18

I am a software engineer. My company is switching their VPN setup to a new provider that uses a two-factor authentication system. Part of this new setup involves a mobile app -- I have been asked by my corporate IT department to install this app on my personal cell phone for when I use the VPN.

The VPN is required for all remote work; I cannot access anything related to my company without first connecting to the VPN unless I am physically at the office. I do not want to install anything related to my company on my personal cell phone. I don't even have a corporate email client installed.

How do I communicate to management that I do not feel comfortable with -- or am willing to -- install corporate software on my personal phone? What alternative solutions can I offer, and how should I go about approaching management or the IT Security team about this?


Some additional information:

  • The reason I avoid having anything work-related on my phone is because I work in healthcare in the US. Everything I do is very strictly controlled by HIPAA and HITECH, with severe penalties. I've never accessed anything work related from a personal device and don't want to start doing so now.
  • I use the VPN to work remotely (I'm allowed to work from home within reason.) I am willing to give up this privilege.
  • I also use the VPN when I'm called after hours. We have an on-call rota; if called, we have 30 minutes to respond to the emergency. Unfortunately I live more than 30 minutes from the office, so the VPN is necessary for me to respond to these situations.
  • The current version of the VPN, which does not include the two-factor authentication, is being phased out so staying on the older application isn't an option.
  • I told my manager that I did not want to install any work/corporate software on my personal cell phone. He brushed me off. (Me: "Hello manager. I'm being transitioned to the new VPN, but it looks like it requires some software be installed on my phone. I do not wish to install this VPN software on my personal phone." / Him: "Yeah, I thought it looked like a pain.")

This question is somewhat related, but specific to Germany and being asked to actually use the personal device for work. For two-factor authentication, the way it works is that when you sign in, the mobile app receives a counter sign and its proximity to the laptop (or other primary sign-in device) will unlock access to the VPN.

  • there are other options - you can install a PC based auth app - winauth.github.io/winauth/index.html that does the exact same thing – NKCampbell Dec 20 '18 at 22:51
  • You sound a lot like me. And if you are like me, then you're just making up reasons that sound logical, but the real reason is, it's simply not work's phone. They're not paying for it, so why should they have any right to have you put something on it for them? Eventually you'll have to decide if this moral stand you're taking is worth more to you than the job. Since it's just a VPN authentication helper, I recommend you go ahead and install it and get back to being great at whatever it is you do. – Kent A. Dec 24 '18 at 1:31
  • Is it something mainstream like "Google Authenitcator" or "obscure in house thing". (Apart from anything else the mainstream ones have other options as nkcamble suggests – Richard Tingle Dec 24 '18 at 9:07
  • Will the corporate software work on a separate device that is not cellular capable? Meaning, can you get a second handset that's WiFi only to carry with you when you're on call? – Johns-305 Dec 26 '18 at 23:31
28

I've always simply asked for either a company phone or a second auth token generator when such requirements came up, simply ignoring the option to use a private phone. With regards to my employer that private phone simply is not an option available.

IT guy:

You need to install that authenticator app on your phone for VPN to work.

Me:

I don't have a company phone. Where do I request one? Or can you provide me with a dedicated token generator?

That so far always did the trick for them to get the hint that private phone is not an option.

In OP's case that's basically the same strategy as the manager "applied" played back at him, simply ignoring unreasonable demands - just that you offer alternatives. To his defence, he might not have gotten that you have a fundamental objection to install the software on your private phone but rather considered it ugly like he stated.

If someone really pushes you, you can also argue about security issues: You don't consider your private phone a secure environment, so you put all kinds of apps on it, which would render the security aspect void, as it might easily be hacked or getting lost. You could also argue that you share it with your girlfriend and friends.

Also note that many companies have explicit policies that forbid usage of private phones/laptops for company business, you might look your contract / company policy up and point to it, should it contain such a paragraph.

In general: Try not to even given them the idea that you have or could use your personal phone. In principle you could not even have a (suitable) smart phone, so they need to have other options.

  • 7
    This. If they insist tell them you rooted your phone, you install a fresh firmware every week, something like this. A company phone won't have to be an expensive an, and for this use it probably wouldn't even need a contract. – idspispopd Dec 21 '18 at 8:14
  • If you trust Google instead, you can always ask if the Google Authenticator app is compatible with their system. Now, whether you should trust Google instead... – pboss3010 Dec 21 '18 at 13:16
  • In addition to the security issue (which is valid) there are a couple of other considerations with using a personal phone 1) Does the company get the ability to remote wipe your phone? 2) Will the company repair or take over the plan to your personal phone to ensure that you can work? As for smart phones in general, up until this time last year I used an original RAZR flip phone - part oft the reason I stopped was because the keyboard died. – Peter M Dec 21 '18 at 13:48
  • You might open a pandora box if you request a company phone. They will then expect you to be on call 24/7 since you have the phone with you. – Dan Dec 21 '18 at 15:46
  • The token generator is pretty benign useage. However, given this is healthcare I can see that even having a personal phone around the office might be a concern for some. Since we are talking token generators, these are pretty easy to install in a number of ways, even on the work laptop itself. So work with IT to get an alternative. – Bill Leeper Dec 21 '18 at 22:49
9

I don't have a smartphone or tablet, so I'm in such a situation once in a while. When that happens I install an Android emulator on my laptop, so that I can install the apps they require. This has always worked for me.

6

Ask if your workplace provides a keychain token. Sometimes you have to order one and you simply register it with the two factor authenticator. You can attach it to your keychain or backpack.

However it is not unreasonable in my opinion to install a simple token software on your phone. My previous work place sent a text message and I do not find it very invasive. Now having to gain access from personal devices, that is different but it doesn't sound like that is being asked here.

  • 3
    SMS is different from installing an app. My employer just switched to this too and told everybody to install their app, but when I dug a little deeper I found there was a text-message option so I chose that. Letting them send me codes via text doesn't compromise anybody's security; installing their app is more invasive. – Monica Cellio Dec 23 '18 at 3:14
2

As an aside to the above excellent answers it looks like you can now ask the employer if they will reimburse you for your personal phone expenses. After all, if you'll be expected to do work with it then they should bear at least part of the expense.

If they say no, problem solved.

0

If you don’t want to rock the boat at all, you can get an older used phone on eBay quite cheaply.

This is probably not the best solution, but the easiest one.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.