Personal phone and work question

[Patricio Swayze 17058]

Alright IT dudes, I need an answer. I feel like I know, but need to double check.

 

I work for a company that requires me to use PingID on my personal phone to authenticate my VPN access (called F5 VPN Client) on a company laptop. Can they monitor what I am looking at on my phone?

 

I would think not as PingID is just for authenticating, right?

[Mo Horn 8899]

This might be helpful. 

[Nice Guy Eddie 13546]

Just assume your company knows everything that you have on or do on your phone.

[Patricio Swayze 17058]

Just assume your company knows everything that you have on or do on your phone.

That doesn’t sound ideal. Haha.

[UnivTex34 1763]

My understanding is you should be good. I'm sure there will be much more qualified people here shortly to confirm. UT Austin uses Duo for the same purpose for anything requiring EID sign in. If on iOs just lock down all of the app permissions other than notifications.

[Zepol87 9263]

You are just authenticating right? Or are you running the VPN on your phone as well? If just authenticating then you should be good 

[Patricio Swayze 17058]

You are just authenticating right? Or are you running the VPN on your phone as well? If just authenticating then you should be good 

Just authenticating. I don’t have any VPN client on my phone. Just the company laptop. However, I do have teams on my phone and it used PingID to authenticate.

[Onboard 2.0 9083]

Look, just don't drop it in the fryer vat when yer surfing porn..........

[bernorange 8375]

Company wants employees to carry an electronic key to unlock access to their computer system, they should provide the electronic key (business cell phone, RFID card, whatever).  I never understood how it became acceptable for businesses to abuse employee personal time/life. 

[CooterBrown 18094]

If your employer requires you to use your phone for work, they should be providing you a phone or at least reimbursing you the cost of your plan.

[Celery Man 21027]

This is stuff I should be smarter about than I am. What the other guys said about how the company should provide or reimburse the device are correct, but I suspect that is besides the point. If it's just a mobile multi factor authentication token (open the token, put in the digits on your laptop, it allows you to connect), I wouldn't worry about it (also, keychain tokens exist but i bet your company doesn't want to deal with the hassle). If your phone is joining the VPN I would be concerned about what traffic they might inspect. If they wanted to install something that imaged or managed my phone I would tell them no.

[CooterBrown 18094]

Another issue with using your personal phone for work is that if a lawsuit asks for any relevant communication between employees, you'll have to surrender your phone and all contents for review.  Maybe you get it back in a week or a month.  However, all your kink photos are now part of the case record.

[Nice Guy Eddie 13546]

I would assume that if you get fired for doing something on your phone, like visiting a gambling website, then your lawyer could fight to see all of the same relevant information on every employees' phone. Ensure they are enforcing the rules in an uniform matter. 

[Onboard 2.0 9083]

2 hours ago, CooterBrown said:

If your employer requires you to use your phone for work, they should be providing you a phone or at least reimbursing you the cost of your plan.

If they reimburse, doesn't that sort of give them access to your phone info ?  I'll pay for my phone, and you have no access to it, and I'll write off the deduction on my itemized taxes.

[Patricio Swayze 17058]

This is stuff I should be smarter about than I am. What the other guys said about how the company should provide or reimburse the device are correct, but I suspect that is besides the point. If it's just a mobile multi factor authentication token (open the token, put in the digits on your laptop, it allows you to connect), I wouldn't worry about it (also, keychain tokens exist but i bet your company doesn't want to deal with the hassle). If your phone is joining the VPN I would be concerned about what traffic they might inspect. If they wanted to install something that imaged or managed my phone I would tell them no.

This was my point/question. I am not really using my phone for calls or Teams often and when I do, it’s over Wi-Fi. I do not have a VON client on my phone. It is on the company laptop. My understanding is this PingID is just for authentication. I suppose I can ask the IT guy.

[Guest]

If it's not a company (funded) device, then how would you be liable?

I mean if it's during work hours, you probably are fucking up somewhere else too...

Edited August 12, 2021 by slorch

[elfenix 34387]

if android expect it to be leaking/sucking up data from everything.  that's simply how android works. 

if you're not cool with that, get a burner worker.  don't even bother putting it on a plan, just use it on wifi (hotspot from your personal phone if out in the field). 

Edited August 12, 2021 by elfenix

[Patricio Swayze 17058]

Just a bit of a follow up.  I read on the PingID site that they do in fact have the capability to track your location.  I don't know if your (or my) company is using this function, but it is an option.  I do doubt they can see your texts, emails or browsing.  I plan on talking to our IT guy next week.  I might end up getting a company phone to do my authentication.

[deadshank 24653]

11 hours ago, Patricio Swayze said:

Just a bit of a follow up.  I read on the PingID site that they do in fact have the capability to track your location.  

I’m gonna save everyone time and money and let them know you’ll either be in a bbq joint or out in the Katy area on a road infested with snek. 

[Celery Man 21027]

Forensic IT guy #1: He frequently visits this location in 78745

Forensic IT guy #2: Yeah that's South Austin's Mom's house, I've seen him there

[SDG 3319]

On 8/12/2021 at 8:34 AM, bernorange said:

Company wants employees to carry an electronic key to unlock access to their computer system, they should provide the electronic key (business cell phone, RFID card, whatever).  I never understood how it became acceptable for businesses to abuse employee personal time/life. 

This is what my company does.   I have a card but prefer the to receive the temp authentication numbers via text on my phone.  The key word is text.  There are no apps or two way communications they can monitor.