Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#91

Post by micromacrofoot »

trasz wrote: post #80
duxup wrote: post #68

Earlier quoted context omitted.

> A gaping security hole What is that?

“the system installed GoGuardian monitoring software on the Chromebook without notice or permission.”

It's tied directly to the remotely managed account, that's how the account works. If you don't sign into the account, the software won't be installed.

Students don't get to decide what software to install when it comes to logging in to school accounts. Generally the laptops are provided by the district, but it seems OP was trying to add another personal device to their system.

You can't participate in their system without the software. So I guess the alternative would be to block personal devices from logging in like this at all.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#92

Post by duxup »

CodeWriter23 wrote: post #84

Organize other pissed-off parents and persist at school board meetings until they change the policy. You’ll likely be labeled as terrorists for seeking redress with your public officials but stand strong, read up on laws and the board’s bylaws. Let them enter a trap (like ignoring you) where the law/bylaws say you can petition for removal of board member(s) on that cause. You’ll likely have to take it to court. But p…

Considering the range of protections a school is required to provide and that school IT is usually poorly staffed, paid, funded awkwardly… tons of different motivations for various policies.

I wouldn’t expect these policies to change.

Best bet is to not mix school administrated accounts with personal devices.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#93

Post by andrewmutz »

I think if you log in with any other google account, you won't have the GoGuardian stuff running.

So I would recommend setting up a personal account for your child and telling them to log in to that whenever they want to work on something unrelated to school (or just want privacy)

Re: Tell HN: My kid's school installed spyware and I can't remove it

#94

Post by detaro »

MereInterest wrote: post #82
detaro wrote: post #42

Earlier quoted context omitted.

They did a factory reset and reconnected the Chromebook to the school account, which configures the device according to the schools requirements. If they wanted to use it themselves, they would reset it, do not connect the school account and all is well. GPs argument seems to support that the school doesn't have to allow to use a school account without the device being put under the schools control. (at least as I un…

That doesn't really make sense to me. User accounts, whether managed remotely or locally, should be subordinate to administrator accounts. That administrator-level privileges are insufficient to undo a change made with user-level privileges breaks this relationship.

OP didn't mention that the child's account is a secondary account. AFAIK if you log-in with an account the first time on a fresh(ly reset) chromebook, it becomes the "administrator" account - and at the same time if its in an organization (i.e. the school) the orgs policies are applied. No clue how that interacts if you do attempt to login such account as a second account, it's possible the org can require an account to be in control of the device. Chromebooks are deeply designed for exactly this centrally managed scenario after all, that's (partly) why they are so popular with schools and companies.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#95

Post by nicce »

steffanA wrote: post #75
dragonwriter wrote: post #28

> Does anyone know how to refer these people to law enforcement for prosecution? You can simply look up the phone number for any law enforcement agency you want and call them. None of them are likely to do anything, however; even if there was a crime involved, they have no obligation to pursue anything, and it's almost certainly not something that is on anyone 8nnlaw enforcement’s list of priorities. What you probabl…

Prosecute for what, though? It's very common for school accounts to take over a chromebook until you remove their profile/perform factory reset. This sounds more like a Google issue for allowing this behavior in the first place.

It is not actually specific behavior to Google (while Android in general has the same property). History has seen many cases, even my old Nokia Lumia phone many years ago has similar properties when I logged in the organisational email and that granted them remote wipe and access rights. Also iPhones have ”organizational control”, which can be set by certain configuration profiles, to track users.

Companies have had demand for these kind features and now they are there.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#96

Post by xg15 »

duxup wrote: post #88
trasz wrote: post #80

Earlier quoted context omitted.

“the system installed GoGuardian monitoring software on the Chromebook without notice or permission.”

When I logged in with my son’s school account on chrome OS it had some notifications about who owns the account and so on. I don’t think it is as much a mystery as implied. In the end there’s no getting around that mixing device uses like this doesn’t work. It works less and less as the history of computers goes on.

Can the managed account actually access files from the unmanaged account or control which processes are active while the unmanaged account runs?

Because, if yes, this absolutely does sound like a security hole:

1) Set up an organisation and add a managed account. Set up policies that install a backdoor on first login.

2) Get hold of victim's Chromebook.

3) Log into the Chromebook using the account from (1)

4) Chromebook will execute the policies and run the backdoor.

5) Use the backdoor to snoop victim's files.

You've successfully gained access to the victim's files without knowing their password. Profit!

This would work even if the victim is fully aware of the issue and never intended to mix managed and unmanaged accounts on their own.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#97

Post by mbubb »

duxup wrote: post #92
CodeWriter23 wrote: post #84

Organize other pissed-off parents and persist at school board meetings until they change the policy. You’ll likely be labeled as terrorists for seeking redress with your public officials but stand strong, read up on laws and the board’s bylaws. Let them enter a trap (like ignoring you) where the law/bylaws say you can petition for removal of board member(s) on that cause. You’ll likely have to take it to court. But p…

Considering the range of protections a school is required to provide and that school IT is usually poorly staffed, paid, funded awkwardly… tons of different motivations for various policies. I wouldn’t expect these policies to change. Best bet is to not mix school administrated accounts with personal devices.

“this is my rifle/ this is my gun/ this one’s for fighting/ this one’s for fun”

Re: Tell HN: My kid's school installed spyware and I can't remove it

#98

Post by duxup »

MereInterest wrote: post #90
duxup wrote: post #45

> I did a full factory reset, signed in to his account again, and now the system is once again locked down. That’s by design though isn’t it? You logged in with a managed account and the policy was applied again? The account is his school account right? That’s pretty much how Chrome OS works. This might just be a good lesson that you want to maintain device / role boundaries.

> That’s pretty much how Chrome OS works. And that's the problem. Signing onto a remote account is a request to access a remote resource, and should not be interpreted as granted the remote actor control over local resources. That Chrome OS works this way implies that Chrome OS is fundamentally flawed.

Maybe there should be more of a notice, but when I tried it with my son’s account I got some notifications.

Having said all that the default will be for most school accounts… all or nothing. Don’t allow them to manage it and you won’t get in.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#99

Post by JonChesterfield »

It is early to learn to separate work (school in this case) from home by using separate hardware but it's a good lesson to learn. Get a second laptop, school spyware nonsense goes on one, non-school stuff on the other.

It's annoying and generally a waste of resources so feel free to argue with the school at the same time. Corporate IT won't remove spyware from my work computer, school sounds likely to be similar.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#100

Post by [deleted] »

mperham wrote: post #85
js2 wrote: post #17

It seems like you should be able to sign out of the CPS managed account, then use "Add Person" to add a non-CPS managed account: https://docs.google.com/document/d/1r7xOL4U9lL0qyqMIVl4eH2EM... https://support.google.com/chromebook/answer/1059242?hl=en&r... For school work, login to the CPS-managed account. Otherwise login to the personal account.

I believe the OP is concerned the Chromebook is rooted by the spy software and therefore using another account doesn’t solve that issue.

[deleted]
Post reply on HN