Hacker News Reader

Comment by zupzupper | Hacker News Reader

Newer Android OSes have the concept of a "Work profile" that you can enable for this. The company's MDM goes onto the work profile, along with the approved work apps. These may be sandboxed copies of existing apps, like in the case of the google suite, where they're tied to company data and accounts.

The work profile apps and data are the only things the MDM can "see" at that point on the device.

You can also switch the profile on and off at will, which is nice for vacations.

View on HN

Yes, practically not a single point in the article is true if you use a work profile. Even the remote wipe only wipes the work profile, no personal data.

It seems like the article is trying to spread some fear, without checking what users can actually control on newer Android and iOS devices.

Yeah, this article doesn't match my understanding either. When I went through the setup process on Android I clicked through a permissions dialog, similar to what you'd see when installing an app, that laid out what exactly the administrator would be allowed to do. To be sure, some policies effectively grant root on the device, but mine just asked for permission to disallow insecure lockscreen settings and to remotely wipe the device (needless to say, my personal data is all backed up elsewhere). This was on an older Android version; newer ones also allow device policies to be scoped to work profiles.

The article makes it sound like once you accept one of these policies the policy server can subsequently push out an update with more permissions and the user doesn't get a chance to opt out. But surely that must not be right?

There is a caveat, some larger organizations, like mine. Still haven't enabled Android for Work on all devices, but are piloting it currently to certain subsets of users.

I have a separate phone (Nextbit Robin) that has my work MDM on it. Thankfully, I've got access to the console, so I can keep an eye on the audit log.

While that’s true, how many of the devices in use in the wild by regular people have newer versions of Android available? With that in mind, I think the article makes sense.

Profiles were introduced in 4.2 on Android, if I recall, almost 4 years ago. Most Android devices in developed countries are above this version. My original Nexus 5 had them, and that's some 4 phones ago.

I'm sure you could find a shipping device that lacks them, but not from a major carrier in most of the world. Of Play-enabled devices, Google puts this at less than 5% worldwide

That's fair, also I haven't tried using one outside of the google ecosystem. My personal accounts are tied up inside google and most of my employers have used the gsuite as well.

Maybe someone else can comment if it works the same with office365 or similar?

Reply on news.ycombinator.com