10 ms·

My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no ma

My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no management software on it, from the “Early Days” when there was no IT and we just got brand new untouched laptops. They offered me an upgrade to an M1/M2 pro, but I refused, saying that I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Since that would hugely disrupt my work, I can’t upgrade. Maybe I can use incidents like this to justify my beliefs to the IT department…

verve_rat 3y ago
Why do you need personal passwords on your laptop to do your work? I'm not understanding this.
- BytesAndGears 3y ago
  Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos from my travel with coworkers, synching docs related to my work visa and taxes * Personal slack login for communicating with my partner in our private server * personal GitHub account credentials for synching my private dotfiles repo with my neovim config. basically can’t work without my dotfiles, but I could theoretically email these to myself or something, to prevent this one. And sure, I could be stubborn and not use any of this, but I’d be way less productive and kinda miserable.
  - MichaelZuo 3y ago
    Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?
    - BytesAndGears 3y ago
      Convenience, I suppose… and that doesn’t solve all of the issues (eg Copilot) I’m fine with it because I know there’s no management software on this laptop, but yeah it’s a totally different story if I had to use a newer one with SSO and management software
      - MichaelZuo 3y ago
        Part of the comp. package is presumably paying for you to endure some level of inconvenience at the company's request. Such as isolating work and personal things on separate systems. At least that's how it works in the vast majority of companies.
    - jen729w 3y ago
      I’ve been in the same situation. With two laptops you lose the ability to, say, send email directly to your task system. It’s really easy to say ‘don’t use your personal stuff at work’, but when work is some locked-down behemoth whose view of productivity software is ‘just use Office’, and you’re really trying to be better at your job, using your own tools can be the only solution. And in my situation, yeah, they didn’t want you bringing things in. I worked in a secure area.
      - pests 3y ago
        Then you need to let the employer see your lack of productivity when you are limited by the locked-down system. Finding solutions to work around the systems, on your own time and dime, only hurts in the long run. They think everything is fine. Nothing will ever get fixed. Voice these concerns.
        comex 3y ago
        Hurts who? If you’ve worked around it then it doesn’t hurt you, at least not too badly. It still hurts the company as a whole. But is that your problem? You might feel a sense of social obligation or solidarity with the company. I usually do. But if I was placed in a dehumanizing situation like that – forced to work inefficiently due to overly rigid policies that assume everyone’s needs are the same – well, whether I worked around it or not, my empathy for the company would be at a nadir whenever I thought about it.
  - hinkley 3y ago
    * Jetbrains * Stack Overflow * Job Search sites I don't remember if Jetbrains needs a password to get to personal licenses, but they definitely do to use their bug database. I suspect they're not the only one. Letting other people blow off steam can be an act of self-preservation. Insisting that people only ever do 100% work things at work or on work hardware slightly raises your low-but-never-zero chances of being murdered by coworkers. Or less ironically, hilariously intense bridge-burning activities. Also most of this conversation is happening during work hours so I think we can infer that grandparent is being a little hypocritical.
  - _boffin_ 3y ago
    Let me get this straight… you’re taking privileged company information and transferring it to personal… I’m now understanding how people get sued when going from company to company.
    - BytesAndGears 3y ago
      Certainly nothing privileged! Moreso just reminders about “follow up with person x” and that kind of thing
      - _boffin_ 3y ago
        Let me ask you one follow up question: if you and the company had a disagreement of sorts and they examined your activity, would you believe they find nothing that they’d deem privileged?
      - foobarian 3y ago
        We are probably all little people here, and nothing like this would ever happen, but say you were high profile enough like that Google self-driving guy that Uber poached, and there was a lawsuit - anything you did on that computer would be up for grabs. All your personal projects, documentation, DMs.. it would be super messy. I’m pretty sure companies like having this kind of situation because it gives them legal ammo in the rare case where there is an action.
  - sneak 3y ago
    > personal Trello account for keeping track of my todo list. > personal Obsidian for keeping meeting notes, and recording conversations as a personal knowledge-base I'm not a lawyer, but I'm pretty sure these could subject a lot of your other personal data to potential subpoena should your employer get sued by a sufficiently determined attacker. Don't cross the streams.
    - BytesAndGears 3y ago
      Ooh actually that’s the most compelling reason I’ve heard. I think I might actually split out those accounts with this reasoning.
    - marksomnian 3y ago
      Also it's a violation of Obsidian's license: > Obsidian is free for personal and non-profit use. However, if you use Obsidian for work-related activities that generate revenue in a company with two or more people, you must purchase a commercial license for each user. Non-profit organizations are exempt from this requirement. https://obsidian.md/license https://obsidian.md/license
      - tuckerman 3y ago
        Perhaps they pay for a commercial license? > Q3. Can I buy a license for myself, or do I have to ask my company to buy it for me? > Yes, you can buy a license for yourself; just put your name in the company > field. You can use such a license to work for any company. https://help.obsidian.md/Licenses+and+payment/Commercial+license https://help.obsidian.md/Licenses+and+payment/Commercial+lic...
  - kccqzy 3y ago
