I've worked at a security software engineer at multiple FAANG where I've held the proverbial "keys to the kingdom." It was a strange feeling knowing that my compromise could lead to the complete and total takeover of the companies I worked at. Realistically, these companies are already compromised by multiple nation-state actors; regardless, I'm glad to not have that responsibility hanging over my head anymore.

The dichotomy between your comment and the sneering of Xooglers in the recent "RCEs on Google engineer workstations is not a security issue" is interesting.

> recent "RCEs on Google engineer workstations is not a security issue"

I'm interested in reading that if you have a link.

Put more simply/directly: if these people put those credentials on their phones in the first place, they should be embarrassed by their security hygiene. More than embarrassed: possibly fired, or at least have that access taken away until they take a basic infosec awareness course.

What are you talking about? Second factor on the phone IS how many companies do 2FA. (Not just ones with poor security, but big tech companies.)

And not for nothing, but a yubikey isn’t exactly protected from border agents either. At least a phone has some legal protections now.

OP stated that getting access to the phone would have allowed a hacker to compromise the protected systems. A 2FA credential alone shouldn't allow that, so my assumption was that they were storing a full authenticator on the phone.

steal password + seize the phone to get 2 factor token = compromise.

It’s not really two factor authentication if the claim is the phone also contains the passwords, the first factor.

What kind of kompromat could I read on one of these phones during a border search and compromise a big company? Are you talking about a draft press release or dirty secrets about large scale crimes?

Before Snowden everyone was like, who cares if the government sees my encrypted traffic, they don't know what is inside; or location info. And then people found out that metadata can be more powerful than the actual unencrypted information and can tie a person to a lot of things. So yeah, how about they don't search the phone without probable cause?

I find it astonishing, and horribly upsetting, that people think needing a warrant is horrible.

Needing a warrant, means you have to articulate why you want to invade someone's private life, and it further provides a chain of accountability.

It prevents rogue employees(peace officer, border patrol) from doing whatever they want, it provides oversight, it provides a second set of eyes, it provides for adherence to legislation and court decisions!

Yet I see people thinking it's some sort of horrible requirement. So bizarre.

It's fairly common to have login credentials to business email, slack (etc) accounts.

So that can be pretty serious for senior staff, infrastructure team members, and so on.