Hacker News Reader

Comment by goombastic | Hacker News Reader

Half the enterprise apps I know stop working on cyanogen. Is there an alternative? Also is there a way to separate work and personal phone usage on a single device? Tools like mobile iron seem to demand all of my info be made available for whatever it deems fit for the corporate I work for.

View on HN

The alternative is a physically distinct work and personal device. This has been the solution for many years. Only recently have people wanted to "BYOD" and use their personal device for work purposes.

On that point, I very recently discovered [1] that connecting an iOS device to an Exchange account via ActiveSync enables the organization's Exchange administrators to remotely wipe the entire contents of the device - not just the content actually provided via the account, but everything.

I am astonished and disappointed that Apple saw fit not to warn the user this could happen. Even Google gets this right; when you connect an Android device, you get a warning and are required to confirm before proceeding. It's inexcusable that Apple doesn't do the same - while I understand and agree with the reasoning behind the existence of the capability, the fact that it's silently enabled is appalling.

[1] Yes, I know it's hardly news, but (I flatter myself that) I'm generally reasonably savvy, and if I only just found out about it, then there's probably someone else reading this thread who could benefit from it being mentioned. So I mention it.

It is news to me. I thought iOS simply didn't implement that functionality without being enrolled in MDM. With Android I knew about it and was able to build a custom firmware with that functionality disabled. I wonder if you can make an Exchange proxy that frees your iOS device via filtering.

Current versions of iOS do make it clear.

http://9to5mac.com/2016/03/02/ios-9-3-makes-it-abundantly-cl...

Well, I'm running 9.3, and I never saw that message, or any other warnings about Exchange connections, while I had my phone connected to work email.

Is all this stuff only a concern when the device is enrolled via MDM? That seems improbable; the (several) sources I've found on the subject don't mention MDM in any context, but just warn that Exchange connection = remote wipe capability. Similarly, while I had my phone connected via Exchange, I visited the devices page in Outlook Web Access and saw that the "Wipe" option was enabled for the device.

If the phone is rooted, you should be able to just uninstall the Google Apps. For good measure, you could also block Google's IP-addresses in the hosts-file.

As for ways to use the same device for work and personal, newer Android-versions (I believe from Lollipop onwards) have the option to create different user-profiles. I think that would work, although I've never actually used them myself...

Depending on your device, you may be able to multiboot. See https://play.google.com/store/apps/details?id=com.tassadar.m...

Problem is when MobileIron/Corporate IT sees root activity has been done on a device, it refuses to load up anything else. So I am now stuck with checking for emails on the laptop.

It's 2016, device manufacturers should have gotten this right already instead of focusing on wallpaper.

You don't need root to multiboot. Or rather, you can multiboot something like Cyanogenmod with stock, and stock can be unrooted.

Reply on news.ycombinator.com