Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#141

Post by [deleted] »

MereInterest wrote: post #132
ac29 wrote: post #108

Earlier quoted context omitted.

Isnt this the same way Windows works? If I sign into a work Windows account and they want to set my default browser or something, thats absolutely something they can do. ChromeOS isnt doing something particularly new in that regard.

On a Windows account, a user can change the default browser for their own account. Therefore, a user can delegate the choice of default browser to the remote management. A user can record which sites their own browser visits. Therefore, a user can delegate that authority, allowing remote management to record which sites that user visits. A user does not have the authority to record which sites are visited by another…

[deleted]

Re: Tell HN: My kid's school installed spyware and I can't remove it

#142

Post by MereInterest »

duxup wrote: post #98
MereInterest wrote: post #90

Earlier quoted context omitted.

> That’s pretty much how Chrome OS works. And that's the problem. Signing onto a remote account is a request to access a remote resource, and should not be interpreted as granted the remote actor control over local resources. That Chrome OS works this way implies that Chrome OS is fundamentally flawed.

Maybe there should be more of a notice, but when I tried it with my son’s account I got some notifications. Having said all that the default will be for most school accounts… all or nothing. Don’t allow them to manage it and you won’t get in.

My issue isn't about the notification, but that this doesn't work at all within any reasonable model of user permissions.

Fundamentally, authority cannot be delegated authority that you yourself don't have. I can agree to a contract promising to do some particular work, because I have the authority to direct my actions. I cannot agree to a contract promising that you will do some particular work, because you haven't granted me that authority. I cannot grant to another what I do not have for myself.

With regards to user permissions, a non-administrator doesn't have permission to monitor another user's activity. Therefore, they cannot delegate permission to a third party to monitor another user's activity. That this is possible means that ChromeOS has a fundamentally flawed model of user permissions.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#143

Post by quadrifoliate »

RcouF1uZ4gsC wrote: post #133
quadrifoliate wrote: post #129

Earlier quoted context omitted.

A few minutes of Googling showed me this upcoming meeting https://www.cpsboe.org/meetings/details/2329 on April 27th, 2022. It seems to be a Chicago Board of Education meeting, and seems to have options for public participation. Do I have this wrong? I'm not from Chicago or Illinois, so that's quite possible.

Quoted post unavailable.

Sorry, but that's fearmongering bullshit that doesn't seem to match reality. Concerned parents often call into school board meetings for all sorts of reasons.

It should go without saying that you should be courteous and reasonable while presenting your concerns.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#145

Post by plussed_reader »

ccleve wrote: post #8
jeffal wrote: post #4

Good lord, just call the CPS IT helpdesk. Problem solved.

Didn't know they existed. Just called them. They said "no, it cannot be removed". They suggested signing in with a different account, but when I do that, I get the error message "This account is not allowed to sign in within this network."

From your description it sounds like when your child signed in with the student account, one of the Ok's they hit for GoGuardian put your device on the schools managed account(cps.edu).

If you're powerwashing and it's automatically pulling cps.edu managed policies as soon as it gets online then the school district IT needs to release your device, and then powerwash it and setup again without the cps.edu policies.

Be aware if you want your child to do any official testing or use their student accounts on your personal device the district may require this arrangement.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#146

Post by londons_explore »

mfreydavis wrote: post #86

I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things. 1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices. 2) You're…

So, it sounds like the best advice to OP is to create another 'home' account for their son, on the same device, which won't be monitored or affected by anything the school does.

The son can decide which account to log into based on what they plan to do that day.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#147

Post by op00to »

quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

Please don't follow this advice. Frothing at the mouth about spyware on your kids computer will immediately be dismissed as insane ravings, and possibly get a visit from your local child safety organization.

I recommend reaching out to your child's teacher, and ask to get connected with the IT team at the school to explain what's going on.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#148

Post by op00to »

awinter-py wrote: post #20

related support ticket from someone trying to log into device w/ work account without inheriting workplace MDM policy https://support.google.com/chromebook/thread/117916330/how-t... > Even if the Chromebook is your private device and your owner account is your private @gmail.com account, once you sign in with a managed account, even using a separate profile, the managed account polices become active. > This is NOT a…

Suing the CPS over this is simply taking money out of everyone else's pocket for your own enrichment.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#149

Post by londons_explore »

MereInterest wrote: post #132
ac29 wrote: post #108

Earlier quoted context omitted.

Isnt this the same way Windows works? If I sign into a work Windows account and they want to set my default browser or something, thats absolutely something they can do. ChromeOS isnt doing something particularly new in that regard.

On a Windows account, a user can change the default browser for their own account. Therefore, a user can delegate the choice of default browser to the remote management. A user can record which sites their own browser visits. Therefore, a user can delegate that authority, allowing remote management to record which sites that user visits. A user does not have the authority to record which sites are visited by another…

Group policies on Windows, applied at logon, give the admin control over what the user can or cannot do. If the admin wants you to use Chrome not Edge, then that is what you'll be using, and you won't be able to change the default.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#150

Post by MereInterest »

michaelmrose wrote: post #125
MereInterest wrote: post #82

Earlier quoted context omitted.

That doesn't really make sense to me. User accounts, whether managed remotely or locally, should be subordinate to administrator accounts. That administrator-level privileges are insufficient to undo a change made with user-level privileges breaks this relationship.

You were never the owner of the chromebook in the first place so Google the actual owner just transferred control to the school. They never needed your permission to do this in the first place because you just paid full fare for an unlimited rental of someone else's property.

That's the conclusion I tend to reach, and I believe Google to have fraudulently described a rental as a purchase. Whoever is the source of authority to run software on a device is the owner of that device. Since enabling remote management does not require administrator privilege, the right to do so doesn't come from the administrator. Since disabling remote management cannot be done by a local administrator, the granted authority is even greater than the nominal authority granted to the buyer. Each of these implies that Google remained the source of authority, and therefore didn't transfer ownership over the device.
Post reply on HN