[sfifs]

So employees are trying to chat "anonymously" on a tech company's wifi network? Seems remarkably dumb for tech employees.

It should be assumed as a given that any company or hotel wifi network is monitored and HTTPS is quite possibly is MITMed.

[Symbiote]

An employee's personal phone wouldn't accept the certificate if HTTPS was MITMed.

[RyJones]

If the employer uses an MDM as a precondition for email access, it might.

[throwanem]

That's a hard stop for me; no employer may have that degree of control over anything I own. I won't even configure an account with Exchange's protocol, because that enables remote device wipe.

If an employer wants to issue me a company phone, that's fine. If an employer wants to enable IMAP, that's fine. Otherwise, I won't have mobile access to email, because the risk is unacceptable. And if that's not fine - well, it's been great talking with you, and I appreciate your time, but I'm afraid this position doesn't seem like a good fit after all.

[Programmatic]

I like seeing more awareness of this! It's always depressing to hear people say that they don't care or that it's not a big deal.

There are various third party applications that will allow you to use Exchange protocols without the OS integration: they'll let the Exchange server admins wipe the application's container/data rather than the entire phone. I think it's a much fairer implementation.

[dboreham]

The requirement to agree to honor the remote wipe request is optional at the server. That is to say, you can use the EAS protocol and not also require remote wipe, if you want to. In theory you could also interpose an EAS proxy between your device and the server that pretended to honor the remote wipe request but not not pass it on to the device (unless the server is setup to check client certs).

Source : I have implemented this protocol.

[rrdharan]

These days the risk of an accidental wipe seems so trivial to me, since every app (photos, music, notes, docs, podcasts etc) I use is of the local-sync-backed-by-cloud variety.

So I guess I can understand not trusting the IT department but I worry very little about losing the data on the device.

Of course if you're not sold on the cloud-backed model because of privacy concerns and you prefer treating your device itself as a source of truth and a secure store then I can understand the attitude.

[foepys]

You don't really have to MITM, you could just check the logs of the DNS server that the network DHCPs to the WiFi clients for queries to Blind's IP addresses.

This doesn't tell you the content but if an employee uses the app. Make of this what you want but given Uber's previous actions I don't think they would just ignore this.

[lojack]

I don't use the app, but messages appear to be timestamped, that's probably enough to deanonymize many conversations.

[slig]

> This doesn't tell you the content but if an employee uses the app

It appears that one has to register using a corporate email address, so it's trivial to figure out which employees are using this service.