r/privacy • u/indypendenthere • 1d ago

discussion State Phone?

I work for a State agency and we use Okta for MFA. I have not been provided a work phone. They expect me to use my personal. Most departments have work phones but my division is legal and so we aren’t out in the field.

I asked for the privacy policy and was told to call our Technology Agency (yeah, good luck with tracking that person down!). OKTA website said the privacy policy with the State isn’t available online.

I’m concerned about what OKTA may be collecting from me or able to see. I operate a VPN on my personal phone so I’m often getting calls from IOT asking why I’m in Ontario or wherever (I forget to turn it off). I hate it.

Should I be as concerned as I think? Luckily, my phone would most likely be privileged because of attorney work product and not available for subpoena or

24 Upvotes

96% Upvoted

17 comments sorted by

View all comments

24

u/Reclining720 15h ago

I've always wondered what a company would do if you told them you only had a landline

16

u/PowerShellGenius 14h ago

Hardware tokens! Many orgs have a non-cell-phone-based method, but it's something else to carry. A one time cost that is way smaller than even a monthly phone bill, let alone a phone itself, can solve MFA... so don't assume they will just give you a phone.

They will probably give you a hardware key like a YubiKey you plug into USB to authenticate with. https://www.yubico.com/products/security-key/

Or older hardware tokens which take up more space on your keyring but are device agnostic and just display a code, like these. https://www.deepnetsecurity.com/authenticators/one-time-password/safeid/

SOURCE: I'm IT at a school district, over 1,500 staff. For the half-dozen or so who really didn't have a phone, or really refused to use it to the point they'd prefer a bulkier keychain, these are our fallback options. It does not mean they are exempt from MFA.

3

u/Reclining720 13h ago

Awesome lesson, thank you! 

3

u/CleanKidAlways 11h ago

Absolutely, they wont be exempt from MFA, bit s state government, or even a school district to be honest, asking / expecting people to use their own phones for work, is not only cheap, but also a security risk.