Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: My kid's school installed spyware and I can't remove it

news.ycombinator.com

Post reply on HN
Print view View original

401–410 of 442 posts

Re: Tell HN: My kid's school installed spyware and I can't remove it

#401

Post by nybble41 »

cosine83 wrote: post #217
MereInterest wrote: post #132

Earlier quoted context omitted.

On a Windows account, a user can change the default browser for their own account. Therefore, a user can delegate the choice of default browser to the remote management. A user can record which sites their own browser visits. Therefore, a user can delegate that authority, allowing remote management to record which sites that user visits. A user does not have the authority to record which sites are visited by another…

>On a Windows account, a user can change the default browser for their own account. Not if they lock down that setting via GPO and let the default behavior of remote > local. There's a lot of settings that can't be undone in the GUI and take diving into the registry to undo when set by GPO but then they'll just get re-applied on GP refresh anyways. Talking about who can do what is immaterial to how domains and remote…

> As a normal user, on a Windows box, if you log into say a corporate Microsoft 365 account with your corporate credentials that device may get managed by the domain (pending any admin approvals needed on the management end) in some fashion because by default the local user/MS account user is a local admin…

The parent owns the device and would have the local admin account. They aren't joining the device to a managed domain where something like GPO would be relevant (unless configured by the parent, naturally). The student would only have a non-admin local account, and would be incapable of granting device administration privileges to the school. The school could still manage their browser profile, of course—if the browser itself is actually signed in to the school account, which is something you can disable while still logging in to the account on the web—but they would have no access to or control over other user accounts or anything else requiring local admin privileges.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#402

Post by nybble41 »

Morgawr wrote: post #285
xg15 wrote: post #89

Earlier quoted context omitted.

Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever co…

> In this situation, whichever account logged in first is the account that "owns" the session and has policies applied.

So if you log in to your personal account first, and then into the corporate account, the corporate policies are not applied to either account? There are probably a bunch of corporate types who will be very surprised to learn this…

Re: Tell HN: My kid's school installed spyware and I can't remove it

#403

Post by nybble41 »

d1sxeyes wrote: post #312

Don't use the CPS provided account. CPS policy is quite clear: https://policy.cps.edu/download.aspx?ID=203 > I. Applicability. > This policy applies to all students who use CPS Computer Resources and/or access the CPS Network (“Students”). Personal electronic devices (e.g. personal laptop) are subject to this policy when such devices are connected to the CPS Network or Computer Resources. > IV. Privacy and Monitoring…

Sounds like CPS is due for some major policy changes. Schools should not be teaching students that this sort of intrusive infringement of their privacy is something to be tolerated.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#404

Post by BizarroLand »

n8cpdx wrote: post #134
quadrifoliate wrote: post #116

> I bought him a Chromebook for schoolwork, but also for other private things. When we logged in... This is why you need to pay attention to the technology choices that you make, and that your schools make. Chromebooks are designed from the ground up to be locked-down dystopian spyware once you "log in" to them with a specific Google account. For heaven's sake stop buying any more Chromebooks. The correct solution he…

> Call into the school's board meeting during public comment, and make it loud and clear that the school is installing spyware on students' Chromebooks. Share your technical credentials and the method by which you found this. Just some comments on the political aspect of this, since the HN crowd tends to not be so good at that part: - Following this advice and using a tone that even resembles the tone of the comment…

I've worked in IT support and had issues with parents who let their children use their work computers for school having the chrome browser locked down by the school.

The only fix that worked was exporting the logins and passwords, deleting them from Chrome, and then reinstalling chrome with a different login. I don't want my coworkers work data in the hands of their children's schools' IT dept, and I've let them know that this can count as a data breach (fortunately, so far none of them have been privy to any important data).

Suffice it to say, don't let your kids use your work laptops, and don't log into your child's school accounts on your work computer.

This should be really obvious but apparently it is not.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#405

Post by wanderer_ »

wanderer_ wrote: post #353
trevcanhuman wrote: post #115

Earlier quoted context omitted.

i don't think you can. I had one of these chromebooks too, which I paid for. But my school did not want to remove the 'school policy' so now it's locked and even other accounts are 'watched' and managed by the school's policy. Last time I tried to create an account it wouldn't let you create it unless you provided an email.

Ah. This makes sense. In this case, I think a throwaway or a personal account will perform the same function, as long as it is not affiliated with the school system.

(By "makes sense" I do not, in fact, really mean that it makes sense; more accurately, this should read "seems typical of a Chromebook").

Re: Tell HN: My kid's school installed spyware and I can't remove it

#406

Post by Morgawr »

nybble41 wrote: post #402
Morgawr wrote: post #285

Earlier quoted context omitted.

ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever co…

> In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. So if you log in to your personal account first, and then into the corporate account, the corporate policies are not applied to either account? There are probably a bunch of corporate types who will be very surprised to learn this…

I admit I've never tried this so I don't know which policies do or do not apply and how. For things like the play store (which is what I've worked on in the past), only the "primary" account (the one you logged into first) will have access to it so if your secondary account has the play store blocked anyway, you won't be able to use it with that account so it doesn't matter much.

I don't know about other policies.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#407

Post by op00to »

kuschku wrote: post #349
cosine83 wrote: post #212

Earlier quoted context omitted.

>That this is the intended behavior, for any remote management to take precedence over any local management, is a terrifying security hole. You've actually got it backwards. In an enterprise domain like this, allowing local management to take precedence over remote management and policies is a massive security hole for the domain as a whole not to mention required by regulatory bodies dictating information security f…

The device belongs to the owner and the owner should be able to override anything . If an organization wants to set policies that can’t be overridden, it should pay for the devices. (And even then, the user still has a right to privacy and a certain level of control). If they set a MDM policy on a device I own, I’ll mail the organization the device and a bill for buying a new one that very same day.

So you’re out both the device AND a stamp?

Re: Tell HN: My kid's school installed spyware and I can't remove it

#408

Post by op00to »

MereInterest wrote: post #150
michaelmrose wrote: post #125

Earlier quoted context omitted.

You were never the owner of the chromebook in the first place so Google the actual owner just transferred control to the school. They never needed your permission to do this in the first place because you just paid full fare for an unlimited rental of someone else's property.

That's the conclusion I tend to reach, and I believe Google to have fraudulently described a rental as a purchase. Whoever is the source of authority to run software on a device is the owner of that device. Since enabling remote management does not require administrator privilege, the right to do so doesn't come from the administrator. Since disabling remote management cannot be done by a local administrator, the gra…

> Whoever is the source of authority to run software on a device is the owner of that device

Hundreds of years of established case law refutes this claim.

Re: Tell HN: My kid's school installed spyware and I can't remove it

#409

Post by op00to »

0des wrote: post #294
yeetsfromhellL2 wrote: post #46

Earlier quoted context omitted.

pwning the laptop was a req for doing school work, like how you essentially give prior consent to a field sobriety test when you get a drivers license. I'm not saying it's right, but that likely the school district's argument in court, and I'm sure it's buried deep in a EULA or privacy policy somewhere.

> you essentially give prior consent to a field sobriety test when you get a drivers license If USA, this is false.

You are misinformed. In the USA, every state has a law stating licensed drivers give their implied consent to roadside DUI testing. Failure to comply will result in extra charges and almost certain conviction.
Post reply on HN