Hacker News Reader

Comment by hacknat | Hacker News Reader

I barely check work email at work. One of the nice things about having slack, at least at my company, is that no one seems to communicate outside of business hours anymore.

View on HN

My team has largely switched to slack as well. Initially I had it installed in my phone, and so then I would look at it anytime I got a message, even outside of work hours.

I wiped and reset my phone recently, and apparently IBM has upped the security requirements to sign into Slack since I first set it up: now I can't sign in on my phone for an undisclosed reason. (Probably because its rooted, I know that's why I'm not allowed to have my work email on my phone.)

It's been kind of nice, honestly.

How do they know the phone is rooted if you are just getting emails? Or do you mean they don't like it when you do, but have no way to really know?

I don't know about rooted but Microsoft's Exchange App on Android demands that it becomes a device admin so it can remotely delete everything on your phone if your company desires. There is an app called MailWise[0] that will allow you to get around that though. I did this as my company pays for my phone nor my service yet demands I install their email on my personal device.

[0]http://support.mail-wise.com/knowledgebase/articles/391797-w...

My wife had a similar problem at work a while ago. Policies changed and the company required the ability to wipe her phone in order to get email on it. She basically told the company that, if they wanted her to have access to email/calendar on her phone (given that requirement), they would need to provide her with a company phone. She went for a couple months without access to email/calendar (when not at the computer) and then they provided a company phone.

Giving your company (or anyone) total access to your personal phone is insane. Your phone, with access to your email, is effectively a master key to your life. Through it, they have the ability to do almost anything to you (reset your bank password and take all your money, etc).

At my university this is the only officially supported way to access your email on Android, that was pretty horrifying when I was a freshman (so much so that I went without email on my phone for the entire first semester.)

If you hunt around enough though you can find the parameters needed to use IMAP.

It's probably a domain (as e.g. in Windows Domain, not DNS) setting that forces given phone to have a certain permissions before allowing integration with corporate services (including email), but usually it doesn't have a way to discover a rooted phone.

On the contrary you can disable other rules - like enforcement of PIN (if you know how) if you have a rooted phone.

If he's on Android, the app can use SafetyNet[0] and rather accurately detect rooted devices, or even devices with bootloader unlocked.

[0]https://developer.android.com/training/safetynet/index.html

many enterprises run a security requirements check before allowing corp email or other communications on. One of the checks is "is rooted" which android reports via api. This usually disabled access. Another is "full disk encryption", and "boot password". This is what big co I work at requires. Also small co we bought required it for 2fa on vpn. They also want remote wipe capabilities. Exchange does this on phones too by domain. But the place I work has a sidecar app that constantly monitors the phone and locks it out if the rules are violated, with is usually accidental by user or a sign of an attack.

I'm fine with not doing so as I don't want bigco's email on my phone, it's super spammy. It's more of a todo list than actual communications, forever base lining permissions.

In my case, they don't have publicly accessible email servers* - I have to run a VPN client. That client ensures all of the security policies are met before allowing me to connect. It's the same on my laptop and iPad.

* POP/IMAP/webmail/etc. Obviously the incomming SMTP server is publicly accessible, but that doesn't help me.

Reply on news.ycombinator.com