3 ms·

Students are afforded very little privacy. I'm sure you've heard of administration software that lets school staff view and control student's computers remotely

Students are afforded very little privacy. I'm sure you've heard of administration software that lets school staff view and control student's computers remotely. One of my teachers even showed to the class that he was able to view the screen of a student who was absent from class, without the student's knowledge. The software also logs keystrokes (yes, including passwords) and browsing history. If that wasn't bad enough they also enforce custom certs so they can MITM ssl traffic. Many students log into their personal accounts on their school computers without realizing that they've compromised their passwords and sensitive personal information. Schools are also notoriously bad at security. My school force disabled Firefox updates, meaning every browser remained unpatched after multiple CVEs, one of which allowed websites to execute arbitrary code on the host's machine (sandbox escape).

nine_k 6y ago
I think it's good to teach the kids that these devices are not theirs in any way. They should expect no privacy whatsoever while using them. Later they will handle similarly any devices provided by employer. Tell the kids not to use such devices for anything that can raise an eyebrow, let alone raise a concern. Doing leetcode problems? Fine. Browsing Wikipedia? Fair enough. Watching educational videos on YouTube? Proceed with caution. Playing games? A bad idea, stop. Opening your private email / social network account / instant messenger? Please never don't do it again, and change your password just in case. This of course, is hard for kids. For many of them, it's the only real computer they have a chance to put their hands on. Which is, of course, bad. But fixing that is not very expansive: a reasonable used laptop can be had for $200, an RPi + a reasonable monitor, for less than $100. I hope most US families with kids who are genuinely interested in technology can afford it. (Getting the parents interested is a different problem.)
- closeparen 6y ago
  In general we teach children not to do "anything that can raise an eyebrow" because it's wrong. Because the raised eyebrows of the adults who care for them are based in compassion, protection, and legitimate moral authority. And if they find themselves scheming about how to avoid the eyebrows then they are knowingly and intentionally doing something wrong, self-destructive, or both. And that is not the kind of people they are, or want to be. I think many parents would be profoundly uncomfortable spending significant money so that their children can evade supervision and guidance by authorities they are meant to respect. My own parents were pretty liberal, and it would still creep them out.
  - frostburg 6y ago
    Learning that they should actively protect their privacy and that there is no reason to think that school authorities always have their best interest as a priority seems rather important, actually. What you teach otherwise is more like mindless conformity.
- BlackFly 6y ago
  > Later they will handle similarly any devices provided by employer. And actually, it is important that we correct this situation in both directions right at the start. In my opinion, the laptops should be treated more like toilets. Sure, they aren't your property and you should be a bit suspicious about "hygiene" (security, etc, in the case of the laptop), but I absolutely expect to not be spied upon and it should be a crime to spy on usage of a company laptop once they allow it to be brought home. In fact, when an employer expects me to take the laptop home with me I generally reject liability for its physical security I would generally push for access to a secure locker on premises to store it. If I go to a bar after work, I don't want to be concerned with company property, I don't want to carry around anything more than my wallet and phone. There should be consideration for me taking care of the physical security of company property if they are unwilling to provide secure storage in the office. The bare minimum of such consideration would be the understanding that I can use it for (limited) personal use at home. I can make personal exceptions for limited times I have some kind of on call, but my general norm would be to leave company property on company premises. So yeah, if you are going to issue laptops to students that you expect them to assume responsibility for, you should provide some kind of consideration over just the "opportunity" to do school work at home. Leave that for school hours. I do recall some teachers talking about how homework prepares one for the real world when the sad reality is you should be trying to find employers that can provide you with a better work life balance than that. These are my norms at least, and I think they are reasonable. If the company wants to get something (me taking the laptop home) then they need to give something (absolutely forbid involuntary remote full administrative access, that is give me privacy).
sellyme 6y ago
Fortunately all of the security problems you mentioned also make it extremely easy for the students to compromise the machines and install a clean OS. The high school I went to (about 5 years ago) had a laptop program, and every year when laptops were given out to the new students one of the senior students would go around and teach everyone how to wipe them. Administration obviously weren't particularly keen on this, but what are they going to do, suspend the entire school? Confiscate over a thousand laptops every week to re-install their spyware? You just need to get buy-in from enough of the students to make any retaliation implausible. I think this process was a lot easier at the school I attended as it was a very tech-focused institution to begin with, but kids are only getting more and more technologically-minded as time goes on, so getting that buy-in should be doable.
- 63 6y ago
  Convenient security holes are harder when the spyware is built into the OS. The popularity of Chromebooks means most students don't have the option you're describing. You can't disable the analytics without disabling school control over the whole OS and then you lose the school wifi password and your machine is useless anyway. What's worse is in a particular district I used to work for, this was the only device the kids had, hence why the school needed to hand them out in the first place. So suddenly the school and Google see all the personal browsing data of every student. Obviously there's no malicious intent so nothing bad has come of it yet presumably, but it is unsettling.
- closeparen 6y ago
  In general MDM provisions both the spyware and the configurations/client certificates necessary for internal resources. With some effort you might manage to unbundle the two. But just wiping the machine and freeing it from MDM only nets you a normal off-the-shelf machine. You aren't getting at privileged resources with it anymore.
MikeUt 6y ago
> One of my teachers even showed to the class that he was able to view the screen of a student who was absent from class, without the student's knowledge. Isn't the fig leaf of "it's stated in the ToS that the user read and understood" the only reason such software is legal? Once you admit the student has no knowledge of it, how is it different than the RAT stalkerware people go to jail for?

