Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#211

Post by cyral »

MereInterest wrote: post #142
duxup wrote: post #98

Earlier quoted context omitted.

Maybe there should be more of a notice, but when I tried it with my son’s account I got some notifications. Having said all that the default will be for most school accounts… all or nothing. Don’t allow them to manage it and you won’t get in.

My issue isn't about the notification, but that this doesn't work at all within any reasonable model of user permissions. Fundamentally, authority cannot be delegated authority that you yourself don't have. I can agree to a contract promising to do some particular work, because I have the authority to direct my actions. I cannot agree to a contract promising that you will do some particular work, because you haven't…

Windows does this as well, and I would expect other management solutions to as well. You can build your own PC and be local admin on it, but the second you sign in to an active directory account (using a VPN for work) that account will be locked down and can run scripts that the AD owner chooses. I imagine that is what is happening here as well, where the user has signed into the school Google Workspace account (or whatever it's called these days). To avoid this, they could sign in to Google Docs and Google Classroom in a browser. (Although to be fair, Chrome does aggressively ask if you want to sign into Chrome with your account, and probably if you want to sign into the user profile on ChromeOS if I had to guess)

Re: Tell HN: My kid's school installed spyware and I can't remove it

#212

Post by cosine83 »

MereInterest wrote: post #174
detaro wrote: post #94

Earlier quoted context omitted.

OP didn't mention that the child's account is a secondary account. AFAIK if you log-in with an account the first time on a fresh(ly reset) chromebook, it becomes the "administrator" account - and at the same time if its in an organization (i.e. the school) the orgs policies are applied. No clue how that interacts if you do attempt to login such account as a second account, it's possible the org can require an account…

Based on this support thread [0], which was linked to by awinter-py's comment [1] elsewhere in the comments, it doesn't really matter which is first. Remote policies supersede any local controls, and can promote themselves to have Owner privileges. That this is the intended behavior, for any remote management to take precedence over any local management, is a terrifying security hole. [0] https://support.google.com/c…

>That this is the intended behavior, for any remote management to take precedence over any local management, is a terrifying security hole.

You've actually got it backwards. In an enterprise domain like this, allowing local management to take precedence over remote management and policies is a massive security hole for the domain as a whole not to mention required by regulatory bodies dictating information security for educational institutions. A locally managed node is effectively a rogue node on the network. There are use cases for it but they're specialized. OP most likely signed a consent form as part of the online learning stuff at some point and this is the consequence of not reading the things you sign. This whole thing is so massively overblown like no one here has worked anywhere with a BYOD policy and MDM.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#213

Post by briandear »

yeetsfromhellL2 wrote: post #22

As a longtime armchair attorney who has closely read summaries of cases like this on Slashdot for well over the past decade (IANAL, BTW)...you could go the lawyer route but this basically amounts to your kid being a minor in school which means they don't have full legal rights, and the interpretation of 4A is likely up in the air here anyway. Constitutional rights don't necessarily apply at school or anywhere near sc…

But the school doesn’t own the machine, the parent does.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#214

Post by rodw »

Isn't this a pretty typical bring-your-own-device policy?

I.e., if you want to use your personal device to access the organization's private network or resources, they are going to insist on having control over that device, or at least they are allowed to.

Or in this case I assume that CPS "owns" your son's account and probably has a terms-of-service-style document somewhere that makes GoGuardian or similar a condition of using that account.

If you don't want their software then you can't use "their" account on that computer. I don't love that policy, but it sure seems like something they are allowed to do.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#215

Post by williamsmj »

n8cpdx wrote: post #134
quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part: - Following this advice and using a tone that even resembles the tone of the comment…

> Following this advice and using a tone that even resembles the tone of the comment or the original post will make you look/sound crazy. School boards (government boards in general) are used to seeing vocal, crazy people and are good at not taking crazy people seriously.

I agree with the general point of your comment but this is simply not true any more. I’m not sure it was ever true, but recent coverage of school boards and environmental review public consultation throughout the United States demonstrates that it certainly isn’t true in 2022.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#216

Post by sokoloff »

car_analogy wrote: post #207
op00to wrote: post #202

Earlier quoted context omitted.

Speaking out is not something that puts you at risk. Showing unstable behavior by escalating a simple technical support issue into a rant about ‘spyware’ at some board of Ed meeting tends to raise eyebrows though. Asking “Does anyone know how to refer these people to law enforcement for prosecution?” regarding a technical support issue is not respectful or orderly behavior.

