5 ms·

As a software eng something that bothers me is that every single employer that I have worked for has assumed that you would have no problem installing work-rela

As a software eng something that bothers me is that every single employer that I have worked for has assumed that you would have no problem installing work-related software on your phone. The most common offender is MFA related software. I run GrapheneOS on my phone and don't have the Google Play stuff installed. And kind of the entire point of this is that I don't want to run proprietary, closed-source stuff on my phone at all. I also like not having a ton of bloatware/spyware installed by the manufacturer that I can't remove. So anyway, I usually protest and say that I can't, and that if I'm required to use a mobile device for work purposes then I need the company to provide me with one. Often arrangements can be made by requesting a device that can double for other work related functions. For example, I currently have a work-issued iPad with Okta Verify installed on it that also let's me reach for Safari and do iOS specific dev & testing when needed. But it does show the creep. Companies just assume that they can request that you use your mobile device for things that you otherwise wouldn't, and that you will have no problem complying. IMO saying either "I don't own a smartphone" or "I refuse to use my personal devices for work related purposes" should be a no-questions-asked accepted position. And while I've yet to be met with hostility by saying that, it is unfortunately such a minority position that it is almost always the first time they've heard an objection.

cesarb 3y ago
> IMO saying either "I don't own a smartphone" or "I refuse to use my personal devices for work related purposes" should be a no-questions-asked accepted position. And while I've yet to be met with hostility by saying that, it is unfortunately such a minority position that it is almost always the first time they've heard an objection. Being at a more security-conscious (or paranoid) company can help in that case: they also don't want you to have work related things (other than MFA related software) on your personal devices, so the incentives align.
- Consultant32452 3y ago
  I spent a few years as an okta engineer implementing MFA. Sometimes they buy you an MFA device, but most companies just degrade their security by letting you use phone mfa (even using your work desk phone for mfa). This, of course, is not the fault/problem of the people who refuse to install mfa on their personal device. Good for them.
- Freak_NL 3y ago
  Definitely. It's just so much easier to have a policy of 'no company data on personal devices' and just hand out the devices people need for their work. Easy to explain to auditors too (think ISO 27001). For devs and support this means a laptop, and for ops and management a smartphone is usually needed too. The only reason I have a phone on me when I'm at the office is for school to reach me in case my kid is taken ill or something like that.
  - ryandrake 3y ago
    I would never put work stuff on my personal phone. Keep those lives separate. I seem to remember a story here a few years ago where someone's company got sued, and they demanded her personal phone (full of nudes and other personal info) for legal discovery because she used it for both personal and work stuff. Don't cross the streams, people! If [company] needs me to do work on a phone, they need to provide the phone. Then they are welcome to remote-wipe it, install whatever Spyware and LockdownWare they need to, and have it back whenever they want it. I don't care.
jameshart 3y ago
Installing an MFA token in your phone is just using a convenient place to keep tokens, not an imposition on you. Objecting to being asked to keep MFA tokens on your phone is like saying 'where am I supposed to keep this keycard to get into the building? In my own personal WALLET?'
- gspencley 3y ago
  1. I wasn't talking about tokens, I was talking about requiring employees to install software on their personal devices. 2. You don't need to own a wallet to use a keycard.
  - jameshart 3y ago
    2FA tokens these days broadly follow TOTP and HOTP standards, meaning you can use any token manager you like to handle them. The iOS password manager even has inbuilt 2FA token support now. You shouldn’t have to install software just for managing corporate 2FA tokens any more than you need to buy a proprietary keyring to hold your desk drawer key.
mindslight 3y ago
I agree with where you're coming from, but half the problem is caused by this needless bundling, putting everything on a single device. A cheap used tablet is like $100. Get one just for work junk. Use it when you need it, otherwise forget about it. Having to spend that money yourself to help corporate check some compliance box is certainly over the line of what should be, but depending on how much you'd otherwise have to argue it's perhaps a better use of your time. In general I find segmenting things across devices a great way of mitigating overstimulation hell. Like most people I've got some trash toilet game I've become habituated to, but I only do so on a particular device that otherwise stays home. If I'm out and about and have to wait for a few minutes, there's zero temptation to pull it out and check in. Also it's simply unable to surveil my movements, as opposed to say trusting the OS permission system plus having to work around its shortcomings with something like an always-on VPN.

cesarb 3y ago

> IMO saying either "I don't own a smartphone" or "I refuse to use my personal devices for work related purposes" should be a no-questions-asked accepted position. And while I've yet to be met with hostility by saying that, it is unfortunately such a minority position that it is almost always the first time they've heard an objection. Being at a more security-conscious (or paranoid) company can help in that case: they also don't want you to have work related things (other than MFA related software) on your personal devices, so the incentives align.

Consultant32452 3y ago
I spent a few years as an okta engineer implementing MFA. Sometimes they buy you an MFA device, but most companies just degrade their security by letting you use phone mfa (even using your work desk phone for mfa). This, of course, is not the fault/problem of the people who refuse to install mfa on their personal device. Good for them.
Freak_NL 3y ago
Definitely. It's just so much easier to have a policy of 'no company data on personal devices' and just hand out the devices people need for their work. Easy to explain to auditors too (think ISO 27001). For devs and support this means a laptop, and for ops and management a smartphone is usually needed too. The only reason I have a phone on me when I'm at the office is for school to reach me in case my kid is taken ill or something like that.
- ryandrake 3y ago
  I would never put work stuff on my personal phone. Keep those lives separate. I seem to remember a story here a few years ago where someone's company got sued, and they demanded her personal phone (full of nudes and other personal info) for legal discovery because she used it for both personal and work stuff. Don't cross the streams, people! If [company] needs me to do work on a phone, they need to provide the phone. Then they are welcome to remote-wipe it, install whatever Spyware and LockdownWare they need to, and have it back whenever they want it. I don't care.

jameshart 3y ago

Installing an MFA token in your phone is just using a convenient place to keep tokens, not an imposition on you. Objecting to being asked to keep MFA tokens on your phone is like saying 'where am I supposed to keep this keycard to get into the building? In my own personal WALLET?'

gspencley 3y ago
1. I wasn't talking about tokens, I was talking about requiring employees to install software on their personal devices. 2. You don't need to own a wallet to use a keycard.
- jameshart 3y ago
  2FA tokens these days broadly follow TOTP and HOTP standards, meaning you can use any token manager you like to handle them. The iOS password manager even has inbuilt 2FA token support now. You shouldn’t have to install software just for managing corporate 2FA tokens any more than you need to buy a proprietary keyring to hold your desk drawer key.

mindslight 3y ago

I agree with where you're coming from, but half the problem is caused by this needless bundling, putting everything on a single device. A cheap used tablet is like $100. Get one just for work junk. Use it when you need it, otherwise forget about it. Having to spend that money yourself to help corporate check some compliance box is certainly over the line of what should be, but depending on how much you'd otherwise have to argue it's perhaps a better use of your time. In general I find segmenting things across devices a great way of mitigating overstimulation hell. Like most people I've got some trash toilet game I've become habituated to, but I only do so on a particular device that otherwise stays home. If I'm out and about and have to wait for a few minutes, there's zero temptation to pull it out and check in. Also it's simply unable to surveil my movements, as opposed to say trusting the OS permission system plus having to work around its shortcomings with something like an always-on VPN.