Hacker News Reader

Comment by tyingq | Hacker News Reader

"1. The apps used MDM profiles, intedned for control of employee's smartphones and/or vpns to filter access to apps."

Anyone know where Apple's language on this is? MDM is "mobile device management", which sounds very much like what a parental control app is. I don't see much difference in the employer vs parent use cases.

View on HN

The difference is, an employer must get (for a fee) their own profile, and they manage the devices themselves. Those apps probably linked the devices with some common profiles. That meant the parent was not really in control, the app developer was. It's like you accessing your bitcoin wallet directly versus you giving me the key and telling me what transactions to do, trusting I won't abuse it. You could argue that every parent should just get their own profile, but they're like $200 or so. A couple hundret dollars definitely. Apple could make the fee smaller, but then hackers and people who want to circumvent the APP Store would start buying profiles en masse, and Apple wants to make that unprofitable.

Ahh. That helps. Sounds like Apple is partially at fault here for ignoring this set of needs. So, both good and bad apps appear to fill that gap.

I don't see how Apple could cater for those needs. The only way would be to allow anyone to create an MDM profile, but making them free and abuntant defeats all the security of the App Store. It would just be sideloading, but a little harder. The use/abuse potential would be huge. I can imagine Netflix using loopholes like this so that users could create their own profiles and use them to install Netflix apps unencumbered by Apple's IAP limitations. That would make users accustomed to installing apps that way, and now we're one step from fake banking apps and Android's story all over.

Parental profiles limited in total number of managed devices? Failing that, it doesn't have to be MDM. They did implement the screentime as a built in piece of functionality. Also, does Android charge for MDM profiles?

Apple don't charge for MDM profiles

MDM is used for enterprise. IT Admin has certain escalated privileges, which is different to a parental control app. It can be especially dangerous if the person in control of MDM has malicious intent.

Refer to the Mobile Device Management tab in the link.

https://support.apple.com/en-au/business

> IT Admin has certain escalated privileges, which is different to a parental control app.

So a random employer is allowed to control employee devices, but a parent isn't allowed to control their children's devices?

Really?

This is flat-out evil on Apple's part.

The employer is allowed to manage devices on its own network, generally to enforce security policies that they may put in place.

It’s not at all the parent that Apple is concerned about, it’s the app developer, or anyone who can hack the app developer.

If a parent was using this feature to manage their in-home devices directly, Apple would have no problem with it at all.

An app developer cannot masquerade as your employer to back door your iPhone and control things on it which third-party apps are generally prohibited from controlling.

Be aware that in some (most?) cases the MDM blocks, at least the very restrictive ones, are only achieved on devices shipped by the employer strictly for work purposes, not on private ones. To get full, total and utter control, you need to wipe your device through Apple Configurator (a Mac program) and set it up with the MDM profile from the start. Just installing the enterprise profile, like you normally do, won't give you access to everything.

It gives the app developer deploying the profile enough access to pipe all traffic through a remote VPN or attempt to redirect certain traffic through DNS resolution, with new certificate trust settings, to let you capture TLS and non-TLS traffic from your phone. It also gives them enough power to change the configuration of the phone this way at any time.

Nothing to do with the parent. It’s the app developers using mdm that are the problem.

IT admins are given powers over devices that would be considered domestic abuse if given to parents.

Like what?

Complete surveillance and indefinite recording of Internet traffic.

Mind you I realise that a lot of people believe parents have absolute right to deny their children privacy. I don't, I have friends with CPTSD.

As a parent, I have a legal and moral obligation to act in the best interests of my minor children. To allow a minor unencumbered access to anything is no different than leaving a gun unlocked.

Not a parent, but perhaps you could teach your minor about the dangers of the {internet, apps, etc.}?

Parents have the legal right to do basically whatever they want with regards to their children’s privacy. That doesn’t mean that I agree that they should do this, but if they would like to do this there’s not much that can stop them.

> Parents have the legal right to do basically whatever they want with regards to their children’s privacy.

Maybe that's true in the US, but it's not true in Europe and definitely not true in England.

That is true to a large extent, but this isn't really a legal question, no?

Domestic abuse is a legal construct.

It is not exclusively defined by the legal domain. Actually I'm not sure how many places have such a crime.

Start a family restaurant, hire your kids, problem solved.

That was my thought, I’m not sure why the relation to mdm and enterprise keeps coming up, in the sense that it’s limited to enterprise use cases only. Many people use enterprise hardware and software for personal use cases. Things like the Meraki Mdm and Duo 2fa free level. I use separate licenses of LastPass Enterprise for company and personal reasons, because it has more features.

I would also argue that a family would have equal or more rights/choice over how they manage their devices/family.

Reply on news.ycombinator.com