5 ms·
Needs an option for “my employer turned on shitty Microsoft ten-billion-factor auth settings”. To login to my work Microsoft account requires a passcode and th
by MortyWaves 2y ago
Needs an option for “my employer turned on shitty Microsoft ten-billion-factor auth settings”.
To login to my work Microsoft account requires a passcode and then three face scans.
- poincaredisk 2y agoBut that's ok your work phone right? At least I hope you didn't agree to have it installed on your private phone. For work phone I guess a good strategy is to avoid installing anything non-work related, so the temptation to use it for anything is low.
- cglong 2y agoNot GP, but I'm okay installing that stuff on my personal phone because it's isolated via Android Work Profile.
- autoexec 2y agoHow is that keeping Microsoft from accessing your GPS, sensor data, wifi, camera/microphone etc? Sure, they can't get at SMS or your other apps and your work won't have access to your entire device but it means MS can still access your location (using GPS and nearby bluetooth/wifi), record audio/video, read/control sensors (accelerometer, proximity, gravity, temperature, pressure, magnetic field etc), have full network access, etc and can record and collect that data whenever they feel like it for the most part.
- cglong 2y agoThat's true with a separate work phone too right? And once I turn off the AWP for the day, all of that stops.
- autoexec 2y agoA work phone I could leave in a lead lined box until I needed to log into the company network. My personal device is often carried with me and in use at other times. If your IT people let you pause your work profile indefinitely that could help protect you though.
- zamadatix 2y agoThe IT people don't get to choose how long you pause your work profile, you do. If they want control over profile access then they need to manage the full device, not just have you run an app in a profile on it. If you plan on carrying a lead lined box with you everywhere you plan on authenticating for work you can do the same with your personal phone before you switch the work profile on.
- bongodongobob 2y agoThere's different kinds of intune enrollment. Generally if it's not a company phone, they can only see your IMEI, last 4 of your phone number, OS version etc. They'll be able to isolate and control the work apps but nothing else because it's in a separate profile.
- johnisgood 2y agoYou may want to try "Shelter" (https://f-droid.org/packages/net.typeblog.shelter/ https://f-droid.org/packages/net.typeblog.shelter/).
- encom 2y agoNo way I'm doing anything work related on any of my personal devices. I have a separate work phone. I turn it off at the end of the work day, and leave it at work. I used to answer emails from bosses and managers while at home (at a previous employer), but it gets out of hand quickly and then they expect you to do it. Never again. Set boundaries immediately. At 15:00 I'm gone.
- cglong 2y agoLeaving it at work goes one step further than my flow. I have AWP configured to automatically turn off at the end of the workday, so I become unavailable after that. There's always the possibility I can turn it back on after hours, but that extra step works well enough as a deterrent for me :)
- throwawayk7h 2y agoYou can usually do OTP from your pc directly, just install an OTP application on your pc like keepassxc
- deskr 2y agoSecurity dept. would like to have a word.
- compootr 2y agosecurity theater dept. has entered the chat
- bongodongobob 2y agoNo. It completely defeats the purpose of MFA.
- MortyWaves 2y agoOh well
- CryptoBanker 2y agoDoesn’t work if your work uses SSO like Okta
- zamadatix 2y agoIf it's plain OTP this works fine. Plenty of corporate solutions like Microsoft's have moved on to requiring additional extensions or modifications which only work in their app.
- autoexec 2y agoI had an employer want that too, but we protested. Basically making that the case that they'd need to provide us with phones so that we don't have to install invasive apps on our personal devices. We ended up getting tiny hardware tokens that go on a key ring and couldn't access GPS, cameras, microphones, sensor data, network, etc even if it wanted to.
- alexvitkov 2y agoThis has always boggled my mind - If you don't trust me to pick a decent password and maintain my own machine, why in God's name would you trust me to write code or deploy/maintain company infrastructure?
- tecleandor 2y agoNah, it's not lack of trust, it's just compliance and plausible deniability.
- ryanmcbride 2y agoThey _don't_ trust you to do that stuff. Not unilaterally at least. In a healthy system you generally aren't able to change anything without sign off from multiple other people.
- TeMPOraL 2y agoAlso the argument they make is, they don't trust every single component of your machine, and want to mitigate the damage caused by an attacker or malware breaking in and impersonating you.
- alexvitkov 2y agoIf I have a group of N people who I individually don't trust not to use mike1234 as a password, I wouldn't trust them as a collective either - at least until N gets impractically large.
- ryanmcbride 2y agoSo no need for code reviews then since all humans are fallible!
- dongkyun 2y ago1. Even if they trust you, they might not be willing to extend that trust to non-technical staff (or even non-infra staff) and having a global policy is the easiest. 2. Even if they trust you, your employer's customers definitely don't, and a lot of big contracts will have security exhibits that explicitly require MFA if you're handling their data.
- scruple 2y agoFirst thing I thought of, too. Why do I need to unlock my phone? Because I need yet another MFA code for yet another mundane part of my job.