    You use so many personal accounts for work that it's unfathomable for me. If some hacker manages to hack into your account and find so much valuable information about your work, your work is going to be mightily pissed about it. Imagine you are working on an upcoming product launch and the attacker used your personal account to leak the launch. Or imagine they just decided to leak your company's internal source code. Or imagine they simply use the technical information in your personal attacks to steal user data (even Cloudflare says they worry about this: "Our aim was to prevent the attacker from using the technical information about the operations of our network as a way to get back in"). You are making your work take on an extraordinary risk in hiring you.
    - BytesAndGears 3y ago
      It’s a fair concern, but there really isn’t so much there. If they compromise my trello account then they know I have some meetings coming up with people, and that I’m starting on ticket 927109 and planning to deploy ticket 901223 on Tuesday. Just referencing items in our ticket management system with very sparse details. My notes are text files on the computer, so we’d have problems regardless if they got that. But maybe I should’ve left it out of the list above in that case… nothing else seems very damning. But you do raise a valid concern, and it’s worth reevaluating!
  - DANmode 3y ago
    This all makes perfect sense - but just seems like your employer is too large to be effective, they're not offering you the right tools/you're not demanding them, and you're in an abusive relationship with them - probably because they pay you well enough.
- deathanatos 3y ago
  The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.) Also, people just do things for convenience. (Although I tend to pipe these passwords over an SSH connection, so that they're not resident on the work laptop. Though there is a good argument to be had about me permitting my work laptop SSH access to my personal laptop. From a technical standpoint, my employer could hack/compromise my personal laptop. From a legal and trust standpoint, I presume they won't.)
  - sneak 3y ago
    It's not extreme at all, it's the bare minimum that professionals do. Absolutely none of my personal stuff ever touches a corporate machine. Ever. I wouldn't even log in to the W2 downloading app as an employee from the work machine. Granting work ssh keys access to your personal machine is crazy; if your work machine gets compromised, they steal your entire personal system's home directory too. Why would you unnecessarily expand the blast radius of a compromise like this?
    - cqqxo4zV46cp 3y ago
      I love these sorts of comments. Could you please just be more direct and call GP “not a professional” for not working in the way that you do? It’s so unnecessarily passive-aggressive.
      - bpt3 3y ago
        You are really, really, really sensitive about this. I wonder why? GP said nothing of the sort.
        Symbiote 3y ago
        GP wrote "it's the bare minimum that professionals do".
yjftsjthsd-h 3y ago
> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?
- Symbiote 3y ago
  A Github account, for one possible example.
  - pizzalife 3y ago
    Well, why? It just seems risky. Everything you make on your work laptop / during work hours is typically owned by your employer. If your employer is paying you to contribute to OSS, don't use your personal github account. Just don't ever mix personal and company accounts on company hardware.
    - electroly 3y ago
      Note that if you do make a second account, at least one of them must be a paid account. A single person cannot have multiple free accounts and GitHub does not care if it's because one is for work; it's in the TOS.
      - 2devnull 3y ago
        There is no way around that restriction either.
      - computerfriend 3y ago
        I have blissfully been unaware of this. Have even linked free accounts with the account switcher. I'd say this is fairly unenforced.
    - da768 3y ago
      The typical work contract also extends to outside work hours and personal devices.
  - 3y ago
samcat116 3y ago
> new laptops that are preinstalled with Okta’s management system Okta doesn't make device management software, thats made by companies like Jamf. Okta can integrate with them but Okta isn't what manages your laptop at all. > I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Do not do this, its not a personal device.
- michaelt 3y ago
  > Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you could write IT security policy for a Fortune 100 company :)
  - da768 3y ago
    Nothing a smartphone can't do. Even companies with these policies preinstall Spotify on work computers.
  - midasuni 3y ago
    I’ve had company devices for over 20 years. I’m currently on the way back to my hotel. I refuse to carry more than one phone or one laptop, and I sure ain’t brining a personal device into a country I wouldnt go to on vacation.
    - DANmode 3y ago
      > I refuse to carry more than one phone or one laptop Footgun, but maybe tolerable with your chosen threat model.
    - autoexec 3y ago
      Totally agree on travel. If I'm getting on a plane for work I don't want to bring my own devices. I can't even trust that my own country won't steal/copy my devices at the border.
deleted 3y ago
[deleted]
ocdtrekkie 3y ago
I wouldn't use Okta at work, but as a network administrator, I also wouldn't allow your improperly managed laptop to talk to business resources (and I'd demand anyone overruling me sign a written statement demanding it to exempt me for responsibility for it). Wild you work somewhere that is letting you get away with that.
prg20 3y ago
IT departments do not care for the musings of self-proclaimed neckbeards. The arrogance of such users to comfort to security policy is a well known risk and usually grounds for swift disciplinary action.
giancarlostoro 3y ago
At a former employer, the company wanted everyone's machine to have full hard drive encryption, thankfully we were on Linux and the vendor they wanted to use was not compatible. Even so, I always encrypt my installs on laptops, not so much workstations (I didn't install it, and reinstalling would be a mess) since at that point you're physically in the office building and we have more serious problems.

