5

My IT department has this great idea: if you want to read your work email on your personal device, you have to give us total access to the device. Well, no. It's my personal device, you can't have it. So I can't have work email.

Then I discover there are apps for Android that really don't care what my IT dept thinks, and they connect to Exchange for the emails anyway. Then I discover Mail+, which does the same thing in iOS: Connecting to my company's Exchange server without the profiles installed, and allowing me access to my work email.

My question is this: How are these apps connecting to the Exchange server? What is different about the way the iPhone connects with native email accounts? Is there a way to make the native accounts work without the profiles installed by my IT dept?

Improve this question
2
  • 4
    Sounds like it's (ab)using Outlook Web Access (OWA) to get around the Exchange server. Seems like a security hole but I'm not sure how you'd patch it without disabling OWA for legit users. And no, you can't do this with the default app because Apple is playing by the rules.
    – tubedogg
    Commented Sep 25, 2013 at 18:37
  • Like @tubedogg said: they're probably abusing OWA. Have IT turn off OWA and see if Mail+ and the like still function.
    – Ian C.
    Commented Oct 1, 2013 at 1:17

1 Answer 1

Reset to default
1

There are certainly a lot of variables here, some are.

The way traffic is 'managed' on the network that you are on.

There are many ways an IT department could prevent their network participants from accessing certain resources, I will explain a few.

DHCP & DNS. Your specific device may be configured by reserved DHCP to use a different DNS server than everyone else. This may prevent external email services (possibly OpenDNS). You could try manually configuring your DNS to 8.8.8.8 (Googles service) and test again. *This will still fail if for instance the IT department have also restricted DNS traffic on port 53 to their own DNS service exclusively.

Level 7 Firewall capability. A firewall can specifically see email traffic and through the creation of rules 'shape' traffic to fit an IT policy. This firewall could then 'see' Apple mail type conversation and block it, another email application may not behave the same way therefore failing to trigger the 'shape' match and ignoring it.

Mail servers can also be configured to use custom configurations, alternative port's could be used or your application may even use a proxy service or VPN (that could be hardcoded into the app)

That said and if your specific corporate IT policy permits, you could always 'investigate' using a VPN of your own if you wanted to 'experiment' (internet search 'personal vpn service') This would enclose your port 25 activity within a VPN tunnel.

Incidentally, I think it's worth mentioning. When your IT department ask for you to accept an Android or iOS device management policy, they do not actually have access to your personal email accounts. They can enforce certain policies, for instance forcing a device to have a lock code, password complexity, length. Other capabilities depend on the device but neither currently have native support for location tracking.

Improve this answer
6
  • The granting of limitations to my functionality is what I'm worried about, not the privacy of my information. I was also told they'll have access to my current location at any time, which makes me uncomfortable as well.
    – Bryson
    Commented Sep 26, 2013 at 2:45
  • Asides the legality context here, a non civil service etc; publicly traded corporation can not encroach on your privacy by force of IT policy. Not whatsoever. Also, unless your installing a specific application that you specifically grant location access to on your device, there is nothing to worry about, it's not possible through a standard mobile device management policy at this time.
    – spaceshipdev
    Commented Sep 29, 2013 at 19:50
  • That's good to know! Is there a specific law(s) I should compare their IT policies with?
    – Bryson
    Commented Sep 30, 2013 at 21:47
  • I would say a reliable mode of assurity would be in the review of your employers terms of use policy. An employer must set out in the policy document how and what they will monitor. I have certainly read that privacy in a workplace is an expectation and not a right as it where. Here is a link to Androids current device management capabilities, location reporting is not supported currently.
    – spaceshipdev
    Commented Oct 1, 2013 at 0:28
  • So long as you agree to it (by virtue of being employed and given notice, or in this case allowing your device to be managed by them) they can do pretty much whatever they want. There is no expectation nor right of privacy, and yes IT policy can override what you would probably consider your "rights" all day long. Again notification is major contributing factor, but the very fact we're having this discussion means you are aware of their intentions.
    – tubedogg
    Commented Oct 1, 2013 at 2:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .