Hacker News Reader

Comment by edent | Hacker News Reader

Android used to have an "office hours" setting which would prevent specific email accounts from notifying you outside of your specified times.

I had my work GMail set to notify only between 0800 (so I could check for a "don't come in" message) and 1700 Mon-Fri. Of course, it didn't account for holidays / sick leave etc, but it was good at prevent me from panic checking every ping.

I wish that was a feature on modern Gmail. Or, indeed, WhatsApp and Signal. You can manually mute, but there's no way to silence specific notifications at specific times.

Regardless, employees shouldn't be expecting employees to be on-call without compensation. But users also need ways to manage this themselves.

View on HN

Check out Buzzkill, its a great app for managing notification rules. You can set it to hide and batch up notifications during your off hours and show them later.

I use 2 different email apps for exactly this reason. I can check my work email if I need to, but I don’t want notifications.

> Or, indeed, WhatsApp and Signal.

You can use Shelter from FDroid to create a separate work profile in the phone, with separate accounts, and then pause it after office hours.

This is still a thing on Android if your work account is a Google account and uses the Work profile feature. You can pause all apps in the Work profile on a schedule (or on demand), so it includes any work apps you might have in addition to email.

Second phone?

Indeed. If $job is not willing to buy and hand me a "work phone" then they are out of luck, nothing for $job gets put onto my private phone. If they think they need this ability, then they also need to add a line item to their budgets for the cost of the phone and the service. And when faced with this alternative, they have not, so far, decided they want to pay for a phone.

Where do you draw the line? If the employer wants you to install a 2FA app on your phone, do you demand a separate phone or alternate 2FA device for that and mark yourself as a troublemaker? Or do you just do what 99.8% of the staff does and install the app?

My IT department and I fully support staff requesting YubiKeys, there’s no concept of being a “troublemaker” for having boundaries and respecting security requirements. I’d talk to your IT management if your company culture seems different, I bet the actual techs do not have an issue with this.

I'm happy to be the "troublemaker". In my experience, one troublemaker can often recruit others to their cause.

>In my experience, one troublemaker can often recruit others to their cause.

Maybe if your company is filled with the type of people who run archlinux on their IBM era thinkpads, but otherwise I would be very surprised if could find even one or two sympathetic people who are also against installing a 2fa app. Even if you can get your manager to cave, it'll be less because they want to be "troublemakers" themselves, and more because they don't to deal with the hassle of arguing with you.

Dude, your characterization of me being an arch user with an ancient latop is clearly in bad faith.

Maybe you're incapable of communicating with your coworkers about how your employer exploits you. I graduated third grade, so I'm not.

>Dude, your characterization of me being an arch user with an ancient latop is clearly in bad faith.

Someone with 3rd grade reading comprehension should be able to realize the comment about IBM era thinkpads were directed at your coworkers, not you. Then again, there was a recent OCED report about how around 7% of tertiary students have the literacy skills of a 10 year old, so that might explain why there are people who proudly proclaim they passed third grade, but nonetheless have worse comprehension.

>Maybe you're incapable of communicating with your coworkers about how your employer exploits you. I graduated third grade, so I'm not.

See my subsequent remark about "...they don't want to deal with the hassle of arguing with you.".

I would install the app on the shittiest iPhone backup i have (I must have like 10 iPhones by now, i dont sell old ones)

You can also perfectly use 2fa without a phone, unless your shitty company is using some shitty propietary 2fa, and even then, its just a "key" or "qr" they give you, that then you totally control and can use in mostly any 2fa compatible app, like Passwords. app from apple, 1Password, or Authy (RIP)

Installing shitty apps just cause your company tells you to is a great way to get your personal phone hacked too

Sames goes with all the MITM bullshit, If you want to install malware on my 6k macbook, you've gonna have to buy me your own "work macbook" for me to handle that shit. And i wont touch it for anything else than work. But installing spyware from work in my personal computer is a big NO NO.

>You can also perfectly use 2fa without a phone, unless your shitty company is using some shitty propietary 2fa, and even then, its just a "key" or "qr" they give you, that then you totally control and can use in mostly any 2fa compatible app, like Passwords. app from apple, 1Password, or Authy (RIP)

Only if they're using RFC 6238 TOTP, and not some weird 2fa app. It's ironic you mention authy because they have their own weird TOTP scheme, along with push notification based approval system.

