No post body was provided.
Tell HN: My kid's school installed spyware and I can't remove it
421–430 of 442 posts
Re: Tell HN: My kid's school installed spyware and I can't remove it
#422Earlier quoted context omitted.
No, it should only be the district's device while the district student's login is being used. There's still very much a legally-enforceable expectation of privacy for the other possible users of the machine. That the user is the actual owner of the equipment makes it pretty important that someone at the school system defined the MDM policies properly so as not to violate other user's privacy rights. ...but considerin…
Why is it ever the "district's device?" It's owned by the parent, it's being used at home. What justification does the district have to monitor anything that's happening not at school using equipment that they do not own that does not involve any of their servers?
It isn't the district's device. OP just enrolled it in the School's GSuite organization so, obviously, policies got pushed. They can just... not do that.
If they want to log into apps or whatever on the Chromebook, they do need to do that. At that point the device has to follow policies for accessing the school's services or whatever. They still don't own the device, but they can push policy to it. At any time the device can be removed from the organization, but that has to be done by the organization, I believe.
Of course, you can have multiple accounts on the Chromebook, so they could just have the device enrolled for one user, but have a personal account not enrolled.
It's all pretty straightforward.
Re: Tell HN: My kid's school installed spyware and I can't remove it
#423I work for a school district (not CPS) with about 2000 deployed Chromebooks and you're likely running into one of two things. 1) You somehow 'enrolled' the device into the Chromebook management. This is hard to do by mistake but if you do, essentially puts the device under the control of the school district. It also uses up a license on their end. We only allow particular IT only accounts to enroll devices. 2) You're…
So, it sounds like the best advice to OP is to create another 'home' account for their son, on the same device, which won't be monitored or affected by anything the school does. The son can decide which account to log into based on what they plan to do that day.
> The son can decide which account to log into based on what they plan to do that day.
You can log into multiple accounts at once on a Chromebook. ctrl + alt + `.` lets you switch between workspaces across accounts, and you can right click windows to move them across workspaces. I'm doing this right now so I can post on HN from my personal account while I code for work.
Re: Tell HN: My kid's school installed spyware and I can't remove it
#424You are going to spend a lot of time and money to address this. Better solution is to buy a second Chromebook only for school or personal use snd explain to your kid that their government hates them.
Better yet, ask the school to provide a Chromebook if they want to spy on and control it. The owner should have the ultimate authority on what the device does - so the school should spend money for the power they demand.
My solution is a pragmatic one, yours is a dead-end most likely, the point was to paper over the issue and move on unless OP wants to spend a lot of time and money on lawyers fighting it.
Re: Tell HN: My kid's school installed spyware and I can't remove it
#425Earlier quoted context omitted.
Sounds like CPS is due for some major policy changes. Schools should not be teaching students that this sort of intrusive infringement of their privacy is something to be tolerated.
I'm not sure I agree that this is an infringement of their privacy - or more accurately I think this is a reflection of the fact that there's no reasonable expectation of privacy in a public space (physical or virtual). It is perfectly normal in working circles that your activities on company owned devices or devices connected to a company network are monitored. If the school required everyone to purchase a private d…
> there's no reasonable expectation of privacy in a public space
This is not a public space, it's a privately-owned Chromebook. It is not reasonable that merely accessing the school's (mandatory) web services from a privately owned device will result in monitoring software being installed on that device without so much as seeking consent from the device's owner (which is the parent here, not the student who is logging in).
I blame Google here more than the schools. They're the ones that designed an OS which doesn't treat the device's rightful owner as the ultimate authority on which software gets installed. The school is just taking advantage of that design flaw, which is also wrong but hardly unexpected.
Aside: Can anyone familiar with the CPS system chime in on whether it's actually necessary to sign in to the Chromebook using the CPS login credentials to access these web services? Do they perhaps check for specific extensions? If it just requires a Google login it should be possible to disable the automatic link between the web login and the device/browser login in the browser's settings (under "Sync and Google Services" disable "Allow Chrome Sign-in", or just use Incognito mode).
Re: Tell HN: My kid's school installed spyware and I can't remove it
#426Earlier quoted context omitted.
What law are you referring to? How could a device owned by the student/parent require monitoring while not in school?
Not the device, the student district-managed account that is logging into the device. Districts are bound by law (varying from state to state) at a basic level to filter content and restrict access in the broadest sense, on or off the district network. I've worked in multiple states for various districts they all had similar compliance requirements.