verve_rat 3y ago

Why do you need personal passwords on your laptop to do your work? I'm not understanding this.

BytesAndGears 3y ago
Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos from my travel with coworkers, synching docs related to my work visa and taxes * Personal slack login for communicating with my partner in our private server * personal GitHub account credentials for synching my private dotfiles repo with my neovim config. basically can’t work without my dotfiles, but I could theoretically email these to myself or something, to prevent this one. And sure, I could be stubborn and not use any of this, but I’d be way less productive and kinda miserable.
- MichaelZuo 3y ago
  Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?
  - BytesAndGears 3y ago
    Convenience, I suppose… and that doesn’t solve all of the issues (eg Copilot) I’m fine with it because I know there’s no management software on this laptop, but yeah it’s a totally different story if I had to use a newer one with SSO and management software
    - MichaelZuo 3y ago
      Part of the comp. package is presumably paying for you to endure some level of inconvenience at the company's request. Such as isolating work and personal things on separate systems. At least that's how it works in the vast majority of companies.
  - jen729w 3y ago
    I’ve been in the same situation. With two laptops you lose the ability to, say, send email directly to your task system. It’s really easy to say ‘don’t use your personal stuff at work’, but when work is some locked-down behemoth whose view of productivity software is ‘just use Office’, and you’re really trying to be better at your job, using your own tools can be the only solution. And in my situation, yeah, they didn’t want you bringing things in. I worked in a secure area.
    - pests 3y ago
      Then you need to let the employer see your lack of productivity when you are limited by the locked-down system. Finding solutions to work around the systems, on your own time and dime, only hurts in the long run. They think everything is fine. Nothing will ever get fixed. Voice these concerns.
      - comex 3y ago
        Hurts who? If you’ve worked around it then it doesn’t hurt you, at least not too badly. It still hurts the company as a whole. But is that your problem? You might feel a sense of social obligation or solidarity with the company. I usually do. But if I was placed in a dehumanizing situation like that – forced to work inefficiently due to overly rigid policies that assume everyone’s needs are the same – well, whether I worked around it or not, my empathy for the company would be at a nadir whenever I thought about it.
- hinkley 3y ago
  * Jetbrains * Stack Overflow * Job Search sites I don't remember if Jetbrains needs a password to get to personal licenses, but they definitely do to use their bug database. I suspect they're not the only one. Letting other people blow off steam can be an act of self-preservation. Insisting that people only ever do 100% work things at work or on work hardware slightly raises your low-but-never-zero chances of being murdered by coworkers. Or less ironically, hilariously intense bridge-burning activities. Also most of this conversation is happening during work hours so I think we can infer that grandparent is being a little hypocritical.
- _boffin_ 3y ago
  Let me get this straight… you’re taking privileged company information and transferring it to personal… I’m now understanding how people get sued when going from company to company.
  - BytesAndGears 3y ago
    Certainly nothing privileged! Moreso just reminders about “follow up with person x” and that kind of thing
    - _boffin_ 3y ago
      Let me ask you one follow up question: if you and the company had a disagreement of sorts and they examined your activity, would you believe they find nothing that they’d deem privileged?
    - foobarian 3y ago
      We are probably all little people here, and nothing like this would ever happen, but say you were high profile enough like that Google self-driving guy that Uber poached, and there was a lawsuit - anything you did on that computer would be up for grabs. All your personal projects, documentation, DMs.. it would be super messy. I’m pretty sure companies like having this kind of situation because it gives them legal ammo in the rare case where there is an action.
- sneak 3y ago
