26

I am a software engineer. My company is switching their VPN setup to a new provider that uses a two-factor authentication system. Part of this new setup involves a mobile app -- I have been asked by my corporate IT department to install this app on my personal cell phone for when I use the VPN.

The VPN is required for all remote work; I cannot access anything related to my company without first connecting to the VPN unless I am physically at the office. I do not want to install anything related to my company on my personal cell phone. I don't even have a corporate email client installed.

How do I communicate to management that I do not feel comfortable with -- or am willing to -- install corporate software on my personal phone? What alternative solutions can I offer, and how should I go about approaching management or the IT Security team about this?

Some additional information:

  • The reason I avoid having anything work-related on my phone is because I work in healthcare in the US. Everything I do is very strictly controlled by HIPAA and HITECH, with severe penalties. I've never accessed anything work related from a personal device and don't want to start doing so now.
  • I use the VPN to work remotely (I'm allowed to work from home within reason.) I am willing to give up this privilege.
  • I also use the VPN when I'm called after hours. We have an on-call rota; if called, we have 30 minutes to respond to the emergency. Unfortunately I live more than 30 minutes from the office, so the VPN is necessary for me to respond to these situations.
  • The current version of the VPN, which does not include the two-factor authentication, is being phased out so staying on the older application isn't an option.
  • I told my manager that I did not want to install any work/corporate software on my personal cell phone. He brushed me off. (Me: "Hello manager. I'm being transitioned to the new VPN, but it looks like it requires some software be installed on my phone. I do not wish to install this VPN software on my personal phone." / Him: "Yeah, I thought it looked like a pain.")

This question is somewhat related, but specific to Germany and being asked to actually use the personal device for work. For two-factor authentication, the way it works is that when you sign in, the mobile app receives a counter sign and its proximity to the laptop (or other primary sign-in device) will unlock access to the VPN.

Improve this question
6
  • there are other options - you can install a PC based auth app - winauth.github.io/winauth/index.html that does the exact same thing
    – NKCampbell
    Commented Dec 20, 2018 at 22:51
  • 2
    You sound a lot like me. And if you are like me, then you're just making up reasons that sound logical, but the real reason is, it's simply not work's phone. They're not paying for it, so why should they have any right to have you put something on it for them? Eventually you'll have to decide if this moral stand you're taking is worth more to you than the job. Since it's just a VPN authentication helper, I recommend you go ahead and install it and get back to being great at whatever it is you do.
    – Kent A.
    Commented Dec 24, 2018 at 1:31
  • 2
    Is it something mainstream like "Google Authenitcator" or "obscure in house thing". (Apart from anything else the mainstream ones have other options as nkcamble suggests
    – Richard Tingle
    Commented Dec 24, 2018 at 9:07
  • 2
    Will the corporate software work on a separate device that is not cellular capable? Meaning, can you get a second handset that's WiFi only to carry with you when you're on call?
    – DTRT
    Commented Dec 26, 2018 at 23:31
  • I agree with @RichardTingle here. If it is something mainstream, you can opt to install 2FA app of your liking — they all work the same way. If it is something in house then probably best to ask for a keychain like YubiKey or a company device.
    – Ozil
    Commented Feb 26, 2022 at 5:39

6 Answers 6

Reset to default
40

I've always simply asked for either a company phone or a second auth token generator when such requirements came up, simply ignoring the option to use a private phone. With regards to my employer that private phone simply is not an option available.

IT guy:

You need to install that authenticator app on your phone for VPN to work.

Me:

I don't have a company phone. Where do I request one? Or can you provide me with a dedicated token generator?

That so far always did the trick for them to get the hint that private phone is not an option.

In OP's case that's basically the same strategy as the manager "applied" played back at him, simply ignoring unreasonable demands - just that you offer alternatives. To his defence, he might not have gotten that you have a fundamental objection to install the software on your private phone but rather considered it ugly like he stated.

If someone really pushes you, you can also argue about security issues: You don't consider your private phone a secure environment, so you put all kinds of apps on it, which would render the security aspect void, as it might easily be hacked or getting lost. You could also argue that you share it with your girlfriend and friends.

