Hacker News Reader

Comment by dml2135 | Hacker News Reader

Don’t you need to be signed in to the same iCloud account on both your laptop and phone to use this feature? That would mean that in order to encounter this issue you already need to be using a work account on a personal device, or vice versa.

Since that’t the case I fail to see how this is a large vulnerability. The article doesn’t seem to address this point (possible I just missed this).

View on HN

A shocking number of people login to their personal Apple IDs (and email accounts and banks and etc. etc. etc.) on their work computer. I personally do not, but lots of people do.

I’d say generally for most people, at least anecdotally, their work laptop is their only laptop because they’re expensive and have good specs. Especially for Apple products (which is the majority of the share of hardware in this anecdote), it’s natural to want and expect the continuity between devices.

Employers usually allow this or don’t explicitly forbid it, and most employees aren’t exactly security conscious or willing to sacrifice convenience. So it’s not that shocking to me, but it is weird that there isn’t more education or rules around it.

This is true for me. I have a personal desktop, but for mobility (laptop) my work issued MacBook M1 Pro is the only thing I have. There's no reason at all to purchase a personal laptop since my company is fully remote and they purchased the laptop from apple and had it directly sent to me, and have never required me to install any kind of monitoring software or control software on it at all.

"Directly from Apple" does not preclude monitoring and control, but it would've notified you on first boot if it were MDM enrolled.

Most tech companies (except some really big ones or those with compliance requirements) are quite flexible around this issue.

I would qualify that "tech companies that don't know what they're doing wrt IT". Apple does have some features to allow a bit of flexibility, but unless you do all of your work via VDI or similar, I'd consider non-MDM devices to be a huge red flag,

It's called trusting your employees, especially if they are engineers. Maybe that's why "nobody wants to work anymore".

MDM does not imply surveillance. I wouldn't use it if it did. It does mean I can enforce full disk encryption and remotely wipe a machine if it is stolen, though.

Found the system admin

Good luck when your laptop gets scooped up in discovery/litigation. After having been through lawsuits at work there is ZERO chance of me ever putting anything personal on work equipment.

Duplication and backups are a requirement of life IMO.

IT in companies using Apple devices must be an absolutely miserable position.

Why, because there’s not as much work to do debugging installers and malware as there is with Windows?

As a consultant, I work with Linux, macOS and Windows. Depends on the client and the project.

I can't remember last time I even heard about a malware in someone else's Windows machine, let alone my Windows machine. I don't know what you mean by debugging installers.

Sounds like an outdated opinion. Just like those "lol PHP bad" regurgitations and linking outdated articles about it.

The sysadmins at my job frequently find malware artifacts on our servers, because we exclusively use Windows server. And the expectation is you RDP in to get stuff done, which means there's a big potential for human failure.

Also most Windows software is just taken off the web and installed with administrator privileges. Sure, there are package managers. In practice, they're rarely used on Windows.

From a technical standpoint, Windows isn't "that bad" at allowing malware. From a culture standpoint, almost nothing has changed since the 90s. Linux and Mac have a different culture.

macOS used to have a decent security story until some QoL started requiring disabling SIP.

They gutted the OS so much that users start disabling security features.

And don't get me started with atrocious window manager from macOS. Took a decade to improve it slightly. Still far away from some Linux DE and Windows. I don't enjoy having to buy apps to fix macOS. There are some open source tools for some things but for others it's cost effective to just buy.

I've worked IT for Mac only shops my entire career, I wouldn't say any of it has been miserable

Depends on what you mean by "IT". If you're thinking like fleet management for thousands of desktops, then it's probably not a bunch of people having a good time. On the other hand, trying to do fleet management for Windows desktops isn't much fun either.

People got really angry at IT not allowing them personal Apple ID logins in several large companies I've been at :/

I'll use my work computer to check personal email and do other personal stuff from time to time. I use a separate browser profile that clears its cache and cookies when I'm done. I don't recommend it necessarily, but I don't have any endpoint monitoring on my machine so I feel reasonably OK doing it.

From here : https://support.apple.com/en-us/120421

> If your Mac asks whether to require Mac login to access your iPhone, choose Ask Every Time or Authenticate Automatically. You can change this later in iPhone Mirroring settings on your Mac.

Seems its an app setting to have this protected or not ?

- iPhone Mirroring system requirements

-- Your iPhone and Mac are signed in to the same Apple Account using two-factor authentication.

This setting is to establish a new mirroring session, but presumably that iOS app install metadata is collected at the very first connection and then cached on macOS.

This is a nice feature of the apple ecosystem to be fair, but I do think the issue is with connecting work and personal accounts/devices

It goes both ways.

You must be signed in to the same iCloud account on a personal device and a work device in order to use a feature? Operational security isn't worth the hassle: most people will just do whatever it takes to do the thing. And when they are finished, it's not as if they are likely to sign back out on either device.

Reply on news.ycombinator.com