Comment by zobzu | Hacker News Reader

Comment by zobzu | Hacker News Reader

Parent Full thread

For what it's worth your comment is technically wrong and misleading - really, it's FUD.

Android is very specific about company-owned vs personally-owned phones. Personally-owned lets you setup devices with a work profile where very little non-work data is available to the employer. They don't know your personal apps, they dont know your IP address, and they dont know where these apps go (ie no personal network logs). They have no access to these either.

Even for company-owned devices (which require a specific setup, if you bring in your own device that means factory reset and things like hitting 7x the white screen on the first new setup page), the mobile device management api doesn't give you all that much. There's no remote access/rootkit, you can't see private messages (they can see messages you send over a work chat app they own, so if its google hangout chat f.e., by looking at the hangout service itself)

Here are the different modes: https://developers.google.com/android/work/terminology and you can follow the API links to see what they do if you want to verify what I just wrote.

Except that in the Employment Agreement that Google made me sign when I worked there (I don't know if it is still like this) Google specifically called out that they reserve the right to rootkit your personal devices that access "Google's corporate information" (basically that means accessing your work email because you needed to use your corp laptop if you wanted to access the internal network)

But I agree that if they were talking about the "Android" feature, an employer could choose not to go that route.

When you signed your agreement, that Android technology didn't exist, so reserving themselves the right to get root on your devices accessing corporate information was the closest, yet very blunt, approximation. Personal devices were highly discouraged or even forbidden for a long time, but employees kept asking about them, for the convenience. These use cases and internal dogfooding were major factors in the eventual development of Android Enterprise and related products.

That doesn't track. By the time they pulled this crap (including the "you didn't sign it, would you sign it again?" and it turned out to be different), we had been given at least one Android phone (ADP1) and maybe the second as well (N1).

I dogfooded pretty much everything from the G1 to the N5, Xoom included. Until Lollipop or Marshmallow arrived, we were discouraged or forbidden from having corporate accounts on personal phones, because there weren't the necessary Blackberry-style features yet, e.g. remote wiping. I remember Honeycomb (the Xoom) having only encryption, but no wiping. At some point you could add your work account as the primary on your personal gift phones (dogfood ones were a different story), but that meant that the device got bricked when you left the company, forcing you to a factory reset — and there was still no good isolation.

I definitely had my personal account as the primary on my N5 along with a work profile and I believe that's the first device/OS combo where it was feasible, if you ignored the annoying duplicate app icons in the launcher. The first truly "tolerated" personal devices were probably the Christmas gift Chromebooks from a few years earlier, as long as you used Yubikeys.

Didn't the policies even predate Android? They definitely were there well before Lollipop. Unless they were introduced post-Aurora, in 2010 — i.e. in the N1/Eclair days, keeping the phone vintage theme.

Reply on news.ycombinator.com