Hacker News Reader

Comment by happytiger | Hacker News Reader

The issue is that company information gets immediately sold on Craigslist or OfferUp or whatever.

In returning the equipment it actually protects the employee from compromise by creating a chain of custody for corporate data.

Sounds counterintuitive but it’s not. If the equipment needs to be destroyed — and it often is — it can be done properly.

People have no idea how easy it is to recover data from a single formatted drive.

View on HN

I’d be curious if it was easy (or even possible) to recover data from a FileVault encrypted drive, which any IT dept worth its salt could remotely wipe

I’d wager to agree, I don’t play in this space much but I can’t imagine MDM being unable to handle this kind of basic use case, and also for most companies the confidential data being worth enough to be more careful than relying on MDM. Sure if you work for a compay that builds weapons for the USG you probably need to worry about hardware chain of custody. But those people are not sending their employees home with laptops anyway. In other words, if you trust your employees enough to take that device home, whatever you have on there is probably fine to be handled by MDM

I'm of a similar mind. I also think the argument of this protecting the employee, while true, feels a it weak in the face of an employer deciding to leave a laptop they didn't adequately scrub with said ex-employee.

I can't speak to FileVault, but Bitlocker and TPM can be quite easily defeated through sniffing the bitlocker key as it's transmitted from the TPM chip to the CPU to decrypt the drive on boot over the LPC, I2C, or SPI bus. Unless you enable TPM+pin for preboot auth you can't easily protect the data on a Windows PC, even with FDE.

If there's a remote wipe done (one click in MDM software) then there is no key left.

Pretty much every company does preboot auth nowadays for Windows laptops. And remote wipe is also possible, as the side comment says.

Letting the former employee keep the laptop is the default, IMO. Although, frankly, I am not sure I would want to keep mine... sitting on a pile of a dozen laptops accumulated over the years.

And everyone watches porn on their on own devices anyway.

> sitting on a pile of a dozen laptops accumulated over the years.

low power consumption and can probably run a couple of VMs, albeit not super well but well enough

Reply on news.ycombinator.com