while I would for sure check the permissions of the app (and double-check my employment contract for the possible implications of installing that specific app and logging in with my corporate account).
Playing the devils advocate though: installing an app is not necessarily super invasive, especially if the app don't get any permissions (and / or is one of the apps that are ok with getting installed in for instance an android studio-style android emulator).
That said, for sure it would be super nice to be able to get a "real" information on what tracking things happen (unfortunately that's not realistic) and if there are requirements from the company for me to use the system (that would theoretically rely on the install of an android app for instance) I would personally require that I either get a company cell phone to install them on, or some sufficient guarantees (on the level of physical paper contracts signed signed by the head of HR) of what they will do.
Or if they would accept me installing the app (and their app manifests etc) on an android vm on my laptop (like you can get in android studio), in that case I guess it would maybe be kind of acceptable to do it (at least on the work laptop).
The limit I will personally go to on my personal devices is installing a (generic, unrelated to what the company asks me to do) TOTP app and registering 2fa auth in that app.
Oh yeah for sure lol. Don't know how I could miss that since one part of the NDA shenanigans with the particular company I was talking about was that another company bought it during the same period that I started there and a lot of things changed essentially overnight (at least according to colleagues who had worked there for a long time).
The full story is ridiculous / hilarious:
The acquisition meant that between the period that I got the official contract (which was supposed to be the new parent companies contract but their HR department refused to send it out to the then daughter company, so I ended up with the old default contract for the daughter company) and signed the contract, and when I started working (which was a couple of months due to reasons) they had an updated "NDA" which actually was a new employment contract with a lot more terms than were in the original contract (and that were illegal in my country, at least according to my legal counsel).
So my first day at that place a new "NDA" waited for me on my desk which turned out to actually be an employment contract. And apart from it having illegal provisions in it, there were references to me accepting an NDA rider that was not available to me at that point so I asked for a copy of that.
In the actual NDA there were even worse provisions. One clause in the contract expanded (it wasn't explicit but that was what it meant) to me not being able to get a mortgage (or even a bank account) in my country (because I would not be allowed to do any kind of "business" with any company who was a customer of my company, or that was a customer of our customer due to them using our software (and we provided FX software for banks).
Another clause explicitly said that all intellectual property that I produced from the time that I signed the NDA were properties of the company, and they would own all intellectual property that I produced UNTIL THE DAY I DIED (including after leaving the company), so after leaving that company I would not be able to work at any place that would expect me to provide intellectual property for them (unless I fought that admittedly illegal agreement in court).
Obviously I refused to sign the new contract and sent an email to the daughter company CEO (we were less than 40 employees) asking to set up a meeting. I then never got a reply until ~6 months later when I was threatening to leave (partly because of this, partly because of payment disagreements, partly because ~25 employees of the daughter company had resigned and left from when I started to that point). Then he really apologized and admitted in a private meeting that no, the employment contract was not enforceable in our country and that even presenting it to employees as something that they might be asked to sign would be grounds for sanctions for the company. And then he managed to convince the parent company to get me a counter offer to get me to not leave which was super insulting (~50USD/month raise), combined with trying to get me to take over as head of operations for the daughter company (because, apart from me and one other person the whole ops department there had resigned).
So obviously I left. And after I resigned the parent company refused to pay out overtime because "there is no explicit agreement with the /new/ company about overtime compensation", and they did some other things to try to screw me over.
There are also some hilarious stories about the guy who stayed and what they promised and how they "fulfilled" those commitments. But that's not my story to tell.
Anyway sorry for ranting, apparently I still have some sore spots regarding this company lol.
And tl;dr: just because your company might be cool right now and you trust it, it might get bought up tomorrow and everything changes overnight.
edit: I got around the "requirement" for me to sign the new contract / nda by getting an email from the local HR asking for me to send in the NDA and me responding with a PDF of the signed origal contract and an email saying "here is the contract that I have signed", and then it freaked out the parent companies HR person during the exit interview when they looked me up in the system (because they had a history of making a point of saying that their intention was to enforce the NDA + employment contract as harshly as possible) and I then told her to check the related PDF.
As someone who no longer shares devices / numbers / ... with employers partly due to NDA shenanigans in the same vein as in this article and when I left that company they tried to make my life as difficult as possible and tried to withhold compensation and so on.
Sure, in the happy path porting number is easy. But this assumes that
* the company will be ok with you porting it out (and not just hold onto it out of spite, which I believe the company I worked for might have done)
* the company will handle that kind of tickets in a reasonable amount of time
* the company will not need to escalate this sort of request to levels where they will then be ignored
* the company will be technically competent to handle this sort of request
I'm not saying that all or even most companies will have these problems but the issue is that if the first thing you do when joining the company is port your number over, how can you know what the internal company culture is and if they will make it feasible for you to get your number back later on?
This also ignores the big selling point of keeping your work accounts / numbers separate: being able to disconnect. Just being able to put your work laptop and phone away and know that you won't get called has it's own fairly large value.
Long time lurker, first time (in a while) commenter :)
I read a lot of blog content but the majority of books I read is fiction (wast majority is SF or fantasy).
One reason is that if I want to read a non-fiction book it's usually to make a real deep dive into a technical subject (control theory for instance) which does not lend itself to quick things. One issue is that I usually don't have the time for that, another is that due to me following so many blogs and having RSS feeds to keep me busy my ability to focus has essentially vanished.
(edit: I also used to read interesting research papers but, again, have lost the focus factor there)
Playing the devils advocate though: installing an app is not necessarily super invasive, especially if the app don't get any permissions (and / or is one of the apps that are ok with getting installed in for instance an android studio-style android emulator).
That said, for sure it would be super nice to be able to get a "real" information on what tracking things happen (unfortunately that's not realistic) and if there are requirements from the company for me to use the system (that would theoretically rely on the install of an android app for instance) I would personally require that I either get a company cell phone to install them on, or some sufficient guarantees (on the level of physical paper contracts signed signed by the head of HR) of what they will do.
Or if they would accept me installing the app (and their app manifests etc) on an android vm on my laptop (like you can get in android studio), in that case I guess it would maybe be kind of acceptable to do it (at least on the work laptop).
The limit I will personally go to on my personal devices is installing a (generic, unrelated to what the company asks me to do) TOTP app and registering 2fa auth in that app.