretty sure you can do exactly that. On Android it's called a Work Profile, and I assume Apple has an equivalent although I don't know anything about it. It's not a VM, but the access is sufficiently constrained that it should be good enough against anything but a really malicious actor of an employer.
- masklinn 5y ago
  The problem is when corporate policy considers that the device you work with essentially belongs to them and can be managed remotely or audited at any moment.
  - Rebelgecko 5y ago
    If you're using work profile and the company doesn't literally own the phone, there's not much they can do. Remote management (such as remotely doing a factory reset) only impacts the work profile. I think the only thing they can do outside of the work profile is check what version of Android you're on to see if you have the latest updates
- kbenson 5y ago
  Hmm, I recall profiles being talked about in the past, but seem to have missed when they rolled out, or forgotten about them. I don't think they necessarily solve the problem entirely, but I'll definitely look into them to see if they're useful to me now that you've reminded me. Thanks!
Wowfunhappy 5y ago
I was thinking about something similar along these lines—why draw the boundary at the physical device in your hands? From the article: > So then I started reading along, doing my best to do a 'diff' in wetware, and found that they had actually added some clauses. One of them amounted to 'taint' for your personal devices. Basically, if you signed in to your corp gmail from a device, they claimed the right to audit it at any point in the future. But iOS apps are supposed to be sandboxed! So as long as I install a separate Mail app for my work email, my company should have no justification for auditing anything else on my iPhone, right? Or, going in the other direction—what if my company wants to audit every device connected to the same wifi network as my work phone? Why wouldn’t they want to do that? Is it really any different?
- kbenson 5y ago
  > If iOS apps are all supposed to be sandboxed, I should be able to just install a different Mail app for my work email, and continue on my way with my one iPhone, right? If you're talking about keeping them logically separated on the device, you already get this on any Android phone. You can install different mail apps and use a different one for each account if you like. You can even do it with GMail accounts if you're willing to use GMail through IMAP (but I think you're out of luck for whatever Google calls their chat platform this week). The problem is that it's hard to distinguish between work and personal notifications when not working (and vice versa). Giving me the ability to take a VMs running and mute them (or mute them except if they blow up with notifications, or provide a single notification on the main interface telling me there's X notifications waiting on the work VM that updates once every hour or so) would be a real benefit. Not as much as a totally separate device, but also it wouldn't necessarily be as expensive or require more physical space.
  - deleted 5y ago
    [deleted]
  - Wowfunhappy 5y ago
    It's not about UX so much as company policies. I edited my post a bit to clarify the part of the article I was referencing.
adrianmonk 5y ago
https://support.google.com/work/android/answer/6191949 https://support.google.com/work/android/answer/6191949 > A work profile can be set up on an Android device to separate work apps and data from personal apps and data. With a work profile you can securely and privately use the same device for work and personal purposes—your organization manages your work apps and data while your personal apps, data, and usage remain private. There are other features aside from keeping apps separate. You can deny location data to apps running under the work profile. You can pause a work profile so you don't get work interruptions on the weekend. You can make phone calls from a separate dialer in the work profile, and it keeps a separate call history.

fouc 5y ago

I assume there's not a lot of incentive to give the end-user that sort of power over their devices

WrtCdEvrydy 5y ago
BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Completely separated environment which allowed your work to just terminate the work environment remotely if you no longer needed access to it. You could even wipe the phone's work space when going through customs and remotely restore it from the BES Server.
- kbenson 5y ago
  > BB10's implementation of this was the best... you couldn't even copy paste between the work space and the personal space. Whether you think that's the best might depend on whether you're a an employee or employer. As an employee, I could see that being really annoying if someone pasted me a recreational link at work but I want to view it outside of a work context. For an employer that sounds like a nice way to keep data from leaking quite as easily though.
- Sunspark 5y ago
  No, it was not completely separated. For example, admins could set a policy that required you to have a password on your personal space and could specify that it was a minimum # of digits, etc. I had a BB and this is one of the things that really soured me on BYOD. I didn't want a long alphanumeric password on my personal space that I had to change at the same frequency as the corporate password.

yjftsjthsd-h 5y ago

I'm pretty sure you can do exactly that. On Android it's called a Work Profile, and I assume Apple has an equivalent although I don't know anything about it. It's not a VM, but the access is sufficiently constrained that it should be good enough against anything but a really malicious actor of an employer.

masklinn 5y ago
The problem is when corporate policy considers that the device you work with essentially belongs to them and can be managed remotely or audited at any moment.
- Rebelgecko 5y ago
  If you're using work profile and the company doesn't literally own the phone, there's not much they can do. Remote management (such as remotely doing a factory reset) only impacts the work profile. I think the only thing they can do outside of the work profile is check what version of Android you're on to see if you have the latest updates
kbenson 5y ago
Hmm, I recall profiles being talked about in the past, but seem to have missed when they rolled out, or forgotten about them. I don't think they necessarily solve the problem entirely, but I'll definitely look into them to see if they're useful to me now that you've reminded me. Thanks!

Wowfunhappy 5y ago

I was thinking about something similar along these lines—why draw the boundary at the physical device in your hands? From the article: > So then I started reading along, doing my best to do a 'diff' in wetware, and found that they had actually added some clauses. One of them amounted to 'taint' for your personal devices. Basically, if you signed in to your corp gmail from a device, they claimed the right to audit it at any point in the future. But iOS apps are supposed to be sandboxed! So as long as I install a separate Mail app for my work email, my company should have no justification for auditing anything else on my iPhone, right? Or, going in the other direction—what if my company wants to audit every device connected to the same wifi network as my work phone? Why wouldn’t they want to do that? Is it really any different?

kbenson 5y ago
> If iOS apps are all supposed to be sandboxed, I should be able to just install a different Mail app for my work email, and continue on my way with my one iPhone, right? If you're talking about keeping them logically separated on the device, you already get this on any Android phone. You can install different mail apps and use a different one for each account if you like. You can even do it with GMail accounts if you're willing to use GMail through IMAP (but I think you're out of luck for whatever Google calls their chat platform this week). The problem is that it's hard to distinguish between work and personal notifications when not working (and vice versa). Giving me the ability to take a VMs running and mute them (or mute them except if they blow up with notifications, or provide a single notification on the main interface telling me there's X notifications waiting on the work VM that updates once every hour or so) would be a real benefit. Not as much as a totally separate device, but also it wouldn't necessarily be as expensive or require more physical space.
- deleted 5y ago
  [deleted]
- Wowfunhappy 5y ago
  It's not about UX so much as company policies. I edited my post a bit to clarify the part of the article I was referencing.

adrianmonk 5y ago

https://support.google.com/work/android/answer/6191949 https://support.google.com/work/android/answer/6191949 > A work profile can be set up on an Android device to separate work apps and data from personal apps and data. With a work profile you can securely and privately use the same device for work and personal purposes—your organization manages your work apps and data while your personal apps, data, and usage remain private. There are other features aside from keeping apps separate. You can deny location data to apps running under the work profile. You can pause a work profile so you don't get work interruptions on the weekend. You can make phone calls from a separate dialer in the work profile, and it keeps a separate call history.