Also note that many companies have explicit policies that forbid usage of private phones/laptops for company business, you might look your contract / company policy up and point to it, should it contain such a paragraph.

In general: Try not to even given them the idea that you have or could use your personal phone. In principle you could not even have a (suitable) smart phone, so they need to have other options.

Improve this answer
8
  • 14
    This. If they insist tell them you rooted your phone, you install a fresh firmware every week, something like this. A company phone won't have to be an expensive an, and for this use it probably wouldn't even need a contract.
    – idspispopd
    Commented Dec 21, 2018 at 8:14
  • 2
    In addition to the security issue (which is valid) there are a couple of other considerations with using a personal phone 1) Does the company get the ability to remote wipe your phone? 2) Will the company repair or take over the plan to your personal phone to ensure that you can work? As for smart phones in general, up until this time last year I used an original RAZR flip phone - part oft the reason I stopped was because the keyboard died.
    – Peter M
    Commented Dec 21, 2018 at 13:48
  • 1
    @Dan While I too prefer hardware token generators from a security, ease of use and practicality point of view, the possible expectation that you address can easily be quelled. First, the phone needs no contract as it's just for running the token generator. Second, it's on when you work and off otherwise. You can turn this even on its head as there is now no reason if you ever need to be available to hand out your private number. You can simply leave the company phone on - exactly in the time-frame you ought to be available. Only down-side, you have to carry an additional phone then.
    – Frank Hopkins
    Commented Dec 23, 2018 at 3:22
  • 4
    @idspispopd: "If they insist tell them you rooted your phone, you install a fresh firmware every week, something like this." -- Tell them this only if it's true. You don't need an excuse not to install something on your personal device, and this situation doesn't justify lying to your employer.
    – Keith Thompson
    Commented Dec 25, 2018 at 2:51
  • 1
    I wouldn't let any company put their software on my personal devices. They should provide the device if they want their software running on it. For better privacy, you could leave the company phone off when you aren't authenticating with it.
    – R891
    Commented Dec 25, 2018 at 3:26
13

I don't have a smartphone or tablet, so I'm in such a situation once in a while. When that happens I install an Android emulator on my laptop, so that I can install the apps they require. This has always worked for me.

Improve this answer
1
  • If the required app is just an authenticator, there are browser plugins that emulate that feature.
    – Trang Oul
    Commented Aug 11, 2021 at 7:17
10

Ask if your workplace provides a keychain token. Sometimes you have to order one and you simply register it with the two factor authenticator. You can attach it to your keychain or backpack.

However it is not unreasonable in my opinion to install a simple token software on your phone. My previous work place sent a text message and I do not find it very invasive. Now having to gain access from personal devices, that is different but it doesn't sound like that is being asked here.

Improve this answer
2
  • 7
    SMS is different from installing an app. My employer just switched to this too and told everybody to install their app, but when I dug a little deeper I found there was a text-message option so I chose that. Letting them send me codes via text doesn't compromise anybody's security; installing their app is more invasive.
    – Monica Cellio
    Commented Dec 23, 2018 at 3:14
  • SMS is by definition weakest option of all the possible MFA solutions out there. Most of the times you can install your own 2FA management application (even re-use the one which you use for private/personal accounts) and not the one recommended by the org.
    – Ozil
    Commented Feb 26, 2022 at 5:37
4

I find myself in a similar situation, but the client is in the financial industry.

I did some research on the app (RSA SecureID), the token that the IT department sent, and a few other things. I found that the app was a only a number/password generator, and the IT department had no other control, nor could pull any data, etc. It was therefore only generating a second password. Depending on the app, you might find something similar.

If you have a similar app, then I think it's extremely unlikely that this will cause you to run afoul of anything HIPAA related, since the app is just generating a time based number/password.

If the app has any more functions though, I probably would refuse and ask for a hardware widget.

Improve this answer
3

As an aside to the above excellent answers it looks like you can now ask the employer if they will reimburse you for your personal phone expenses. After all, if you'll be expected to do work with it then they should bear at least part of the expense.

If they say no, problem solved.

Improve this answer
2

If you don’t want to rock the boat at all, you can get an older used phone on eBay quite cheaply.

This is probably not the best solution, but the easiest one.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .