Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy for Students: Surveillance Self-Defense

ssd.eff.org

Post reply on HN
Print view View original

51–60 of 95 posts

Re: Privacy for Students: Surveillance Self-Defense

#51

Post by fn-mote »

pabs3 wrote: post #41
picture wrote: post #19

This sucks. My school district used a bunch of money to buy every student chromebooks. I remember just a few years ago, back when I was in middle school, I helped unbox all the chromebooks that were shipped to the school - about 2500 of them. Just for one middle school. Every student having access to these laptops made some thing a lot easier, like using Canvas to submit work done on Google Docs. However, this is in…

I wonder if the Chromebooks could dual-boot with regular Linux.

They can but they need to be dis-enrolled in enterprise management, so students cannot do this themselves. At least at the time I looked at it, there was no reasonable workaround.

Re: Privacy for Students: Surveillance Self-Defense

#52

Post by fn-mote »

mips_avatar wrote: post #45
germinalphrase wrote: post #15

Earlier quoted context omitted.

If you’re talking about teaching staff, they almost certainly have no part in purchasing or deploying these systems.

Given that it’s almost impossible to get fired as a teacher I think they need to show a little bravery and push back against this damage being inflicted.

The most direct avenue for change on this front is probably through school board elections. Everyone can help solve the problem.

Schools I am familiar with are managed in a very top-down way, so it's hard to see at what point teachers could push effectively. They are not likely to be involved in purchasing the hardware, selecting the software, or choosing (surveillance) vendors.

You could argue that the teacher's union could be spearheading the pro-privacy push. I would support that, but it might be kind of far from the "core business" of the union. There are areas with a greater and clearer short-term impact my city's local teacher's union has choosen (e.g., internet access for low-income students).

Re: Privacy for Students: Surveillance Self-Defense

#53

Post by germinalphrase »

mips_avatar wrote: post #45
germinalphrase wrote: post #15

Earlier quoted context omitted.

If you’re talking about teaching staff, they almost certainly have no part in purchasing or deploying these systems.

Given that it’s almost impossible to get fired as a teacher I think they need to show a little bravery and push back against this damage being inflicted.

I am a public school teacher at the high school level. I’m a union member and I have tenure. My union participation means I have to be offered a PIP before I can be released, and I can request a union lawyer at disciplinary meetings. If my boss wanted me gone next school year, I would be ‘not renewed’ and gone. I only say this to underscore that the country is big and broad.

Re: Privacy for Students: Surveillance Self-Defense

#54

Post by 29083011397778 »

ddingus wrote: post #42
tremon wrote: post #17

Earlier quoted context omitted.

I would consider this a teaching opportunity. Get her a Faraday case for the device. Explain to her that the case isn't to protect the device, but to protect her from the device. Try to make her control the device, rather than the other way around.

She is little, so yeah deffo time for tech education. My own kids were not particularly interested, but she is, so that's a nice change. Edit: I am gonna start with Faraday Cage. Thanks.

Being the "confused grandparent" might be a fantastic way to teach via the Socratic method. Moreso if one is savvy enough to know what's likely being done (such as remote-admin by the school board), what is rather dystopian and ought to be avoided (see above), and how to work around the blocks put in place by others.

Re: Privacy for Students: Surveillance Self-Defense

#55

Post by fulafel »

easton wrote: post #37
chasil wrote: post #24

Earlier quoted context omitted.

Surprising that schools are requiring additional certs to be added a a device for internet access. This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device. https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...

Of course, that means you can’t use the school’s Wi-Fi since now every site with https won’t let you pass. Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing witho…

Or use a VPN.

Re: Privacy for Students: Surveillance Self-Defense

#57

Post by siraben »

Gen Z-er here. I really appreciate that the EFF is writing a guide aimed at students. I was in high school only a few years ago, we were provided MacBook Pros (13-inch, mid-2012), which for me also served as my personal laptop (my own MBP had a failing hard drive). After a few weeks of using it in classes, I realized that none of the class activities required exotic software I couldn't figure out how to obtain, so I formatted the disk and reinstalled macOS (even though we had admin, I booted into recovery instead). For my younger sibling, who was in middle school at the time, they did not have admin access and there was a surveillance software that allowed the teacher to view their screen (and god knows what else), I decided to protect their privacy as well and reinstall the OS. This got me into a bit of trouble (for modifying "someone else's computer"), but to no long-term harm, and when they reinstalled the OS with the software I removed it again anyway.

EDIT: I also randomized my MAC address while using the school network using a script I wrote during a free period[0]

The worrying bit is that most gen-Zers have a radically different and weakened view of digital privacy. They are more than happy to use services with bad privacy track records just because "their friends are on it", network effects trump everything else. They self-censor constantly and mistakenly think that perceived impermanence (e.g. Snapchats, or Instagram stories) means things would be deleted forever. They happily share passwords with romantic partners, even viewing grades (!) (despite constant stories of blackmailing after breaking up), constantly reuse passwords, don't have TFA, the list goes on. Out of convenience, secondary schools use services like GSuite, but in doing so they condition the next generation of people to increasingly give up their privacy.

At one point I tried to deactivate my Facebook account, but the day after, ran into problems because my clubs were using it as a proto-Slack platform, so I bit the bullet and continued using it.

Now that many of us are in university, the surveillance gets more ridiculous, especially in a pandemic. Most notably, I've heard friends complain of software that tracks your eye and body movement, audio, video and screen while taking a test. Fortunately for me the most I've had to do is join a Zoom call while the (human) professor proctors.

More hacker culture-minded types take more precautions, but it is sadly an extremely minority opinion, IME.

[0] https://gist.github.com/siraben/c3133b39e470d1aed16fd71f42b8...

Re: Privacy for Students: Surveillance Self-Defense

#58

Post by abestic9 »

slumdev wrote: post #32
chasil wrote: post #24

Earlier quoted context omitted.

Surprising that schools are requiring additional certs to be added a a device for internet access. This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device. https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...

It's not really surprising. Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm). In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.

There is a fine line between doing this to protect IP and actual privacy abuse - and as we're treading it's important to remember how important context is.

This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections.

There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.

Re: Privacy for Students: Surveillance Self-Defense

#60

Post by siraben »

picture wrote: post #19

This sucks. My school district used a bunch of money to buy every student chromebooks. I remember just a few years ago, back when I was in middle school, I helped unbox all the chromebooks that were shipped to the school - about 2500 of them. Just for one middle school. Every student having access to these laptops made some thing a lot easier, like using Canvas to submit work done on Google Docs. However, this is in…

Do you still use those Chromebooks in high school? Did technically-minded kids eventually find their way around the restrictions such as reinstalling the OS?
Post reply on HN