Google Starts Sharing All Your Text Messages with Your Employer(www.forbes.com)
43 pointsby toomanyrichies11 hours ago10 comments
  • oftenwrong9 hours ago
    This headline is misleading.

    >This applies to work-managed devices and doesn’t affect personal devices.

    "All Your Text Messages" implies _all_ messages, which is not the case.

    • SilverElfin8 hours ago
      But many jobs require you to bring your personal device, rather than giving you a separate work phone. And when you want to connect it to your work email or calendar, since that’s what’s expected these days, you are forced to opt into their IT team’s management of your personal device. I think that makes you fall under the privacy gap the article is describing.
      • AuthAuth6 hours ago
        On android it splits into two seperate profiles. Personal and work and they do not share the same app data, photo,files, contacts etc.
        • olyjohn14 minutes ago
          I'm pretty sure this only works on Pixel phones if your employer enables the "Work Profile" from their MDM service. My previous employer didn't care to, and all my shit was mixed together.
      • pjmlp7 hours ago
        Well, I am quite sure in many European countries I can refuse that practice as per work legislation.

        Now if people aren't keen into fighting for their rights, that is another matter.

      • marssaxman7 hours ago
        That practice sounds like it ought to be illegal. I'm glad I have never encountered it.
        • halJordan6 hours ago
          It is illegal, the only problem is that standing behind you is a rube who will absolutely let his employer use a private phone instead of demanding a company one
      • lern_too_spel7 hours ago
        Android is a multi-user OS. One of the ways this is exposed is via work profiles, which are walled off from the main profile. The IT management applies only to the work profile.
  • pavel_lishin11 hours ago
    > While employees have long been aware of the risks in over-sharing on email — a woefully insecure technology that is easy for employers to monitor, texting has been seen as different.

    I don't think they're even that aware, but yep - this will get some careless folks in trouble.

  • everfrustrated8 hours ago
    Looks like it shows a very obvious warning in the messages app.

    See screenshot here.

    Headline is clearly click-bait.

    https://support.google.com/work/android/answer/13761869#zipp...

  • 10 hours ago
    undefined
  • ramesh319 hours ago
    >"allowing employers to intercept and archive RCS chats on work-managed devices."

    Key phrase there. You should already be treating any employer provided device as completely compromised. Never do anything on those that you wouldn't be perfectly comfortable having projected on a screen in front of your entire company at a meeting.

  • youngtaff9 hours ago
    Never assume anything you do on a work device or a work network is private
  • sidibe10 hours ago
    I'm surprised this wasn't already the case for work phones?
    • palmotea10 hours ago
      The article says it will allow "employers to intercept and archive RCS chats on work-managed devices."

      I can read that as applying personal phones hooked up to employer services. I think it's pretty common to force employees to consent allowing their employers to manage their device to get access to work email on it. I'd always assume that just mean they could remote wipe it, but maybe it's even worse than that.

      • nhubbard9 hours ago
        Since this is on Android, this policy should only apply to the version of the Messages app within the work profile, right? If it didn't and could access personal messages, that would be crossing a line.

        Reading the post makes it sound like this only happens on managed devices; whether that means "owned and provided by work", "within the confines of the work profile on a BYOD devices", or both, I'm not 100% sure.

      • JohnFen10 hours ago
        > I think it's pretty common to force employees to consent allowing their employers to manage their device to get access to work email on it.

        Is it common? I've only been asked to do that once, and I declined. I explained that it's my policy to never use my personal equipment for work purposes or my work equipment for personal purposes. They provided me with a work phone to use, instead.

        • palmotea7 minutes ago
          I don't know how common it is, but it's optional for me (at least). If I want access to work email/calendar/chat (which is convention), I'd have to consent to some kind of device management.

          But personally, I've always said no, because years ago someone at my workplace fat-fingered a command and wiped all iPhones hooked up to company services (including employee-owned personal devices). I've always seen it as a risk to my data if not my privacy.

        • kaikai6 hours ago
          I’ve worked for multiple companies and only one demanded I enroll my personal phone in their device management. I pushed back in a public channel and they reconsidered the policy. I left shortly after so not sure where that landed.

          Everywhere else I’ve worked I’ve had slack/teams/email/pagerduty whatever on my personal device without issues. It hasn’t felt realistic to ask for a dedicated work device for that.

    • lxgr9 hours ago
      It’s been taking Google a minute to fully reinvent the wheel with their proprietary instant messaging solution du jour.
  • m-hodges10 hours ago
    Periodic reminder that E2EE chat apps like Signal cannot protect you from a device that betrays you (MDM). I don’t use Signal on any work devices. I can’t do anything about my colleagues who chat with me and do.
    • d1sxeyes10 hours ago
      Could you explain how MDM would breach E2EE? I know that it can be used to MITM TLS connections, but not aware of a way it would breach E2EE like Signal.
      • m-hodges10 hours ago
        It doesn’t breach E2EE; it gives your employer control over the device. Once messages are decrypted on the phone so you can read them, anything your employer deploys via MDM (screen capture, keylogging, backup/forensics tools, admin unlock, etc.) can potentially copy them.

        On a company-owned, fully managed device, you should treat MDM as roughly equivalent to handing your boss an unlocked device: anything you can see on-screen could be captured or exfiltrated by tooling they deploy.

  • Joshua-Peter9 hours ago
    [dead]