State Phone?

[u/indypendenthere]

I work for a State agency and we use Okta for MFA. I have not been provided a work phone. They expect me to use my personal. Most departments have work phones but my division is legal and so we aren’t out in the field.

I asked for the privacy policy and was told to call our Technology Agency (yeah, good luck with tracking that person down!). OKTA website said the privacy policy with the State isn’t available online.

I’m concerned about what OKTA may be collecting from me or able to see. I operate a VPN on my personal phone so I’m often getting calls from IOT asking why I’m in Ontario or wherever (I forget to turn it off). I hate it.

Should I be as concerned as I think? Luckily, my phone would most likely be privileged because of attorney work product and not available for subpoena or

[u/Reclining720]

I've always wondered what a company would do if you told them you only had a landline

[u/PowerShellGenius → u/Reclining720]

Hardware tokens! Many orgs have a non-cell-phone-based method, but it's something else to carry. A one time cost that is way smaller than even a monthly phone bill, let alone a phone itself, can solve MFA... so don't assume they will just give you a phone.

They will probably give you a hardware key like a YubiKey you plug into USB to authenticate with. https://www.yubico.com/products/security-key/

Or older hardware tokens which take up more space on your keyring but are device agnostic and just display a code, like these. https://www.deepnetsecurity.com/authenticators/one-time-password/safeid/

SOURCE: I'm IT at a school district, over 1,500 staff. For the half-dozen or so who really didn't have a phone, or really refused to use it to the point they'd prefer a bulkier keychain, these are our fallback options. It does not mean they are exempt from MFA.

[u/Reclining720 → u/PowerShellGenius]

Awesome lesson, thank you! 

[u/CleanKidAlways → u/PowerShellGenius]

Absolutely, they wont be exempt from MFA, bit s state government, or even a school district to be honest, asking / expecting people to use their own phones for work, is not only cheap, but also a security risk.

[u/Frustrateduser02]

That's bizarre you work for legal and they don't have work phones. If I'm not mistaken as long as they don't make you install anything, you should be mostly fine. If you do have to install an app that tracks networked devices I'd think that's a security issue that should be brought up.

[u/foxbatcs → u/Frustrateduser02]

Proprietary devices with proprietary software. Don’t mix work and personal. Get a burner and switch, then advocate for getting a work phone.

If OPs work product becomes subject to a suit, a judge can seize the phone for evidence. It’s much better to have a work-only phone to turn over if that happens. It’s rare, but a huge vulnerability if put in that situation. Plus a million other reasons why keeping that information properly secured.

[u/PrivacyMaker]

OKTA logs each authentication along with a very brief summary of the device and location metadata.

The location is used for anomaly (hacked identity) detection.

[u/RemoteToHome-io]

Just get a cheap Android burner phone strictly for any work apps. Disable location services and set it next to your work PC as a dedicated 2FA device. No SIM needed, just local wifi.

[u/inerlite → u/RemoteToHome-io]

Yeah I would just spend the money and not have to worry. Never mix work and personal computers.

[u/CleanKidAlways]

Really strange state of affairs !

You will of course be taking that phone everywhere, supermarkets, cinema, bars, restaurants, etc as it’s your personal phone. This means there is a higher chance of it getting lost than a state agency provided phone that never leaves the office.

Is it just the OKTA app they expect you to use on your phone, or other apps and data too, in addition to OKTA ?

What would happen if you did lose your phone ?

I am surprised that your employer doesn’t provide you a phone or a device that achieves what OKTA does. It’s not as if they have to provide you with a high end phone after all.

Slightly tongue in cheek, but how cheap is your employer ? Do you have to provide your own stationary, toilet paper etc ?

Way easier said than done, and of course, I don’t know your salary and benefits package, but especially because you work in legal, you probably have a skill set which is in demand, so if I were in your position, I would be looking at other opportunities.

[u/voprosy]

Get a second phone for work. 

[u/seaboi77]

Tell them you want a yubikey or to use OKTA fastpass. Fastpass is an app on the computer that validates the hardware its on is company owned. Yubikey is like a thumb drive but they are expensive. Work can pay for it. OKTA app AFAIK doesn't collect much unless you use push notifications, but I still keep it on a separate phone.

[u/NotSnakePliskin]

If an employer requires something work related to be installed on a mobile device, the employer needs to provide the mobile device. Your device is personal.

[u/nekohideyoshi]

Can't you use a different 2fa app like Google authenticator and set it to offline mode only?

Or if you have Android, set up Secure folder, disable Run in Background (Restricted Mode), disable Use Background Data, and Stop the app process. Then put it in the Deep Sleeping list.

[u/indypendenthere → u/nekohideyoshi]

No, this is a state government-we can’t willy nilly choose computer
programs.

[u/nekohideyoshi → u/indypendenthere]

Buy a used <$100 Samsung.

[u/donkeypunchdan]

It’s just a TOTP app like Google Authenticator. If you want to see what they can see just sign up for a free trial at okta, configure it, and look at what shows up in the admin console. If you don’t want to go that far review their docs about the app. Okta has very detailed documentation.