Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#131

Post by js2 »

mperham wrote: post #85
js2 wrote: post #17

It seems like you should be able to sign out of the CPS managed account, then use "Add Person" to add a non-CPS managed account: https://docs.google.com/document/d/1r7xOL4U9lL0qyqMIVl4eH2EM... https://support.google.com/chromebook/answer/1059242?hl=en&r... For school work, login to the CPS-managed account. Otherwise login to the personal account.

I believe the OP is concerned the Chromebook is rooted by the spy software and therefore using another account doesn’t solve that issue.

Since this Chromebook is BYOD, I think OP is likely in scenario 2 described here:

https://news.ycombinator.com/item?id=30912995

Re: Tell HN: My kid's school installed spyware and I can't remove it

#132

Post by MereInterest »

ac29 wrote: post #108
MereInterest wrote: post #90

Earlier quoted context omitted.

> That’s pretty much how Chrome OS works. And that's the problem. Signing onto a remote account is a request to access a remote resource, and should not be interpreted as granted the remote actor control over local resources. That Chrome OS works this way implies that Chrome OS is fundamentally flawed.

Isnt this the same way Windows works? If I sign into a work Windows account and they want to set my default browser or something, thats absolutely something they can do. ChromeOS isnt doing something particularly new in that regard.

On a Windows account, a user can change the default browser for their own account. Therefore, a user can delegate the choice of default browser to the remote management. A user can record which sites their own browser visits. Therefore, a user can delegate that authority, allowing remote management to record which sites that user visits. A user does not have the authority to record which sites are visited by another user. Therefore, they cannot delegate that authority to remote management, because they themselves do not have it.

On ChromeOS, you can filter your own access to websites. You cannot filter other users' access to websites. But signing in to a remote management can filter other users' access to websites. This grants the remote management privileges that the user doesn't actually have.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#133

Post by RcouF1uZ4gsC »

quadrifoliate wrote: post #129
spamizbad wrote: post #124

Earlier quoted context omitted.

CPS does not really have a traditional school board and it’s not elected either (appointed by one of several mayors who ran on an elected school board and then reneged). OP can shout their complaints out over Lake Michigan for the same effect.

A few minutes of Googling showed me this upcoming meeting https://www.cpsboe.org/meetings/details/2329 on April 27th, 2022. It seems to be a Chicago Board of Education meeting, and seems to have options for public participation. Do I have this wrong? I'm not from Chicago or Illinois, so that's quite possible.

No post body was provided.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#134

Post by n8cpdx »

quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this.

Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part:

- Following this advice and using a tone that even resembles the tone of the comment or the original post will make you look/sound crazy. School boards (government boards in general) are used to seeing vocal, crazy people and are good at not taking crazy people seriously.

- “spyware” is not something non-technical understand. Just invoking spyware is going to make people think you’re crazy, not motivate them to fix the problem.

- Normal people do understand things like ownership and consent (approximately, anyway). It might be better to highlight the fact that you own the laptop, your child cannot possibly consent to such monitoring/software being installed, and that you weren’t notified.

- Normal people understand things like subscription costs - why should the school district be paying a third-party service to monitor a device that they don’t manage. By installing management software on your child’s device, are they assuming ownership and _liability_ for how that device is used outside of school?

- The whole chromebook=spyware doesn’t really make sense unless the only comparison is Linux; and if your kid doesn’t understand privacy issues on a chromebook, they definitely won’t have a good time with Linux. The IT department could have just as easily installed similar spyware for Windows or macOS.

Realistically what probably happened here is they have slightly clueless people who installed standard-issue software without thinking to check if the student actually owned the chromebook, because they probably dealt with a hundred other District-issued devices that day. When you run into that kind of bad outcome from human frailty, it is better to treat it as such rather than complain to the board that the sky is falling.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#135

Post by modeless »

To be clear, you can and did remove it. The factory reset worked. You just can't login to the school account using the built-in Chrome browser. But I bet you could by installing a different browser using the Play Store or Crostini/Linux, just like you would on a PC. So try that before suing people.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#137

Post by MatthiasPortzel »

js2 wrote: post #17

It seems like you should be able to sign out of the CPS managed account, then use "Add Person" to add a non-CPS managed account: https://docs.google.com/document/d/1r7xOL4U9lL0qyqMIVl4eH2EM... https://support.google.com/chromebook/answer/1059242?hl=en&r... For school work, login to the CPS-managed account. Otherwise login to the personal account.

This is the perfectly reasonable solution. But OP wants the operating system to be signed into an account managed by the organization without the organization having permission over anything, and since that's not the way ChromeOS works, they're going to sue the school board.

Honestly, I'm disappointed in the HN that they're taking OP at their word and giving legal advice.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#138

Post by MatthiasPortzel »

mperham wrote: post #85
js2 wrote: post #17

It seems like you should be able to sign out of the CPS managed account, then use "Add Person" to add a non-CPS managed account: https://docs.google.com/document/d/1r7xOL4U9lL0qyqMIVl4eH2EM... https://support.google.com/chromebook/answer/1059242?hl=en&r... For school work, login to the CPS-managed account. Otherwise login to the personal account.

I believe the OP is concerned the Chromebook is rooted by the spy software and therefore using another account doesn’t solve that issue.

> I did a full factory reset, signed in to his account again

I read this to mean that the software uninstalled after a factory reset, but signing back into the managed account re-installed it. I'm taking OP with a grain of salt here, but I think it's likely that OP doesn't understand their son's brand new Chromebook and that there's a technical solution that doesn't involve suing anyone.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#139

Post by quadrifoliate »

n8cpdx wrote: post #134
quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part: - Following this advice and using a tone that even resembles the tone of the comment…

I agree one hundred percent with this commenter. They are absolutely right – don't use the tone that I'm using on HN! I did not structure my HN comment from the point of view of how to present it for public comment; and the tone if used verbatim will mark you down as "tinfoil hat crazy person who we should ignore", as the parent correctly points out.

Definitely don't use the term "spyware". Try to assume the persona of a reasonable, slightly conservative, and concerned person who is worried about data privacy why public money is being spent on subscriptions to companies who collect a lot of it, but are not local or accountable. Highlight that you understand that choices are difficult, but that the school needs to do better and be more accountable to parents and students, especially in an age where personal data has become so important.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#140

Post by dragonwriter »

michaelmrose wrote: post #130

You should strongly consider a freedom of information request on what personal data they school has collected on your kid.

Digital sunshine laws (FOIA and state and local equivalents) generally exclude personal data other than certain information about public employees, and definitely records covered under specific privacy regulation like FERPA. You would need to request those records under different laws relating to parent access to private records of students (in this case, the parental right to inspect under FERPA, probably), not sunshine laws.

Quite possible there are whole different request channels for private vs. public records.

Post reply on HN