nine_k 6y ago

I think it's good to teach the kids that these devices are not theirs in any way. They should expect no privacy whatsoever while using them. Later they will handle similarly any devices provided by employer. Tell the kids not to use such devices for anything that can raise an eyebrow, let alone raise a concern. Doing leetcode problems? Fine. Browsing Wikipedia? Fair enough. Watching educational videos on YouTube? Proceed with caution. Playing games? A bad idea, stop. Opening your private email / social network account / instant messenger? Please never don't do it again, and change your password just in case. This of course, is hard for kids. For many of them, it's the only real computer they have a chance to put their hands on. Which is, of course, bad. But fixing that is not very expansive: a reasonable used laptop can be had for $200, an RPi + a reasonable monitor, for less than $100. I hope most US families with kids who are genuinely interested in technology can afford it. (Getting the parents interested is a different problem.)

closeparen 6y ago
In general we teach children not to do "anything that can raise an eyebrow" because it's wrong. Because the raised eyebrows of the adults who care for them are based in compassion, protection, and legitimate moral authority. And if they find themselves scheming about how to avoid the eyebrows then they are knowingly and intentionally doing something wrong, self-destructive, or both. And that is not the kind of people they are, or want to be. I think many parents would be profoundly uncomfortable spending significant money so that their children can evade supervision and guidance by authorities they are meant to respect. My own parents were pretty liberal, and it would still creep them out.
- frostburg 6y ago
  Learning that they should actively protect their privacy and that there is no reason to think that school authorities always have their best interest as a priority seems rather important, actually. What you teach otherwise is more like mindless conformity.
BlackFly 6y ago
> Later they will handle similarly any devices provided by employer. And actually, it is important that we correct this situation in both directions right at the start. In my opinion, the laptops should be treated more like toilets. Sure, they aren't your property and you should be a bit suspicious about "hygiene" (security, etc, in the case of the laptop), but I absolutely expect to not be spied upon and it should be a crime to spy on usage of a company laptop once they allow it to be brought home. In fact, when an employer expects me to take the laptop home with me I generally reject liability for its physical security I would generally push for access to a secure locker on premises to store it. If I go to a bar after work, I don't want to be concerned with company property, I don't want to carry around anything more than my wallet and phone. There should be consideration for me taking care of the physical security of company property if they are unwilling to provide secure storage in the office. The bare minimum of such consideration would be the understanding that I can use it for (limited) personal use at home. I can make personal exceptions for limited times I have some kind of on call, but my general norm would be to leave company property on company premises. So yeah, if you are going to issue laptops to students that you expect them to assume responsibility for, you should provide some kind of consideration over just the "opportunity" to do school work at home. Leave that for school hours. I do recall some teachers talking about how homework prepares one for the real world when the sad reality is you should be trying to find employers that can provide you with a better work life balance than that. These are my norms at least, and I think they are reasonable. If the company wants to get something (me taking the laptop home) then they need to give something (absolutely forbid involuntary remote full administrative access, that is give me privacy).

sellyme 6y ago

Fortunately all of the security problems you mentioned also make it extremely easy for the students to compromise the machines and install a clean OS. The high school I went to (about 5 years ago) had a laptop program, and every year when laptops were given out to the new students one of the senior students would go around and teach everyone how to wipe them. Administration obviously weren't particularly keen on this, but what are they going to do, suspend the entire school? Confiscate over a thousand laptops every week to re-install their spyware? You just need to get buy-in from enough of the students to make any retaliation implausible. I think this process was a lot easier at the school I attended as it was a very tech-focused institution to begin with, but kids are only getting more and more technologically-minded as time goes on, so getting that buy-in should be doable.

63 6y ago
Convenient security holes are harder when the spyware is built into the OS. The popularity of Chromebooks means most students don't have the option you're describing. You can't disable the analytics without disabling school control over the whole OS and then you lose the school wifi password and your machine is useless anyway. What's worse is in a particular district I used to work for, this was the only device the kids had, hence why the school needed to hand them out in the first place. So suddenly the school and Google see all the personal browsing data of every student. Obviously there's no malicious intent so nothing bad has come of it yet presumably, but it is unsettling.
closeparen 6y ago
In general MDM provisions both the spyware and the configurations/client certificates necessary for internal resources. With some effort you might manage to unbundle the two. But just wiping the machine and freeing it from MDM only nets you a normal off-the-shelf machine. You aren't getting at privileged resources with it anymore.

MikeUt 6y ago

> One of my teachers even showed to the class that he was able to view the screen of a student who was absent from class, without the student's knowledge. Isn't the fig leaf of "it's stated in the ToS that the user read and understood" the only reason such software is legal? Once you admit the student has no knowledge of it, how is it different than the RAT stalkerware people go to jail for?