8 ms·

Apple Configurator (self-hosted local MDM, free macOS app in store) has an option for "supervised" iOS devices so that Wi-Fi connections are limited to SSIDs wh

Apple Configurator (self-hosted local MDM, free macOS app in store) has an option for "supervised" iOS devices so that Wi-Fi connections are limited to SSIDs which are pre-defined in the MDM profile. It's intended for enterprise usage. Worth testing to see how MDM policy interacts with carrier-managed Passpoint networks. Note: you can't supervise an existing device without wiping it, so this is an experiment to conduct with a spare phone, or one already managed by Configurator/MDM. Apple Configurator training: https://it-training.apple.com/tutorials/deployment/dm095 https://it-training.apple.com/tutorials/deployment/dm095 Wi-Fi payload: https://developer.apple.com/documentation/devicemanagement/wifi https://developer.apple.com/documentation/devicemanagement/w... Another option is using Apple's MDM for small business to define a list of approved SSIDs, https://www.apple.com/business/essentials/ https://www.apple.com/business/essentials/ Edit: is there an option to "Remove Profile" in Settings? General -> VPN & Device Management -> Configuration Profiles Edit2: workaround by null routing the carrier's Wi-Fi SSID? https://www.reddit.com/r/tmobile/comments/vvt6dd/comment/iyrq3v4/ https://www.reddit.com/r/tmobile/comments/vvt6dd/comment/iyr... Change IP address to manual and 127.0.0.1 Change subnet mask to 255.255.255.0 Change DNS to manual and 251.252.253.254

cxie 3y ago
The "Remove Profile" option in Settings might be helpful if it's available, but it seems like it could be carrier-dependent, and not all users may have this option. The null routing workaround seems interesting and could potentially help in avoiding unwanted connections to the carrier's Wi-Fi SSID. However, this method might require some technical knowledge and might not be ideal for less tech-savvy users.
newZWhoDis 3y ago
I do not have any profiles installed, and none of my devices are managed. I’m aware this could potentially be fixed by enrolling all my family’s devices in an MDM. But I mean come on, wipe everyone’s phone to enroll in MDM? Seems pretty crazy when the phone should just let you control what it does/does not join. Edit: I misread your post, I see now it was more suggesting a test. My bad.
- stacktrust 3y ago
  If Carrier MDM policy can override Configurator/Enterprise MDM policy, then corporate security admins will likely be unhappy about their lack of control over enterprise device networking. Has the industry forgotten the pre-iPhone disaster of telco-controlled devices? https://www.quora.com/Why-was-the-iPhone-initially-exclusive-to-AT-T?share=1 https://www.quora.com/Why-was-the-iPhone-initially-exclusive... > The landscape of the cell phone market was very different pre-2007. Most notably, the carriers had complete control over what phones were allowed on their network. A carrier could nix a feature that had been in R&D for years and suddenly you couldn’t sell your new phone with this amazing feature. They were especially protective of data and overloading their networks, which led to browsers on phones being stripped down and limited. The whole “full web” was not a technical impossibility, it was just that carriers wouldn’t allow phones on the network that had a full browser. https://archive.is/4ZCH5 https://archive.is/4ZCH5 > Apple bucked the rules of the cellphone industry by wresting control away from the normally powerful wireless carriers ... Mr. Jobs once referred to telecom operators as "orifices" that other companies, including phone makers, must go through to reach consumers.
- mynameisvlad 3y ago
  Since when did you have to wipe your phone to enroll it in MDM? You don’t even have to wipe it if you unenroll, and that would certainly be more important since the phone could have downloaded sensitive content in that time.
  - Yechi770 3y ago
    Don't know since when, but definitely for a few years. To fully unenroll too. The reason is because in order to fully manage the device it needs to reset and restart in a managed mode.
    - TheHappyOddish 3y ago
      This isn't true. You can enroll and unenroll without wiping. You can't _supervise_ without wiping. These are two seperate (commonly confused) things.
philsnow 3y ago
Thank you for that first link. I stumbled across Apple Configurator when I was trying to lock down an old phone, to have at home as a pseudo-landline (but which I can take with me on trips) that is safe to leave accessible to kids. I got it working by muddling through, and that link would have at least let me situate myself in the space of "what does this thing do?" better.
- jdelman 3y ago
  What settings did you use to lock down your phone?
  - philsnow 3y ago
    More or less: - prevent removal of profiles: general -> security -> "with authorization", and added a password - prevent total phone wipe: general -> functionality -> [ ] allow Erase All Content and Settings (supervised only) - only allow a few apps to run: restrictions -> apps -> restrict app usage -> only allow some apps phone, messages, facetime, settings - disallow installing new apps: restrictions -> functionality -> [ ] allow installing apps (supervised only) - content filter -> filter type -> limit adult content I'm not really sure what this does but makes sense to enable it - wi-fi -> configure one payload, for my home guest network - google account -> configure one payload, for a phone@vanitydomain.com google account I have a copy of the resulting .mobileconfig file that also allows safari, but I only enable that when I'm e.g. taking a flight on Southwest and want to be able to use that phone as another screen for passing time in the plane
    - tekknik 3y ago
      This seems like a heavy handed solution to a simple problem, which isn’t necessarily bad. Why did you not get a number forwarding service to forward to your primary cell phone instead of carrying 2 devices?
      - stacktrust 3y ago

