There was interesting discussion elsewhere on SE a few days ago where somebody had put a foot wrong at work and found that her laptop wouldn't power up for the duration of the investigation. However I think there's a distinction to be made between a company-owned laptop being disabled and the company mandating what browser- hence possibly also what OS- is to be run on a "bring your own" system.

If this were the case, why wouldn't they have just blocked running programs from outside the Program Files folder, so that Firefox Enterprise could still run but Firefox Portable couldn't? Also, not having a rogue root CA doesn't mean you can surf without getting MITM'd by it; it just means all of your connections will fail.

So the security concern is that it's too secure?

This seems highly likely, not the same industry as stated but still a highly regulated one. I wonder if this has anything to do with "working from home" and wanting to monitor staff.

@corsiKa yeah well this is kinda personal security vs company-wide control. It could be used to make the company more security against individual malicious or compromised employees but then opens them up to get compromised or malicious in the first place. Central control vs. distributed trust or the like. But yes, at least many corporations, certifications and policies would prefer the first approach as it's the easier legal/political argument to cover yourself legally should something happen.

@corsiKa Security and privacy are usually in opposition, aren't they? A police state / surveillance state could be very secure, all but eliminating crime and terrorism, at the expense of anybody's privacy. Laws reducing privacy are often justified with „think of the children” or „terrorism”, in both cases thus justified by safety and security. A society with high levels of privacy, however, has to accept it cannot prevent and combat crime and terrorism as effectively as one where privacy is absent.

@gerrit Security for individuals is also security. When you stop hackers seeing your emails, it's privacy++ and security++. When you stop some mythical benevolent dictator seeing your emails, it's privacy++ and security--

@user253751 Sure, but when boss speaks of security they are speaking from the perspective of a dictator, not the equivalent of a grassroots privacy advocate. Maybe boss in OP example considers privacy a threat to their surveillance ability and therefore to their control over security.

@gerrit the issue with a business is that as their agent, working on their equipment and accessing their network, and particularly in regulated industries, you don’t have an individual right to privacy in that context. If you misuse that equipment, the business is responsible. Sure, you can be individually sued and/or prosecuted if the action rises to that level, but the business has a responsibility. Keep your private stuff on your own gear, and on your own time. If you’re going to use your own device for the business, you’re going to have to live with the compromise.

Can't you use Chrome portable and enable DNS over HTTPS in the settings? Or even make your own build of Firefox Portable that would mask itself as another innocuous app?

@Craig You're right, of course. That doesn't contradict anything I said. A business may claim spying on their employees necessary for business security and they might be within their right to do so (IANAL, but I imagine they would need consent).

@gerrit The law is fairly clear on this. There are some safeguards, but generally anything and everything you do on company-owned equipment is the property of the company. Imagine a large public firm preparing to conduct a large deal that is likely to affect the stock price. Some employee, with no ill intent, casually mentions the deal to a friend or relative in an email. That communication is an S.E.C. issue exposing the firm to potential criminal prosecution and heavy penalties. Every business has a P&P manual with a communications policy. Just keep your stuff on your own equipment. ;-)

@Craig Sure, and I would expect companies to have their employees signing that they agree with this when they sign their contract or no later than when they start working, or otherwise have a statement somewhere that by performing work they agree on this. At least where I've worked I've signed such noticed, maybe that was superfluous (I've also signed that I won't take bribes) or maybe it needs to be explicitly stated in some locations.

@gerrit Essentially all professional companies of any scale at all do have their employees sign these agreements, and even if they don't, they're pretty much covered legally. Too many people use company-owned laptops and mobile devices without really thinking about this. That text message you sent from your company smartphone to your cousin calling your boss a <expletive>? Yeah, the company owns that text message. The same goes for websites you visit and personal letters you write on your company laptop. Unless you have an explicit signed agreement to the contrary. And I still wouldn't do it.

@Craig Even worse, when I worked for a UK university, it was made clear to me that by the Freedom of Information Act, anybody could request access to any emails I had sent or received with my university account, with only a handful of university employees authorised to censor minimal amounts of those emails before they would be made public. I can understand that an employer would block the use of technology if they believe the technology can be used to circumvent company policy or even the law (FOIA did not require me to store the emails though, just to hand them over if I do and am asked to)

@gerrit that points up the need for an official data retention policy, so those emails are automatically deleted after, say, 6 months unless they have explicitly been set aside for archival. If they don't exist, they can't be handed over. If there's a policy then they haven't been deleted to hide anything. Imagine another fun angle, where a (family) business with kind of an easy-going, trust-based culture is purchased by new, less easy-going owners who don't know you and suddenly own all of your email and documents going back years. If the gear isn't yours, keep personal stuff off of it. :-)

@PyRulez too secure for whom? for an employee accidentally clicking a phishing link in an email? making racist remarks on twitter?someone watching porn at work?