Hacker News Reader

Comment by goatinaboat | Hacker News Reader

Google had wiped her personal phone when it suspended her

Everyone take note: BYOD isn’t for your benefit.

Google offers two versions of this wipe. The whole phone, and only employer data. Wonder if they did the whole phone on accident, malice, or they are trying to say they "wiped" the phone but only removed employer data.

That only works on Android, if you have an iPhone, you always give your phone over to the employer.

Another (to me more plausible) option: The employee was unable/unwilling to separate the personal from work. So the "personal" data included (or could have reasonable suspicion of including) employer data.

This. BYOD is a very bad idea. It has no upside for the user. It’s all for the benefit of the employer in multiple ways. Don’t do it.

I'd rather not have to carry two mobile phones around which would be the alternative to BYOD.

BYOD is fine if the MDM software does profiles and allows the separation of company data and personal data. That way the company can only wipe its own data and not the personal data.

Don't carry your work phone around when you're off hours.

Agreed. For a while my company allowed Office 365 access from my cell phone without installing anything but now they require inTune and reserve the right to wipe phones but promise to never do it. I guess I will stop using Outlook on my phone...

What exactly does Google do for BYOD? I use my personal phone for work, but I've simply added my work GSuite account as one of the accounts on the phone, in addition to my personal one. I can access work email, use work's 2FA, but at no point in time (as far as I know) does work have the ability to, say, delete files from the device or from my personal backup accounts. Are Google employees allowing something far more intrusive, or am I underestimating my exposure when I have multiple Google accounts configured on my Android phone?

It sounds your device isn’t managed by an MDM. Did you accept a new cert from work and a bunch of scary messages when adding the account?

If you accept the MDM you will give root accesses to your company’s MDM system. Basically giving them as much access as Find My iPhone or whatever the android equivalent. Location tracking, remote wiping the phone, access to texts and calls...everything.

Yes they could access your texts/calls/emails everything.

If your employer wants, they can predicate the use of a work profile and your corporate assets on the installation of a device policy. This policy can give them extensive capabilities on your device, including wiping the device. If you installed a device policy, you may be underestimating your employer's capabilities. Otherwise, you're fine.

Ah okay, thank you. Wasn't familiar with MDM policies and such. Haven't installed one. Would rather carry a second phone when I'm on call...

Work profile can't wipe the whole device. Setting up the MDM profile as primary profile does allow that - but it's very clearly communicated.

But work profile can require the installation of a device policy, right? I know I have a device policy installed, and I can't think why I would have done that if setting up the work profile didn't require it. Although as it happens the policy I have on my device only allows wiping the work profile, as you say.

Does a remote wipe also wipe out cloud backups? Couldn't the employee simply restore from a backup (cloud or on-disk)?

A corp wipe shouldn't touch personal data, so that should hypothetically be possible. If they can't, my guess is it's because cloud backup was disabled (and corp wipe will conservatively blow away the local camera cache because there's no way to know if any photos contained corp-sensitive data).

Worth keeping in mind the target use-case of corp wipe: a hostile agent has taken control of a corporate asset. Application of policy to minimize the risk to the corporation, i.e. blowing away all cache that could be reached without an additional private user credential into a personal account, should be expected.

Reply on news.ycombinator.com