cxie 3y ago

The "Remove Profile" option in Settings might be helpful if it's available, but it seems like it could be carrier-dependent, and not all users may have this option. The null routing workaround seems interesting and could potentially help in avoiding unwanted connections to the carrier's Wi-Fi SSID. However, this method might require some technical knowledge and might not be ideal for less tech-savvy users.

newZWhoDis 3y ago

I do not have any profiles installed, and none of my devices are managed. I’m aware this could potentially be fixed by enrolling all my family’s devices in an MDM. But I mean come on, wipe everyone’s phone to enroll in MDM? Seems pretty crazy when the phone should just let you control what it does/does not join. Edit: I misread your post, I see now it was more suggesting a test. My bad.

stacktrust 3y ago
If Carrier MDM policy can override Configurator/Enterprise MDM policy, then corporate security admins will likely be unhappy about their lack of control over enterprise device networking. Has the industry forgotten the pre-iPhone disaster of telco-controlled devices? https://www.quora.com/Why-was-the-iPhone-initially-exclusive-to-AT-T?share=1 https://www.quora.com/Why-was-the-iPhone-initially-exclusive... > The landscape of the cell phone market was very different pre-2007. Most notably, the carriers had complete control over what phones were allowed on their network. A carrier could nix a feature that had been in R&D for years and suddenly you couldn’t sell your new phone with this amazing feature. They were especially protective of data and overloading their networks, which led to browsers on phones being stripped down and limited. The whole “full web” was not a technical impossibility, it was just that carriers wouldn’t allow phones on the network that had a full browser. https://archive.is/4ZCH5 https://archive.is/4ZCH5 > Apple bucked the rules of the cellphone industry by wresting control away from the normally powerful wireless carriers ... Mr. Jobs once referred to telecom operators as "orifices" that other companies, including phone makers, must go through to reach consumers.
mynameisvlad 3y ago
Since when did you have to wipe your phone to enroll it in MDM? You don’t even have to wipe it if you unenroll, and that would certainly be more important since the phone could have downloaded sensitive content in that time.
- Yechi770 3y ago
  Don't know since when, but definitely for a few years. To fully unenroll too. The reason is because in order to fully manage the device it needs to reset and restart in a managed mode.
  - TheHappyOddish 3y ago
    This isn't true. You can enroll and unenroll without wiping. You can't _supervise_ without wiping. These are two seperate (commonly confused) things.

philsnow 3y ago

Thank you for that first link. I stumbled across Apple Configurator when I was trying to lock down an old phone, to have at home as a pseudo-landline (but which I can take with me on trips) that is safe to leave accessible to kids. I got it working by muddling through, and that link would have at least let me situate myself in the space of "what does this thing do?" better.

jdelman 3y ago
What settings did you use to lock down your phone?
- philsnow 3y ago
  More or less: - prevent removal of profiles: general -> security -> "with authorization", and added a password - prevent total phone wipe: general -> functionality -> [ ] allow Erase All Content and Settings (supervised only) - only allow a few apps to run: restrictions -> apps -> restrict app usage -> only allow some apps phone, messages, facetime, settings - disallow installing new apps: restrictions -> functionality -> [ ] allow installing apps (supervised only) - content filter -> filter type -> limit adult content I'm not really sure what this does but makes sense to enable it - wi-fi -> configure one payload, for my home guest network - google account -> configure one payload, for a phone@vanitydomain.com google account I have a copy of the resulting .mobileconfig file that also allows safari, but I only enable that when I'm e.g. taking a flight on Southwest and want to be able to use that phone as another screen for passing time in the plane
  - tekknik 3y ago
    This seems like a heavy handed solution to a simple problem, which isn’t necessarily bad. Why did you not get a number forwarding service to forward to your primary cell phone instead of carrying 2 devices?
    - stacktrust 3y ago