Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

181–190 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#181

Earlier quoted context omitted.

Quoted post unavailable.

Sorry, but that's fearmongering bullshit that doesn't seem to match reality. Concerned parents often call into school board meetings for all sorts of reasons. It should go without saying that you should be courteous and reasonable while presenting your concerns.

comment is alluding to this incident: https://www.edweek.org/policy-politics/national-school-board...

Re: Tell HN: My kid's school installed spyware and I can't remove it

#182

I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things. 1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices. 2) You're…

This response should be higher instead of the useless armchair lawyering :) With GoGuardian, though, I think device level management is common? It's BYOD but it essentially becomes the district's device (and all the other accounts disabled) until you remove the managed account. It can't happen by accident, though, it tells you very clearly you're making it a managed device. It sucks that schools are using enterprise…

No, it should only be the district's device while the district student's login is being used. There's still very much a legally-enforceable expectation of privacy for the other possible users of the machine.

That the user is the actual owner of the equipment makes it pretty important that someone at the school system defined the MDM policies properly so as not to violate other user's privacy rights. ...but considering the way most of them are staffed, they probably screwed up and need to be shown the right way to do it before they land themselves in court.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#183

Earlier quoted context omitted.

CPS does not really have a traditional school board and it’s not elected either (appointed by one of several mayors who ran on an elected school board and then reneged). OP can shout their complaints out over Lake Michigan for the same effect.

A few minutes of Googling showed me this upcoming meeting https://www.cpsboe.org/meetings/details/2329 on April 27th, 2022. It seems to be a Chicago Board of Education meeting, and seems to have options for public participation. Do I have this wrong? I'm not from Chicago or Illinois, so that's quite possible.

You can indeed attend and raise concerns but it will likely be ignored. Nobody is worried about losing their seat if they ignore constituent complaints.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#184

Earlier quoted context omitted.

Group policies on Windows, applied at logon, give the admin control over what the user can or cannot do. If the admin wants you to use Chrome not Edge, then that is what you'll be using, and you won't be able to change the default.

To my knowledge, that group policy only applies to the user who is logging in, not the other users on the computer.

There doesnt appear to be any claim that this undesired software was being run on any other account besides the managed one.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#185
post #45

> I did a full factory reset, signed in to his account again, and now the system is once again locked down. That’s by design though isn’t it? You logged in with a managed account and the policy was applied again? The account is his school account right? That’s pretty much how Chrome OS works. This might just be a good lesson that you want to maintain device / role boundaries.

> That’s pretty much how Chrome OS works. And that's the problem. Signing onto a remote account is a request to access a remote resource, and should not be interpreted as granted the remote actor control over local resources. That Chrome OS works this way implies that Chrome OS is fundamentally flawed.

Yeah good luck getting a company to give you VPN access to their network without demanding you've been keeping your operating system patched. BYOD without such policies is a great way to make the network support staff quit and maybe slash your tires on the way through the parking lot.

It's called _attestation_ and Windows has been doing it for some time now with VPNs and domain credentials. Attestation actually makes it possible for BYOD to be done in a way that's not going to simply repeatedly expose one's network to every kind of malware known to man.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#186

It is early to learn to separate work (school in this case) from home by using separate hardware but it's a good lesson to learn. Get a second laptop, school spyware nonsense goes on one, non-school stuff on the other. It's annoying and generally a waste of resources so feel free to argue with the school at the same time. Corporate IT won't remove spyware from my work computer, school sounds likely to be similar.

Upvote. My kids use Chromebooks as well, and we were asked to buy them ourselves, but I always assumed they would be heavily locked down and monitored.

We bought very cheap ones and they are only used for school work at school. They take forever to boot up and load google docs, but once there they are fine.

The kids know the teachers can see and read everything and anything that happens on that machine.

I kind of assumed they would be dropped or beaten up, and was expecting to buy a new one every tear, but the eldest is still in perfect condition after 2 years. Quite proud that they are looking after them.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#187

I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things. 1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices. 2) You're…

This response should be higher instead of the useless armchair lawyering :) With GoGuardian, though, I think device level management is common? It's BYOD but it essentially becomes the district's device (and all the other accounts disabled) until you remove the managed account. It can't happen by accident, though, it tells you very clearly you're making it a managed device. It sucks that schools are using enterprise…

I think GoGuardian is normally full device, but on Chromebooks it is installed via extensions. Extensions in on Chromebooks are 'user' policies so they are applied to entire OUs of users. (docs here for anyone who is interested : https://support.google.com/chrome/a/answer/6177431?hl=en#zip...)

These types of solutions are really common for schools because under CIPA you must filter your network to receive e-rate funding. Deploying it to the device meets these requirements and also extends filtering off site which is a commonly requested feature.

If it is just being managed at the user level - then creating a second account is exactly the way to go.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#189
post #152

Earlier quoted context omitted.

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Emphasize stories of previous data breaches involving educational companies [1], This is some bad advice. No need to escalate the situation. Simply contact the sons school and find out who the t…

Oh no, there's no way the school system didn't know they were installing monitoring software. It would be fairly reasonable for them to require that in the context of students logging in to access and use school resources (i.e. lessons) and to keep them from just goofing off. What is not reasonable is the very real possibility that they might have overstepped and made these policies active for all logins on the devic…

I agree. What I should have typed instead of "The school is not intentionally installing spyware." Is they probably did not intend to install the spyware on personal machines of students that logged in with their school Google account. Perhaps there is a management policy misconfigured or the student got confused and enrolled the device.

From my understanding if you setup a personal chromebook you can then login to Google Classroom via the Chrome browser and it should not enroll the chromebook in MDM. At least when I login to my chromebook it does not enroll my device.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#190
post #134

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part: - Following this advice and using a tone that even resembles the tone of the comment…

> “spyware” is not something non-technical understand. Just invoking spyware is going to make people think you’re crazy, not motivate them to fix the problem.

It's also vague. Make sure parents know exactly what data is being gathered, and who gets it. And point out that this is being kept hidden from both children and parents - if the spying is above-board, then why doesn't the device give a big "All your chat messages and internet activity is being monitored by XYZ, even outside school hours" notice at log-in?

Was the existence and extent of this spying communicated in any clear way, by the software or by the school, or buried deep in a click-through agreement?

Post reply on HN