  > personal Trello account for keeping track of my todo list. > personal Obsidian for keeping meeting notes, and recording conversations as a personal knowledge-base I'm not a lawyer, but I'm pretty sure these could subject a lot of your other personal data to potential subpoena should your employer get sued by a sufficiently determined attacker. Don't cross the streams.
  - BytesAndGears 3y ago
    Ooh actually that’s the most compelling reason I’ve heard. I think I might actually split out those accounts with this reasoning.
  - marksomnian 3y ago
    Also it's a violation of Obsidian's license: > Obsidian is free for personal and non-profit use. However, if you use Obsidian for work-related activities that generate revenue in a company with two or more people, you must purchase a commercial license for each user. Non-profit organizations are exempt from this requirement. https://obsidian.md/license https://obsidian.md/license
    - tuckerman 3y ago
      Perhaps they pay for a commercial license? > Q3. Can I buy a license for myself, or do I have to ask my company to buy it for me? > Yes, you can buy a license for yourself; just put your name in the company > field. You can use such a license to work for any company. https://help.obsidian.md/Licenses+and+payment/Commercial+license https://help.obsidian.md/Licenses+and+payment/Commercial+lic...
- kccqzy 3y ago
  You use so many personal accounts for work that it's unfathomable for me. If some hacker manages to hack into your account and find so much valuable information about your work, your work is going to be mightily pissed about it. Imagine you are working on an upcoming product launch and the attacker used your personal account to leak the launch. Or imagine they just decided to leak your company's internal source code. Or imagine they simply use the technical information in your personal attacks to steal user data (even Cloudflare says they worry about this: "Our aim was to prevent the attacker from using the technical information about the operations of our network as a way to get back in"). You are making your work take on an extraordinary risk in hiring you.
  - BytesAndGears 3y ago
    It’s a fair concern, but there really isn’t so much there. If they compromise my trello account then they know I have some meetings coming up with people, and that I’m starting on ticket 927109 and planning to deploy ticket 901223 on Tuesday. Just referencing items in our ticket management system with very sparse details. My notes are text files on the computer, so we’d have problems regardless if they got that. But maybe I should’ve left it out of the list above in that case… nothing else seems very damning. But you do raise a valid concern, and it’s worth reevaluating!
- DANmode 3y ago
  This all makes perfect sense - but just seems like your employer is too large to be effective, they're not offering you the right tools/you're not demanding them, and you're in an abusive relationship with them - probably because they pay you well enough.
deathanatos 3y ago
The parent's view does seem a bit extreme, but there is always some overlap. Whatever HR system you have is going to be in a weird area of personal/employee overlap, as it'll need to have a password that your personal life has access to. (As tax documents, pay stubs, benefits stuff, etc. all impact the "personal" side of one's life. E.g., I need to store — in my personal archives — the years W-2.) Also, people just do things for convenience. (Although I tend to pipe these passwords over an SSH connection, so that they're not resident on the work laptop. Though there is a good argument to be had about me permitting my work laptop SSH access to my personal laptop. From a technical standpoint, my employer could hack/compromise my personal laptop. From a legal and trust standpoint, I presume they won't.)
- sneak 3y ago
  It's not extreme at all, it's the bare minimum that professionals do. Absolutely none of my personal stuff ever touches a corporate machine. Ever. I wouldn't even log in to the W2 downloading app as an employee from the work machine. Granting work ssh keys access to your personal machine is crazy; if your work machine gets compromised, they steal your entire personal system's home directory too. Why would you unnecessarily expand the blast radius of a compromise like this?
  - cqqxo4zV46cp 3y ago
    I love these sorts of comments. Could you please just be more direct and call GP “not a professional” for not working in the way that you do? It’s so unnecessarily passive-aggressive.
    - bpt3 3y ago
      You are really, really, really sensitive about this. I wonder why? GP said nothing of the sort.
      - Symbiote 3y ago
        GP wrote "it's the bare minimum that professionals do".

