Hacker News Reader

Thank you for that first link. I stumbled across Apple Configurator when I was trying to lock down an old phone, to have at home as a pseudo-landline (but which I can take with me on trips) that is safe to leave accessible to kids. I got it working by muddling through, and that link would have at least let me situate myself in the space of "what does this thing do?" better.

What settings did you use to lock down your phone?

More or less:

  - prevent removal of profiles:
    general -> security -> "with authorization", and added a password
  - prevent total phone wipe:
    general -> functionality -> [ ] allow Erase All Content and Settings (supervised only)
  
  - only allow a few apps to run:
    restrictions -> apps -> restrict app usage -> only allow some apps
    phone, messages, facetime, settings
  - disallow installing new apps:
    restrictions -> functionality -> [ ] allow installing apps (supervised only)
  
  - content filter -> filter type -> limit adult content
    I'm not really sure what this does but makes sense to enable it
  
  - wi-fi -> configure one payload,
    for my home guest network
  - google account -> configure one payload,
    for a phone@vanitydomain.com google account

I have a copy of the resulting .mobileconfig file that also allows safari, but I only enable that when I'm e.g. taking a flight on Southwest and want to be able to use that phone as another screen for passing time in the plane

This seems like a heavy handed solution to a simple problem, which isn’t necessarily bad. Why did you not get a number forwarding service to forward to your primary cell phone instead of carrying 2 devices?

Is there an SMS forwarding service that works for 2FA?

This is a phone I let my kids use; it's a landline "house phone" replacement, that I can take with me on vacation. It wouldn't make sense for it to forward to my primary phone.

I want a POTS landline (guess I'm stuck in my late 90s "it's more reliable than the internet connection, since the power comes over the copper" attitude), but I can't even get POTS installed here.

I do not have any profiles installed, and none of my devices are managed.

I’m aware this could potentially be fixed by enrolling all my family’s devices in an MDM.

But I mean come on, wipe everyone’s phone to enroll in MDM? Seems pretty crazy when the phone should just let you control what it does/does not join.

Edit: I misread your post, I see now it was more suggesting a test. My bad.

If Carrier MDM policy can override Configurator/Enterprise MDM policy, then corporate security admins will likely be unhappy about their lack of control over enterprise device networking.

Has the industry forgotten the pre-iPhone disaster of telco-controlled devices? https://www.quora.com/Why-was-the-iPhone-initially-exclusive...

> The landscape of the cell phone market was very different pre-2007. Most notably, the carriers had complete control over what phones were allowed on their network. A carrier could nix a feature that had been in R&D for years and suddenly you couldn’t sell your new phone with this amazing feature. They were especially protective of data and overloading their networks, which led to browsers on phones being stripped down and limited. The whole “full web” was not a technical impossibility, it was just that carriers wouldn’t allow phones on the network that had a full browser.

https://archive.is/4ZCH5

> Apple bucked the rules of the cellphone industry by wresting control away from the normally powerful wireless carriers ... Mr. Jobs once referred to telecom operators as "orifices" that other companies, including phone makers, must go through to reach consumers.

Since when did you have to wipe your phone to enroll it in MDM? You don’t even have to wipe it if you unenroll, and that would certainly be more important since the phone could have downloaded sensitive content in that time.

Don't know since when, but definitely for a few years. To fully unenroll too. The reason is because in order to fully manage the device it needs to reset and restart in a managed mode.

This isn't true. You can enroll and unenroll without wiping. You can't _supervise_ without wiping. These are two seperate (commonly confused) things.

I mean, you plainly don’t. I asked a rhetorical question and made it clear by explaining you don’t.

This thread explains the difference between enrolling and supervising and is pretty clear that enrollment does not require a wipe.

https://www.reddit.com/r/Intune/comments/yd7mo5/do_you_need_...

You don't have to wipe to enrol, only to supervise a device. Supervision enables a lot of features that would be considered user hostile in a different context - it's definitely not something you want being enabled without you knowing.

The "Remove Profile" option in Settings might be helpful if it's available, but it seems like it could be carrier-dependent, and not all users may have this option.

The null routing workaround seems interesting and could potentially help in avoiding unwanted connections to the carrier's Wi-Fi SSID. However, this method might require some technical knowledge and might not be ideal for less tech-savvy users.