3 ms·

> IMO saying either "I don't own a smartphone" or "I refuse to use my personal devices for work related purposes" should be a no-questions-asked accepted positi

by cesarb 3y ago

> IMO saying either "I don't own a smartphone" or "I refuse to use my personal devices for work related purposes" should be a no-questions-asked accepted position. And while I've yet to be met with hostility by saying that, it is unfortunately such a minority position that it is almost always the first time they've heard an objection. Being at a more security-conscious (or paranoid) company can help in that case: they also don't want you to have work related things (other than MFA related software) on your personal devices, so the incentives align.

Consultant32452 3y ago
I spent a few years as an okta engineer implementing MFA. Sometimes they buy you an MFA device, but most companies just degrade their security by letting you use phone mfa (even using your work desk phone for mfa). This, of course, is not the fault/problem of the people who refuse to install mfa on their personal device. Good for them.
Freak_NL 3y ago
Definitely. It's just so much easier to have a policy of 'no company data on personal devices' and just hand out the devices people need for their work. Easy to explain to auditors too (think ISO 27001). For devs and support this means a laptop, and for ops and management a smartphone is usually needed too. The only reason I have a phone on me when I'm at the office is for school to reach me in case my kid is taken ill or something like that.
- ryandrake 3y ago
  I would never put work stuff on my personal phone. Keep those lives separate. I seem to remember a story here a few years ago where someone's company got sued, and they demanded her personal phone (full of nudes and other personal info) for legal discovery because she used it for both personal and work stuff. Don't cross the streams, people! If [company] needs me to do work on a phone, they need to provide the phone. Then they are welcome to remote-wipe it, install whatever Spyware and LockdownWare they need to, and have it back whenever they want it. I don't care.

by cesarb 3y ago

Consultant32452 3y ago

I spent a few years as an okta engineer implementing MFA. Sometimes they buy you an MFA device, but most companies just degrade their security by letting you use phone mfa (even using your work desk phone for mfa). This, of course, is not the fault/problem of the people who refuse to install mfa on their personal device. Good for them.

Freak_NL 3y ago

Definitely. It's just so much easier to have a policy of 'no company data on personal devices' and just hand out the devices people need for their work. Easy to explain to auditors too (think ISO 27001). For devs and support this means a laptop, and for ops and management a smartphone is usually needed too. The only reason I have a phone on me when I'm at the office is for school to reach me in case my kid is taken ill or something like that.

ryandrake 3y ago
I would never put work stuff on my personal phone. Keep those lives separate. I seem to remember a story here a few years ago where someone's company got sued, and they demanded her personal phone (full of nudes and other personal info) for legal discovery because she used it for both personal and work stuff. Don't cross the streams, people! If [company] needs me to do work on a phone, they need to provide the phone. Then they are welcome to remote-wipe it, install whatever Spyware and LockdownWare they need to, and have it back whenever they want it. I don't care.