yjftsjthsd-h 3y ago

> if I have my own personal passwords or keys anywhere on my work computer. Well... don't do that? Why would you ever have personal anything on a work computer?

Symbiote 3y ago
A Github account, for one possible example.
- pizzalife 3y ago
  Well, why? It just seems risky. Everything you make on your work laptop / during work hours is typically owned by your employer. If your employer is paying you to contribute to OSS, don't use your personal github account. Just don't ever mix personal and company accounts on company hardware.
  - electroly 3y ago
    Note that if you do make a second account, at least one of them must be a paid account. A single person cannot have multiple free accounts and GitHub does not care if it's because one is for work; it's in the TOS.
    - 2devnull 3y ago
      There is no way around that restriction either.
    - computerfriend 3y ago
      I have blissfully been unaware of this. Have even linked free accounts with the account switcher. I'd say this is fairly unenforced.
  - da768 3y ago
    The typical work contract also extends to outside work hours and personal devices.
- 3y ago

samcat116 3y ago

> new laptops that are preinstalled with Okta’s management system Okta doesn't make device management software, thats made by companies like Jamf. Okta can integrate with them but Okta isn't what manages your laptop at all. > I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Do not do this, its not a personal device.

michaelt 3y ago
> Do not do this, its not a personal device. You think nobody's logged into their personal spotify on their work computer? All those guys wearing headphones in the office have brought in CDs to play in their laptop CD drives? And that business traveller away from their partner and kids for a week+ isn't going to video call them? Or watch some netflix in their hotel room in the evening? That's so unrealistic, you could write IT security policy for a Fortune 100 company :)
- da768 3y ago
  Nothing a smartphone can't do. Even companies with these policies preinstall Spotify on work computers.
- midasuni 3y ago
  I’ve had company devices for over 20 years. I’m currently on the way back to my hotel. I refuse to carry more than one phone or one laptop, and I sure ain’t brining a personal device into a country I wouldnt go to on vacation.
  - DANmode 3y ago
    > I refuse to carry more than one phone or one laptop Footgun, but maybe tolerable with your chosen threat model.
  - autoexec 3y ago
    Totally agree on travel. If I'm getting on a plane for work I don't want to bring my own devices. I can't even trust that my own country won't steal/copy my devices at the border.

deleted 3y ago

[deleted]

ocdtrekkie 3y ago

I wouldn't use Okta at work, but as a network administrator, I also wouldn't allow your improperly managed laptop to talk to business resources (and I'd demand anyone overruling me sign a written statement demanding it to exempt me for responsibility for it). Wild you work somewhere that is letting you get away with that.

prg20 3y ago

IT departments do not care for the musings of self-proclaimed neckbeards. The arrogance of such users to comfort to security policy is a well known risk and usually grounds for swift disciplinary action.

giancarlostoro 3y ago

At a former employer, the company wanted everyone's machine to have full hard drive encryption, thankfully we were on Linux and the vendor they wanted to use was not compatible. Even so, I always encrypt my installs on laptops, not so much workstations (I didn't install it, and reinstalling would be a mess) since at that point you're physically in the office building and we have more serious problems.