Hacker News Reader

Comment by timr | Hacker News Reader

This is such critical advice, particularly if you work for a company that does remote hardware management.

You could be fired tomorrow, and your access to your hardware revoked instantly. Apple devices, in particular, allow IT to remote lock your laptop. Whatever you had stored on the drive is lost to you, available to your employer, and you can't do anything about it.

Don't mix business and personal hardware.

View on HN

Saying "instantly" is under selling it. It literally happens before you are fired. IT will have disabled you ability to access files before you have been informed it is happening.

Android has work profiles separate from personal profiles -- I find that a reasonable compromise.

Having work emails/chat/etc on my phone has been a great benefit -- it means I can be untethered from desk but not miss anything important.

If you got the laptop in a sealed Apple box (purchased by employer), and set up macOS yourself, created your own admin user and everything, does this remote access still apply?

Yes, it does. The employer has registered in front of Apple the serial number and Apple considers the device theirs. MDM on an employer's laptop allows them full control. If the device is owned by the user, then the MDM is more limited.

It's actually the vendor that registers Macs. Only iOS devices can be registered to Apple DEP manually. Macs can't, only the vendor can do so, whether it's Apple or whoever else.

Are you saying the employer can take control of the device without ever having physical access to it?

That sounds like a massive privacy and security issue. Do you have more information?

I was researching MDM more than an year ago, but keep in mind that we are talking for an employer's machine. Here is the overview:

https://support.apple.com/guide/mdm/mdm-overview-mdmbf9e668/...

It would still need on-device authorisation to opt into MDM though. I can't just give Apple your serial number and tell them to start pushing updates to your device, can I?

At the time of purchase, the vendor knows which machines the employer buys and assigns them the relevant privileges. When the machine is initially opened, it connects to Apple and is provided with the address of its mothership server. The MDM server then instructs the machine what to download and how to configure it. The user has just to unbox the machine and nothing else. This is convenient because it allows for downloading multiple apps, installation and configuration of certificates, setting password policies and many other actions that users are really prone to mess up, and that are wasting lots of sysadmin time if done manually one by one.

If the user owns the machine, then there must be authorization and the MDM has much more limited, privacy-preserving scope.

I think they are asking if you could social engineer access to someone's laptop by knowing their serial and calling enterprise support. Seems to me like you could.

@R0b0t1

No, you can't. The employer has proof of ownership because they buy the machine.

That's really surprising. I suppose it makes sense if it happens at the time of setting up the machine, and an explicit notice is given to the end user. That should circumvent any privacy and security issues.

In that case you should know whether a management profile[1] has been installed, but you shouldn't assume you can simply create another admin account.

[1] https://support.apple.com/guide/server/intro-to-profile-mana...

If I don't see a Profiles section in my System Preferences, does this mean that my employer has a very high level of trust in me?

It means your employer has a very low level of security and you should be genuinely concerned about any personal or financial information you gave them during your hiring.

Seems like a vast overstatement.

Endpoint management is like bare minimum security basics. At this point luck is the only thing stopping a BEC or ransomware attack.

nonsense. there is no one-size-fits-all solution for security.

That is like arguing "not all cars need seatbelts." You might disagree on how many airbags or crash avoidance widgets a car needs, but the vast majority of the industry agrees that seatbelts are a requirement.

EPS isn't like a seatbelt. Often EPS (like kernel mode AV drivers) is used as an intrusion vector and reduces security.

Every single FAAMG company runs managed endpoints. I'm not sure why you are arguing that companies having no control over their hardware is somehow a security feature?

I manage hundreds of Macs. Just wanted to add that these management profiles don't say much about what you can and can't do and what your company can do. You have to go through each of them to see what they do (the management one is just the master one, there will be tons more which specify exactly what is restricted and/or enforced). Apple is very good at privacy protection, asking the user for permission even on managed machines, which can be bypassed with certain profiles but it's pretty tough to do. I personally take this as a sign to think long and hard about whether I really should.

Co-usage is just a thing these days. A little trust in your employees is also important. Usually these profiles just mandate some basics like password complexity, disk encryption and they set standard settings like WiFi and printers so you don't have to bother figuring all that stuff out. And it will install applications you need and security stuff.

And don't forget, a password complexity profile on a Mac will apply to all accounts created on it. Even ones created by the user. Many things work like this, on a machine level. It's more about establishing a security baseline than tying the users' hands.

This entirely depends on what you do from that point forward. Are you using a VPN provided by your employer? Are you installing any screen sharing or collaboration apps for work? You'll need to understand what each of these are capable of in order to fully understand your exposure.

This is what (public or personal) cloud is for. Nothing lost. Helps too if the laptop breaks or is stolen.

Though I would prefer to see stricter separation like Android Work profile on computers too.

Chromebooks provide separate logins for personal and Workspace/GSuite accounts.

As for what happens if your Chromebook is stolen and you've not selected the option to lock it when the lid is closed, Workspace/GSuite accounts can be remote wiped, personal ones cannot. Perhaps with the upcoming Workspace Individual plan, remote wiping of personal accounts will be possible too.

Yes, agreed. Apple does a good job letting you know what your company has access to, and if you use iCloud / Personal GMail, your stuff stays with you after you leave.

Reasonable countries don't allow companies to fire employees immediately, hence access cannot possibly be revoked instantly.

Just because you aren't fired instantly doesn't mean your access can't be revoked.

The company just says "your new job is to stare at the login screen until HR can schedule a meeting with you."

I live in Australia, which generally has decent (but slowly eroding) workplace protections. But I managed to get fired and walked out of the building with zero notice. So I would not count on this even in a country with traditionally strong labour laws.

I would say that not allowing a company to fire someone immediately, say, if they're looking at porn on their work computer during work time in front of the entire work office, is unreasonable.

Every country with employee protections allows for instant termination for gross infringements like you mention.

> access cannot possibly be revoked instantly

Not according to the comment I was replying to.

What country on earth won't allow an employer to lock you out of everything and escort you to the door if they deem it necessary for their security?

Employed or not, your access isn't under your control.

That’s a non sequitur. Access can be revoked on a machine with something like an MDM system the next time it gets network access, whether you’re fired or not.

Certainly if a machine is stolen I’d expect it to be remotely wiped. Same with a phone.

If you have hardware that isn’t under an mdm system though that’s different.

Even if a company can't fire you immediately, they can certainly revoke your access and remove all of your responsibilities while they process your termination.

Many services allow you to log out of either all or a specific session on another computer.

Couldn't you pop the drive out, wipe and format it, then put it back in?

Reply on news.ycombinator.com