Hacker News Reader

Comment by cj | Hacker News Reader

Our company uses G Suite's Advanced MDM on a G Suite Enterprise account. I administer its configuration.

Unless I'm missing something, there's not an obvious way to "spy" on employees, which this article is claiming. Perhaps it's possible, but if it is, it would require a lot of deliberate effort to accomplish. For example, there's not an out of the box way to track employee location. There's not a way to track employee internet browsing history out of the box.

TLDR: using G Suite Advanced MDM, there are not out of the box solutions for tracking or spying on employees in the ways suggested in the article. It might be technically possible, but to accomplish it, your company would need to make a (large) deliberate effort to do this.

View on HN

Same, we use gsuite MDM for BYOD just to ensure that personnel's devices have basic security configurations (e.g. encryption, lock screen, etc.) Beyond that, this MDM is quite limited to what's possible to accomplish.

>There's not a way to track employee internet browsing history out of the box.

Some large enterprises use MDM to deploy certificates and proxy policies that essentially force you into a MitM situation, with the intention of tracking browser usage.

Location is a bit more tricky. I would say that's less common, but I've seen MDM solutions that offer location tracking as a feature

Yes, there are probably sketchy MDM providers that specialize in employee tracking / spying.

I'm speaking to what's possible to accomplish out of the box with G Suite's Advanced MDM offering, without an extreme amount of additional effort.

(This is relevant because, when prompted to install a MDM profile, the MDM provider such as G Suite is visible to the end user)

Not even sketchy. Monitoring how long techs take on calls is a requirement in some roles for quality assurance and training purposes. Company I worked for had GPS tracking that they used to make it show that one employee was visiting another employees wife because our home base was over street over. It was a funny prank until it wasn't.

For g suite location is under Mobile management. They list it as a find my phone type of feature. There's even a picture of it on their marketing.

I mention this because one of the top use cases for MDMs is deploying said MitM setups. It's common in certain industries, like for banks and for schools. Saying this from experience because I worked for a company that produced both an MDM product and a MitM product.

For an MDM solution on iOS there's a big list of supported profiles you can deploy after the MDM profile is installed ( see https://developer.apple.com/business/documentation/MDM-Proto... under "request types").

If the device belongs to the organization, you might not even know these profiles are installed, if it's a BYOD environment you know you are installing the MDM profile and if you open the settings page you can manually inspect which other sub-profiles have been installed by the MDM.

But you're right the MitM itself isn't built into the MDM, because that's a totally different product category ("Secure Web Gateway"). The MitM setup only works if you have an MDM to enforce the certificates and proxy setup upon the user.

If I remember correctly, even the isolated work profile can add certificates on android. Probably the only reason I don't use that either.

Being able to push software installs is a pretty basic feature of MDMs. Is that not the case with G Suite?

Reply on news.ycombinator.com