7 ms·

related support ticket from someone trying to log into device w/ work account without inheriting workplace MDM policy https://support.google.com/chromebook/thr

related support ticket from someone trying to log into device w/ work account without inheriting workplace MDM policy https://support.google.com/chromebook/thread/117916330/how-to-prevent-work-account-from-becoming-adminstator-or-owner-of-chromebook https://support.google.com/chromebook/thread/117916330/how-t... > Even if the Chromebook is your private device and your owner account is your private @gmail.com account, once you sign in with a managed account, even using a separate profile, the managed account polices become active. > This is NOT a bug. It's required to maintain security of the managed environment. Whenever the managed account is active, ChromeOS management and the policies set by your administrators pwn the entire machine. > Google promises bulletproof security to customers who license Chrome OS management, and having any instance of an active non-managed account available when a managed account and its resources are active is a potential security hole. not a chrome-os user -- I imagine you can access the G acct via a browser without signing in the whole OS? if 'signing into gmail signs in the OS', maybe can do it via crostini linux re law: illinois is the state that has the biometric privacy law iirc? you may be able to do a civil suit via that, if the device is sharing face images and you really didn't consent and you can prove it and the law was written with your situation and mind and CPS hasn't indemnified big G. my guess is you'd have to pay a few $k to a lawyer to evaluate the case and then many more $k on the suit, plus you probably have a TOS problem.

fn-mote 5y ago
The ending of that post (trimmed above) is also important: > So you can boot into your personal account and do your personal business and then reboot into your business acount and do your business' business, but never the twain shall meet.
- xg15 5y ago
  Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?
  - MereInterest 5y ago
    From the sound of it (haven't used ChromeOS in ~4 years), "log into" means switching users without powering off the laptop, while "boot into" means to reboot the computer and log in as the other user. For a device that is supposedly built around security, needing to know that the "Switch User" menu shouldn't ever be used to switch the user is something of a footgun.
    - lrem 5y ago
      "Shouldn't ever be used" is an overstatement though. My employer (Google, no less) would apply restrictions, but not hoover logs from the personal profile. Meaning it's still good to have messaging and music there while working.
  - joe_g_young 5y ago
    Chrome has a log in screen like windows and Mac. You can login and out between google accounts like a gmail.com or a k12 account. Similarly but not the same— there is a second “add account” after logged in. This secondary account does allows access email but not override them, bookmarks, etc
  - Morgawr 5y ago
    ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever corp policies get applied to you (like no play store, no linux, etc). If you log into your personal account, you don't get those restrictions (there's a note to be made here for stuff like enrolled devices which I don't think applies to OP and I'm not too familiar with anyway). However, once you are already logged into an account on the device, you can also choose to "sign in with another account". This makes you run two accounts at the same time, you can swap between them without using passwords, etc (it's like switching a virtual desktop/workspace). You can even transfer windows from one account to the other so you can simply alt+tab between them as you would on a single account (for example I am typing this at work on my personal account in a window running inside my corp account). In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. If you log into your corp account with play store disabled, and then log into your personal account as a secondary account, you can't use the play store on it. If you log out everything and re-log with your personal account, you will still be able to use the play store there.
Ancapistani 5y ago
Hmm. I’m not super familiar with ChromeOS’s MDM stuff… but I wonder what would happen if someone were to log in to two separate managed accounts, for two separate organizations, with conflicting requirements?
- awinter-py 5y ago
  don't cross the streams
- riking 5y ago
  It'll block the multi-login and require you to fully sign out of everything, THEN log into the other organization account.
op00to 5y ago
Suing the CPS over this is simply taking money out of everyone else's pocket for your own enrichment.
- Dylan16807 5y ago
  It's to make them stop doing it, not to profit. Right now they're spending money to spy on students, so fighting that is worth it.
- spacemanmatt 5y ago
  Yeah, why anyone gotta make trouble for the guvnah

fn-mote 5y ago

The ending of that post (trimmed above) is also important: > So you can boot into your personal account and do your personal business and then reboot into your business acount and do your business' business, but never the twain shall meet.

xg15 5y ago
Not a chomeOS user, so maybe I'm not familiar with the terminology, but what is the difference between "log into" an account and "boot into" one? Are there different ways how you can add multiple accounts to a Chromebook and the OP just used the wrong one?
- MereInterest 5y ago
  From the sound of it (haven't used ChromeOS in ~4 years), "log into" means switching users without powering off the laptop, while "boot into" means to reboot the computer and log in as the other user. For a device that is supposedly built around security, needing to know that the "Switch User" menu shouldn't ever be used to switch the user is something of a footgun.
  - lrem 5y ago
    "Shouldn't ever be used" is an overstatement though. My employer (Google, no less) would apply restrictions, but not hoover logs from the personal profile. Meaning it's still good to have messaging and music there while working.
- joe_g_young 5y ago
  Chrome has a log in screen like windows and Mac. You can login and out between google accounts like a gmail.com or a k12 account. Similarly but not the same— there is a second “add account” after logged in. This secondary account does allows access email but not override them, bookmarks, etc
- Morgawr 5y ago
  ChromeOS developer here (opinions are my own, etc etc), writing as a user though since I don't work on this specific field myself but I've been using chromebooks daily with multiple accounts (corp and personal) daily for the greater part of a decade. You have a few options on how you log into ChromeOS. Once you boot the device, you can choose which account to sign in as. If it's your corp account, you get whatever corp policies get applied to you (like no play store, no linux, etc). If you log into your personal account, you don't get those restrictions (there's a note to be made here for stuff like enrolled devices which I don't think applies to OP and I'm not too familiar with anyway). However, once you are already logged into an account on the device, you can also choose to "sign in with another account". This makes you run two accounts at the same time, you can swap between them without using passwords, etc (it's like switching a virtual desktop/workspace). You can even transfer windows from one account to the other so you can simply alt+tab between them as you would on a single account (for example I am typing this at work on my personal account in a window running inside my corp account). In this situation, whichever account logged in first is the account that "owns" the session and has policies applied. If you log into your corp account with play store disabled, and then log into your personal account as a secondary account, you can't use the play store on it. If you log out everything and re-log with your personal account, you will still be able to use the play store there.

Ancapistani 5y ago

Hmm. I’m not super familiar with ChromeOS’s MDM stuff… but I wonder what would happen if someone were to log in to two separate managed accounts, for two separate organizations, with conflicting requirements?

awinter-py 5y ago
don't cross the streams
riking 5y ago
It'll block the multi-login and require you to fully sign out of everything, THEN log into the other organization account.

op00to 5y ago

Suing the CPS over this is simply taking money out of everyone else's pocket for your own enrichment.

Dylan16807 5y ago
It's to make them stop doing it, not to profit. Right now they're spending money to spy on students, so fighting that is worth it.
spacemanmatt 5y ago
Yeah, why anyone gotta make trouble for the guvnah