My employer wants/wanted to install a 3rd party app on my personal cell phone. One of the issues that we are still not seeing eye-to-eye with is regarding security.
Here are some issues that concern me:
- The 3rd party sent everyone in our company the same password in a company-wide e-mail.
- The app does not have a way to change the password.
- All of our usernames are predetermined and easily guessable.
- It's possible to login as anyone from any device into this app.
My boss has used a car analogy, suggesting that I'm requesting security similar to "full roll cage, 5 point safety harness, helmet, and HANS device, and a fire suppression system". I've pointed out that the security of the app is more like that of a Ford Pinto. I've compared his car safety analogy to "more like using 2-factor authentication with 32 character randomly generated password using a mix of lowercase, uppercase, numbers, and special characters stored via salted password (inefficient) hashing with each user having a different randomly generated salt".
I am no security expert. Perhaps I was incorrect with my response to him. Can someone point me to either a better response (e.g. an unbiased source)?
Update A few people have asked what type of app it is. The best way I can explain it is a social media app for just our company.