Hacker News Reader

Comment by jzl | Hacker News Reader

I've heard multiple times directly from Apple employees that there is no way to login to iCloud on your work machine using a company-controlled account. Many people create new Apple ID's which they only use while working there, but others just use their personal iCloud accounts. You are, of course, not supposed to store company data in iCloud. But thanks to Apple's own efforts, it's difficult to use a Mac without being logged into iCloud (for example if you want to use the App store), and some data can easily spill into the iCloud account.

If accurate, it is of course patently absurd that Apple has left this an unsolved problem.

View on HN

I have used a Macbook at work for 5 years without signing into any iCloud account ever.

I suppose this is harder when the company hosts everything in icloud though...

I have as well but if you want to use any software that is only on the App Store like Numbers or Pages then you are out of luck.

It is a sub-standard experience and it looks like it is only going to get worse as Apple pushes iCloud into more areas of macOS.

But I don’t have to use any apps from the store, in fact I’d say that at my company there aren’t any apps available on the store that we use. So the parent is right, it’s perfectly usable without ever touching iCloud. I don’t think I’ve ever even opened the settings for it on my work laptop

Apple certainly uses Numbers, Pages, etc. internally extensively, so you really do have to sign into an iCloud account as an employee.

That's rough. Not just the iCloud thing but, Numbers is so much worse than Excel or even Google Sheets.

Not anymore, it’s been slowly improving over the years and is pretty good now.

I'm saying it's bad because my new work laptop has Numbers instead of Excel ;_; There are CSVs I had to import into GSheets because Numbers was choking.

macOS is generally good about not forcing an iCloud account, but the Mac App Store is the one piece of nonsense that needs it.

Yes, that's correct - an Apple account is tied to a person. A person can have multiple Apple accounts, if they wish. But there is no such thing as an organizationally controlled Apple account.

>A person can have multiple Apple accounts, if they wish.

I don't know if it's in the terms but Apple definitely discourages this. In particular it won't let you setup a new account on the same phone number as an existing account.

Yes this seems incoherent and incompatible for a company that supposedly care about their trade secrets.

This legal action will make anybody think twice before walking out of Cupertino with a stash of secrets.

Which is what OpenAI will argue - that Apple is negligent in protecting their trade secrets. Trade secrets are not protected in the USA if the company doesn't take reasonable effort in protecting them. I would feel quite confident as a lawyer arguing against a company that intentionally has their employees use personal accounts on their corporate devices, long after using separate work accounts and devices has become SOP for large companies with serious security concerns (almost certainly including OpenAI itself).

This is better explained in The Information article (which is paywalled): https://www.theinformation.com/articles/apple-icloud-policy-.... Emphasis mine:

> When new employees join Apple, the company often issues them an iPhone and Mac and pays for an iCloud account with a large amount of online storage capacity. Crucially, during the onboarding process, Apple encourages new hires to use their preexisting personal Apple IDs with this iCloud account, through which their co-workers can share internal Apple documents and other files with them.

There is a solution though. I don't like it, but we use MDM to disable iCloud file sync, scan network communication and such.

I have a company-managed Apple account on my work iPhone and Mac. So I beg to differ ¯\_(ツ)_/¯.

It is quite nerfed compared to a normal Apple account - for example the App store is effectively disabled and you need some MDM to be able to install or update apps. But otherwise, it allows me to not use my personal Apple account which was the main objective.

Edit for precision: I don't work at Apple. My point is that it is possible - I guess Apple doesn't want to manage these accounts, but it is not for lack of technical feasibility.

You can log into your personal account and have iCloud file sync disabled. I mean what does that prevent that you couldnt do by some other means? I could also just use a browser to drag and drop anything to my personal google drive. Or use a usb stick.

I don’t understand people that create separate Apple accounts for work.

I’ve always used my personal account on corp laptops, including MFAANG. It’s awesome being able to use side car on my personal machines, hand-off on my AirPods, or screen mirroring to my Apple TV during conference calls. What are you gaining from isolating your account? Why even bother making a fake account at all?

You aren't gaining or losing much - but they are gaining a huge risk. Just as you above show by being able to easily move files to any USB drive or Google Drive

Are you saying that your employers prevent you from accessing any potential data-leaking avenues? No usb ports, really? That’s an insane level of paranoia. Do you work for the mob or a drug cartel? How do you even compile and debug?

I've worked in strategically important sector and only USB devices that were allowed were keyboards and mice. The use of Bluetooth keyboard/mouse was discouraged.

My company locks down the USB ports on our macbooks so that only input devices are recognized. Flash drives and the like are not recognized. We’re a small private company in the telco space so definitely not the mob or a cartel.

Why would I need a USB drive to docker build or run a debugger?

Firmware development, IoT, basically anything embedded. Mobile devs that want a responsive debugger. Yubikey authentication. Smart card readers. Remoting into air-gapped machines.

Thats just stuff I do.I’m sure there are many other use cases.

For context, I work for a very large company in Redmond that has a renowned history of antitrust litigation.

Lot of places just lock down USB to read only. Exceptions could be made for specific machines and device IDs.

It's pretty common really - and if the internal disk is fully encrypted reasonably hard to easily exfiltrate a large amount of data.

Of course that doesn't stop taking screenshots with another device but that's a slow process

If you are a decision maker, you might find your personal stuff subject to a subpoena for any number of reasons. Antitrust, insider trading, harassment suits, all sorts of legal fishing expeditions. Its convenient to be able to just give them the corporate burner, and get another. I know a few people who had to go through this with their personal phones and this is a horrible experience. For once, you lose your phone there and then and are explicitly forbidden for tampering with anything replicated to iCloud.

A friend of mine is a svp of something something and his corp was sued by antitrust regulators. One day police is at his doorstep - not even a legal letter - and they took his phone then and there. Super disruptive, considering one usually has a lot of MFA tied to the phone.

This is simply bad hygene. It's such a basic thing that I can't even figure out how to back up far enough to start to explain why one should keep work and personal life seperate. I guess if I'd ever had kids I would have had to figure this out when they were like 5 or 6, and then I'd know how to explain what should be explained to every 5 or 6 year old.

Reply on news.ycombinator.com