My employer wants/wanted to install a 3rd party app on my personal cell phone.  One of the issues that we are still not seeing eye-to-eye with is regarding security.

Here are some issues that concern me:


The 3rd party sent everyone in our company the same password in a company-wide e-mail.
The app does not have a way to change the password.
All of our usernames are predetermined and easily guessable.
It's possible to login as anyone from any device into this app.


My boss has used a car analogy, suggesting that I'm requesting security similar to "full roll cage, 5 point safety harness, helmet, and HANS device, and a fire suppression system".  I've pointed out that the security of the app is more like that of a Ford Pinto.  I've compared his car safety analogy to "more like using 2-factor authentication with 32 character randomly generated password using a mix of lowercase, uppercase, numbers, and special characters stored via salted password (inefficient) hashing with each user having a different randomly generated salt".

I am no security expert.  Perhaps I was incorrect with my response to him.  Can someone point me to either a better response (e.g. an unbiased source)?

Update
A few people have asked what type of app it is.  The best way I can explain it is a social media app for just our company.

Let's address your points one by one.


  
  The 3rd party sent everyone in our company the same password in a company-wide e-mail.
  


A password that everyone knows is not a password. It's like leaving the key under the mat, only without the mat to hide it.


  
  The app does not have a way to change the password.
  


So if you ever lose your keys or think someone else might have them, you can't change the locks - and from point 1, we know that your keys are already in other people's hands.


  
  All of our usernames are predetermined and easily guessable.
  


So, the people who have your keys also know where you live.


  
  It's possible to login as anyone from any device into this app.
  


Put the first three together - other people have your keys, they know where you live, and you can't change the locks - and yeah, this is the result. Anyone can get into somewhere that should be yours alone. To recycle your employer's car analogy, he's asking all employees to lock their cars but leave the keys in the door, and then park in the company car park underneath a sign with their name on.

And on top of all this, he's asking you to do this on your personal phone. Your employer has no right to be touching that device. Depending on what this app does, this could be exposing your personal data to risk because of a third-party security flaw that you have no control over.

Even if the third-party app isn't malicious and doesn't do anything that causes a risk, there's no guarantee that it's 100% free of accidental flaws or bugs that might cause a security weakness or present an opportunity for some other malicious party to exploit. Given this third-party company's atrocious handling of basic security practices like "don't email passwords", "don't re-use passwords", and "always allow users to change their passwords", the chances of their app being completely safe, secure and free of vulnerabilities is looking pretty slim.
