Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#281

Post by xg15 »

I tried to google OP's setup (because I was curious), but all resources I found so far were about managing/enrolling an entire Chromebook before use.

However, the situation OP (and others) seems different: They are using a managed account on an unmanaged Chromebook, which already had private accounts set up. So I guess you could talk about a "half-enrolled" Chromebook.

Are there any official Google resources which describe this particular state and how it interacts with the data that is already on the device?

Edit: This post explains more: https://news.ycombinator.com/item?id=30915710

Re: Tell HN: My kid's school installed spyware and I can't remove it

#282

Post by nextlevelwizard »

quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

This just seems so over the top.

Whole point of Chromebooks is that they are minimal devices that can easily be adopted for school work. What I find strange is that OP had to buy their own machine. Anyway even if you somehow convinced the school to change to a Windows based laptops all you'd achieve would be a tier more expensive machines for the kids to use. The school would still require same "spyware" to be installed.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#283

Post by joe_g_young »

xg15 wrote: post #89
fn-mote wrote: post #35

Earlier quoted context omitted.

The ending of that post (trimmed above) is also important: > So you can boot into your personal account and do your personal business and then reboot into your business acount and do your business' business, but never the twain shall meet.

Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?

Chrome has a log in screen like windows and Mac. You can login and out between google accounts like a gmail.com or a k12 account. Similarly but not the same— there is a second “add account” after logged in. This secondary account does allows access email but not override them, bookmarks, etc

Re: Tell HN: My kid's school installed spyware and I can't remove it

#284

Post by ryan_j_naughton »

gernb wrote: post #246
evilDagmar wrote: post #173

Earlier quoted context omitted.

> Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. Nonsense. They were designed to implement required policies when someone logs into a managed domain. Unless you're logging into something like that (where disclosures have been made and consent has been obtained) then there's no "dystopian spyware" involved. Absent any domain man…

Agreed, domain admins can also lock down Windows, iOS, Android, and MacOS. The school is effectively making the computer a terminal into their system. Their system, their rules. I know the OP won't like this answer but the OP should buy their kid another computer for their non-school activities. Of course they could also complain to their school/district to change the polices. Personally, I'm used to it. I have a per…

That corp computer is owned by your employer. If instead you are a consultant who does work for several clients on your own machine, then it would be unreasonable for them to lockdown your personal machine. Instead, if they want you to use a more secure solution, they should provide the computer.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#285

Post by Morgawr »

xg15 wrote: post #89
fn-mote wrote: post #35

Earlier quoted context omitted.

The ending of that post (trimmed above) is also important: > So you can boot into your personal account and do your personal business and then reboot into your business acount and do your business' business, but never the twain shall meet.

Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade.

You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever corp policies get applied to you (like no play store, no linux, etc). If you log into your personal account, you don't get those restrictions (there's a note to be made here for stuff like enrolled devices which I don't think applies to OP and I'm not too familiar with anyway).

However, once you are already logged into an account on the device, you can also choose to "sign in with another account". This makes you run two accounts at the same time, you can swap between them without using passwords, etc (it's like switching a virtual desktop/workspace). You can even transfer windows from one account to the other so you can simply alt+tab between them as you would on a single account (for example I am typing this at work on my personal account in a window running inside my corp account). In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. If you log into your corp account with play store disabled, and then log into your personal account as a secondary account, you can't use the play store on it. If you log out everything and re-log with your personal account, you will still be able to use the play store there.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#286

Post by voakbasda »

ocdtrekkie wrote: post #123
quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

It's also worth noting that Google is almost undoubtably violating childrens privacy laws, and other states are already investigating this... it's very possible what CPS is doing here isn't even legal. There's a lot of reason that the agreements schools are making to bring Google's platform in should be dragged out into the light. Source: https://www.theverge.com/2020/2/20/21145698/google-student-p...

If they activate the microphone and pick up a background conversation, they could be found in violation of state or federal wiretap laws. At least one party must be aware that they are being recorded. I hope everyone involved gets held responsible and prosecuted.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#287

Post by xg15 »

Morgawr wrote: post #285
xg15 wrote: post #89

Earlier quoted context omitted.

Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever co…

Thanks a lot for that info, that clears up a lot! So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot.

Still, if account policies "leak" into unmanaged accounts when both accounts are active at the same time, this sounds like a potential vulnerability: E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account?

Re: Tell HN: My kid's school installed spyware and I can't remove it

#288

Post by Morgawr »

xg15 wrote: post #287
Morgawr wrote: post #285

Earlier quoted context omitted.

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever co…

Thanks a lot for that info, that clears up a lot! So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot. Still, if account policies "leak" into unmanaged accounts when both accounts are active at the same time, this sounds like a potential vulnerability: E.g., if the managed account has a policy that sets proxy settings or force-installs a pa…

> So an unmanaged Chromebook can't be "taken over" by logging into a managed account, the policies are only active until you reboot.

That's my understanding, yes. You can't "infect" an unmanaged account from a managed one, as far as I know at least.

> E.g., if the managed account has a policy that sets proxy settings or force-installs a particular browser extension, would those policies also be applied to the unmanaged account?

I'm not 100% sure if those policies would apply, I admit I'm not familiar with the account enrolment details of ChromeOS since I work at a much lower level. However, from what I know, whenever you go to sign-in to a secondary account in the same session as your primary one, there's a big warning telling you to be careful because you're basically "entrusting" your secondary account to the primary one and to not share an account session with another account you do not trust. This I always assumed was due to reasons like (for example) ending up literally sharing account2 window with account1 session, if you bring a program running in the account2 "domain" (filesystem, etc) into the account1 UI session, the account1 can take a screenshot of it (screenshot will be saved into account1 local files) and that can leak data obviously.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#290

Post by lrem »

MereInterest wrote: post #179
xg15 wrote: post #89

Earlier quoted context omitted.

Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?

From the sound of it (haven't used ChromeOS in ~4 years), "log into" means switching users without powering off the laptop, while "boot into" means to reboot the computer and log in as the other user. For a device that is supposedly built around security, needing to know that the "Switch User" menu shouldn't ever be used to switch the user is something of a footgun.

"Shouldn't ever be used" is an overstatement though. My employer (Google, no less) would apply restrictions, but not hoover logs from the personal profile. Meaning it's still good to have messaging and music there while working.
Post reply on HN