Authy is also EOL since it was acquired by twilio and tossed into the do not recycle bin it seems...

But yeah, things can get messy depending on the specifics, but not installing random apps on your personal phone seems like a pretty reasonable line to make.

I only mentioned Authy cause it was my go-to for 2fa before they got acquired

> Where do you draw the line?

If they want me to have some "special device", they pay for the hardware for me to have said "special device".

My private phone is not for their use, ever.

Seems pretty in line with a recent frontpost of "Pre-Modern Armies for Worldbuilders, Part III: Paying for It " [1].

There's a cost for everything and while you can "devolve" the cost downwards of a phone to an employee it's probably correct (in capitalism perspective) for an employer to pay for any tool they require so that the input costs are correctly correlated to the output price.

[1]: https://news.ycombinator.com/item?id=48689859

Take for example a university. Many of them seem to use Duo[1], which is not something you can replace with Google Authenticator or other TOTP app. They require it for students as well as faculty and staff. Is it reasonable for them to have to provide a device to all those people, forcing them to carry two devices around, and then also deal with replacing lost or broken devices? The cost of this would simply be added to the technology fee that students have to pay, when they all already have smartphones and could use the app for no additional cost.

[1] https://duo.com/

> Is it reasonable for them to have to provide a device to all those people, forcing them to carry two devices around, and then also deal with replacing lost or broken devices?

No, but it's also not reasonable for them to only offer something that can't be used with other software. Use a different 2FA scheme

One of the biggest banks in the US forces staff and contractors alike to install a proprietary 2fa app on their personal devices. if you can get a company phone, you can't finish activating the MDM, to install the company 2fa app, without first using that 2fa app on your personal device. Even a company yubikey can't be activated without the 2fa appp, which again, you can't get on a company device without first installing it on your personal device.

What about people who don’t have smartphones? Not everyone has one.

Easy fix. The company buys me a second personal phone, which I can then use to set up the work phone which they also buy.

Yes. That is where you draw the line. Work use of your personal device. Why is this so hard to imagine? If you're working somewhere where not donating resources to your employer means you are a troublemaker, it's time to find new work.

They can buy a USB Fido token. I've had this argument with employers in the past; some states have laws that require the employer compensate employees for requiring the use of their personal mobile device, even for something as simple as MFA. There's no such thing as a free lunch: if you want to require an employee do something, you must be willing to pay for that capability. Ethically, I think all employers should be held to this standard. Legally, anyone who employs people in California, Montana, and I think Massachusetts must be aware of that standard.

if the company wants to identify me by my phone, they have to take control over the phone. eg. a rooted android can screw with their app

that means they need to provide it

If its a standards compliant TOTP 2fa, I don't have any issue in adding those to my app.

If its the terrible MS authenticator or DUO, then get me a device.

> Indeed. If $job is not willing to buy and hand me a "work phone" then they are out of luck

My employer has a BYOD program with a monthly stipend that is somewhat more than my phone provider (Fi) charges for an extra line. I think doing this with a non-flagship phone would probably pay for itself in a year or two.

I’m torn. I’d prefer the 2nd phone, but at some point it’s not worth arguing about. If they are paying enough I just mentally subtract the cost from my comp.

Having to lug 2 phones around has always seemed like more trouble than it's worth to me. I also don't like having multiple devices to do stuff that a single one could do, for environmental reasons, but that's not a very wide-spread opinion.

So I do have work stuff on my personal phone, but with no notifications whatsoever. Only works because I'm in a position where it's acceptable to require all communications to go through emails or messaging apps though.

I'm not worried about notifications on my personal phone, I just don't want to install anything work related there. I don't want them to have even a tiny bit of chance of having access to my personal data, photos, browsing, anything

Im with GP, absolutely no work stuff on my personal phone

If a device is owned by a corporate entity it becomes trivial for them to engage in wildly intrusive monitoring.

For example, if Apple can verify the device was purchased by a corporate entity and then enrolled in an mobile device management system, it will allow a lot of things that it won't allow on a personal device - things that can be used for monitoring.

> wildly intrusive monitoring.

Like what for example? They can’t access any chat messages or app data. Even your location is impossible to obtain without your knowledge.

I have two iPhones, one for day and one for the night.

Reply on news.ycombinator.com