Calling unremovable* spyware (the term is accurate, no matter how insane you think it sounds) a "technical support issue" is like calling surveillance cameras installed in your home an "improper furnishing issue". *Edit: sokoloff may be correct, and the spyware is not unremovable. Still, the analogy holds.

Is it unremovable from the device, though? It isn’t clearly defined in the account above whether it was removed (and then reinstalled with the subsequent kid’s login).

Re: Tell HN: My kid's school installed spyware and I can't remove it

#217

Post by cosine83 »

MereInterest wrote: post #132
ac29 wrote: post #108

Earlier quoted context omitted.

Isnt this the same way Windows works? If I sign into a work Windows account and they want to set my default browser or something, thats absolutely something they can do. ChromeOS isnt doing something particularly new in that regard.

On a Windows account, a user can change the default browser for their own account. Therefore, a user can delegate the choice of default browser to the remote management. A user can record which sites their own browser visits. Therefore, a user can delegate that authority, allowing remote management to record which sites that user visits. A user does not have the authority to record which sites are visited by another…

>On a Windows account, a user can change the default browser for their own account.

Not if they lock down that setting via GPO and let the default behavior of remote > local. There's a lot of settings that can't be undone in the GUI and take diving into the registry to undo when set by GPO but then they'll just get re-applied on GP refresh anyways. Talking about who can do what is immaterial to how domains and remote management actually work if they're not designed how you think they should be. The remote admin will always have more control than the local user in this situation, it's been that way for a very long time now and is unlikely to change.

As a normal user, on a Windows box, if you log into say a corporate Microsoft 365 account with your corporate credentials that device may get managed by the domain (pending any admin approvals needed on the management end) in some fashion because by default the local user/MS account user is a local admin and the services and processes that handle all of this run as SYSTEM thus the user has the authority to delegate that authority to remote management at-will.

Like, this is all basic stuff for BYOD and MDM policies if you've worked anywhere with a halfway competent IT staff. OP didn't read the fine print probably. Wouldn't be the first parent to not do so and freak out over nothing.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#218

Post by soraminazuki »

op00to wrote: post #202
serf wrote: post #156

Earlier quoted context omitted.

>Please don't follow this advice. Frothing at the mouth about spyware on your kids computer will immediately be dismissed as insane ravings, and possibly get a visit from your local child safety organization. I don't think parent described 'frothing at the mouth', and furthermore the concept of "I shouldn't speak out otherwise I may paint myself as a target for child protective services" is so subversive and nu-speak…

Speaking out is not something that puts you at risk. Showing unstable behavior by escalating a simple technical support issue into a rant about ‘spyware’ at some board of Ed meeting tends to raise eyebrows though. Asking “Does anyone know how to refer these people to law enforcement for prosecution?” regarding a technical support issue is not respectful or orderly behavior.

From Wikipedia [1]:

> GoGuardian products allow teachers and administrators to view and snapshot students' computer screens, close and open browser tabs, and see running applications. GoGuardian can collect information about any activity when users are logged onto their accounts, including data originating from a student's webcam, microphone, keyboard, and screen, along with historical data such as browsing history. This collection can be performed whether students connect from school-provided or personally-owned devices.

I can only describe this as, well, spyware. No need for scare quotes. The OP has every right to be angry about this.

To describe this as a "simple technical support issue" is some blatant euphemism.

[1]: https://en.wikipedia.org/wiki/GoGuardian

Re: Tell HN: My kid's school installed spyware and I can't remove it

#219

Post by mulmen »

> I bought him a Chromebook for schoolwork, but also for other private things.

Sadly we do not live in a world where this is a reasonable expectation.

School is effectively work. There should be separate hardware for both. If you have more than one kid they shouldn’t share hardware.

Don’t use your work laptop for anything personal. Don’t set up corporate email on your phone. Don’t log in to your personal iCloud on your work laptop.

You bought your son school supplies. Back in my day my parents donated Kleenex boxes and other classroom supplies. This isn’t really any different. The school owns that device now.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#220

Post by alar44 »

londons_explore wrote: post #146
mfreydavis wrote: post #86

I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things. 1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices. 2) You're…

So, it sounds like the best advice to OP is to create another 'home' account for their son, on the same device, which won't be monitored or affected by anything the school does. The son can decide which account to log into based on what they plan to do that day.

No, at this point they probably can't. It's locked down the way it is to specifically prevent that sort of thing.

It should be removed from enrollment, the IT dept doesn't want that on there any more than OP does.

Post reply on HN