Hacker News Reader

Comment by cannonedhamster | Hacker News Reader

Generally MDM software swallows up everything. It's been a while since I managed an MDM instance but we could track everywhere the employee went by default and when I suggested we turn it off there wasn't an option nor did management want to. We could see every app pretty much everything on the device. I will never install MDM on my phone after managing it. I've also seen phones accidentally wiped. Back up your phones.

View on HN

I learned my lesson when in the early days of MDM, an employer I quit decided to erase my personal device that had work email on it. Live and learn :S

Apple MDM is changing quite a bit come iOS 13 and macOS Catalina 10.15. A new enrollment methodology called User Enrollment is aimed at protecting the privacy of employees using their own personal devices. User Enrollment greatly limits what the company can see about the device. As an example, the MDM can only see the apps that it has installed on its own, it can't get any PII (Personally Identifiable Information) such as a phone number or serial number from the device, etc. The MDM data and visibility into the device is essentially sandboxed.

This article provides a summary of MDM User Enrollment, including details about how Apple separates personal and business data on separate APFS volumes.

https://simplemdm.com/apple-user-enrollment/

Before User Enrollment there wasn't a great Apple MDM enrollment option that struck this privacy balance for employee-owned devices. App data couldn't be viewed per-se, though a list of apps is certainly available (as mentioned by cannonedhamster). Some companies would skip MDM and essentially "wrap" individual apps in order to have the ability to encrypt the app data and have some control over the binary, but that's about it.

I'm not sure of the story with Android, though I'm under the impression that there is a similar "sandbox" option for MDM, albeit the implementation and user experience is rather messy and obtuse.

Full disclosure: I work for an MDM software producer.

Does turning off location on your phone mitigate their tracking of where employees go? I realize the other problems are still there, but I'm wondering if that would help. I turn on location on my phone once in a blue moon when an app gets too damn annoying that I actually need to use right then.

Depends on the MDM and phone really but, No. Triangulating a cellphone on the network via cell towers is a tried and true feature of wireless infrastructure. Even your phones GPS capabilities are most likely "A-GPS" meaning Cellular Assisted; It'll use cell location data when GPS satilites are slow/unavailable.

GPS toggle isn't doing much of anything besides application permissions enforcement.

Reply on news.ycombinator.com