Can an employer force staff to use personal phones for multi-factor authentication?

For me personally I am in a bit of a odd position, I'm self employed but I also do work for a lot of places that are owned by Large entities or branches of the Government and they have a lot of security concerns.

For me before and during lockdown I've had to log into remote systems to sub invoices, work orders, specialist compliance reports, etc most of the time I was given a VPN token with the contract name taped onto the back I keep in my safe and I've always maintained a work and private phone but mostly out of preference same goes for my computer's I have a laptop I use for work and when I'm away from home or my workshop and I have a personal desktop for everything else and I rebuild the floating laptop every few months anyway just to make sure I know it's clean and working but also keep the two separate.

(I'm aware most people can't have this set up but it's just how I've always done it), Since lockdown's have happened more places I do work for and subcontracting for have required some form of 2FA to access there systems - I've provided my own work phone for this task and kept my personal phone for personal things, but if I was a employee I would ask for them to provide me with some form of recompense for it and also a written agreement it was for 2FA only not device management, or a alternative path such as a Token or a SMS.

/r/CasualUK Thread