Not true, and also not possible.
If a kid or parent can log in from offsite, it is not technically possible to force all browsers or systems to monitor and restrict activity. I can log in through Firefox (or curl, for that matter) and not have my activity sent to the school.
Also, there is absolutely no legal way the school could force the monitoring of activity from an offsite computer (unless it were school-owned), even if it were technically possible. To secretly and silently install spyware on a parent's computer when the parent logs into the child's account would violate so many laws and constitutional protections I can't even list them.
Re: Tell HN: My kid's school installed spyware and I can't remove it
#427Earlier quoted context omitted.
Agree. We have filtering on our kid's Chromebook, but only when they login as user to their school account. They have their separate account which gives them their own space. Certainly you WANT the school district to do some filtering for the school accounts, right? I mean, I think ours locks it down so tight that students can't get outside emails until they are whitelisted somehow...
> Certainly you WANT the school district to do some filtering for the school accounts, right? a) No. Filtering (if there is any) should be limited to their own network or a school-issued device, not some device the school system doesn't own. b) Filtering only the school accounts is pointless if the student can just switch to a non-school account (or guest account) and access whatever they want there.
Your A) is exactly what is happening. Filtering on school account only.
On B) I agree that kids can and will do anything they want on other accounts including just opening their phone! But what happens on school sponsored email, virtual drives, and applications should be controlled I would think. It opens the school to liability if nothing else.
Re: Tell HN: My kid's school installed spyware and I can't remove it
#428Earlier quoted context omitted.
Since he is basically going to have a Chromebook for the rest of his school career, and likely part of his professional life, why not help him to understand it and set him up to be successful? Even if you have a personal dislike for something, your job is to enable your son to be prepared for his life ahead.
I see what you're getting at but there's really nothing Chrome OS offers that can't be replicated on x86 and M1 machines. If he really wants to use it, I'll just VM Chrome OS, get him a touch screen monitor and call it a day. Chrome OS and iOS for that matter are garbage through and through by design, not by nature and I'll never stop preaching that... basically, if I took your stance, I'd be putting my son at a huge…
This is like people who think they are vegan so their pets should be too.
At no point in the future is your kid going to say "wow dad thanks for teaching me how to stand up to the corporate overlords and opening my eyes to what shit iOS is!" Instead the conversation is going to be "Dad can you loan me money for rent this month? I replaced the proprietary freedom hating operating system on the cash register with an open source alternative and corporate had to fly someone out to fix it so they fired me."
Re: Tell HN: My kid's school installed spyware and I can't remove it
#429Earlier quoted context omitted.
Agree. We have filtering on our kid's Chromebook, but only when they login as user to their school account. They have their separate account which gives them their own space. Certainly you WANT the school district to do some filtering for the school accounts, right? I mean, I think ours locks it down so tight that students can't get outside emails until they are whitelisted somehow...
> Certainly you WANT the school district to do some filtering for the school accounts, right? a) No. Filtering (if there is any) should be limited to their own network or a school-issued device, not some device the school system doesn't own. b) Filtering only the school accounts is pointless if the student can just switch to a non-school account (or guest account) and access whatever they want there.
> Filtering only the school accounts is pointless if the student can just switch to a non-school account (or guest account) and access whatever they want there.
From the district's perspective this does have a point: it removes perceived or actual liability for things that the student could be exposed to or experience using their managed services. Being able to tell an offended parent "not our account, not our device, not our problem" versus having to answer for "but he was logged into his district managed Google account, shouldn't you have protected him?"
Re: Tell HN: My kid's school installed spyware and I can't remove it
#430Earlier quoted context omitted.
From your description it sounds like when your child signed in with the student account, one of the Ok's they hit for GoGuardian put your device on the schools managed account(cps.edu). If you're powerwashing and it's automatically pulling cps.edu managed policies as soon as it gets online then the school district IT needs to release your device, and then powerwash it and setup again without the cps.edu policies. Be…
Sorry, are you saying it's impossible to completely wipe/factory-reset a chromebook that's been adopted by an MDM?
It is non-trivial to release hardware where the serial number is showing as mated to a managed domain.
If you're power washing and as soon as it connects online it gets cps.edu remote policies you're gonna need district IT to release the serial from management.