5 ms·

High school changes every student’s password to ‘Ch ngeme ’

21 points by c5karl 3y ago

noodlesUK 3y ago
I filed an GDPR/ICO complaint against my university student's union when I discovered that they were using the same password for all the student society/sports club outlook accounts (which regularly processed things like passports and other personal data). They didn't permit changing the passwords on these accounts, and I assumed they were doing something stupid like keeping the passwords in a spreadsheet somewhere, but I was definitely surprised that they used the same password for all 200+ distinct accounts. Their legal team got involved and eventually they did the reasonable thing of letting each group set the password directly and delegating permissions properly. IT is sometimes shockingly bad about this kind of thing.
NoZebra120vClip 3y ago
I may be nitpicking here, but it seems to me that an audit is where you collect information and examine data, but you don't change anything. An audit may make recommendations for followup, like "reset everyone's password" but I wouldn't say that that action was part of the audit proper. It almost seems like they want to blame audits for messing up the status quo here. Audits are good. Audits uncover bad things and help orgs move towards compliance. Love the audit.
autoexec 3y ago
Schools forcing their students to use Google accounts makes me sick. I don't believe for a moment that Google isn't collecting massive amounts of data about young people and categorizing them by their intellect while taking careful note of their test scores, conversations with friends, and their struggles. Schools should have more respect for our children than to feed them to a machine that exists only to exploit and manipulate them for profit. Schools should also put more resources into IT. I've worked with schools who were desperately trying to secure their networks and prevent things like pornography and P2P file sharing, and the lack of staff and pathetic budgets they had to work with just couldn't compete with the students who had all the time in the world to probe and evade and attack those networks. Generally, the schools had plenty of money, but they didn't want to invest the resources or take money from athletics and overpaid admins. The more schools are forced to farm things out to third parties and vendors the more our kid's data gets handed over without meaningful oversight or accountability
- shaftway 3y ago
  > I don't believe for a moment that Google isn't collecting massive amounts of data about young people and categorizing them by their intellect while taking careful note of their test scores, conversations with friends, and their struggles. Maybe they are. But Google is a big company, and that's a lot of people who have to go along with a conspiracy and not break ranks. The only way for three to keep a secret is if two of them are dead. And at least their ToS claim that they aren't using the information for advertising. That's far better than my kids using some other random service that other kids use where there's zero accountability and they had to lie about their age, which means that they're *definitely* mining my kids' data for advertising and selling it to everyone they can. I've managed a Google Workspace domain and it's pretty turnkey and simple. I agree that there needs to be more resource in school IT, but I'd rather them put the money into staff that knows not to do things like this, rather than into basic tasks like managing the domain.
  - autoexec 3y ago
    From what I've heard Google is extremely protective of the data they collect and the assumptions and conclusions derived from that data. Very few employees could look up everything google knows (or thinks that they know) about me, or even about themselves for that matter. I doubt very many would be able to tell what has been collected on kids. (if any google employee here can provide me with a complete list of what google has inferred about me using all of the data they've collected from me over the last 25 years please reach out!) It's comforting to think that people can't keep secrets, but history is filled with examples of large organizations including governments which have successfully done so for decades. Tuskegee was kept secret for over 40 years! That's a lot longer than the amount of time Google has existed. The truth is that whistleblowers are extremely rare and not a sufficient check against abuse and corruption.
    - shaftway 3y ago
      I was a Google engineer, team lead on the Play Store. I know what data we collected, but I also know controls around accessing it were very strict (rumor is in the early days of GMail an employee was caught accessing his girlfriend's email, so they went full lockdown). There were tables we could access for reporting and analytics that were aggregated heavily for anonymity. Anything that needed deeper metrics required sign offs from a pretty high level. VP if it was unique and sensitive enough. Yeah, other business areas may operate differently, but every area I worked in took this stuff pretty seriously.
Havoc 3y ago
How bizarre. Even someone with a basic understanding of passwords should have caught that nevermind an actual sysadmin

21 points by c5karl 3y ago

I filed an GDPR/ICO complaint against my university student's union when I discovered that they were using the same password for all the student society/sports club outlook accounts (which regularly processed things like passports and other personal data). They didn't permit changing the passwords on these accounts, and I assumed they were doing something stupid like keeping the passwords in a spreadsheet somewhere, but I was definitely surprised that they used the same password for all 200+ distinct accounts. Their legal team got involved and eventually they did the reasonable thing of letting each group set the password directly and delegating permissions properly. IT is sometimes shockingly bad about this kind of thing.

NoZebra120vClip 3y ago

I may be nitpicking here, but it seems to me that an audit is where you collect information and examine data, but you don't change anything. An audit may make recommendations for followup, like "reset everyone's password" but I wouldn't say that that action was part of the audit proper. It almost seems like they want to blame audits for messing up the status quo here. Audits are good. Audits uncover bad things and help orgs move towards compliance. Love the audit.

autoexec 3y ago

Schools forcing their students to use Google accounts makes me sick. I don't believe for a moment that Google isn't collecting massive amounts of data about young people and categorizing them by their intellect while taking careful note of their test scores, conversations with friends, and their struggles. Schools should have more respect for our children than to feed them to a machine that exists only to exploit and manipulate them for profit. Schools should also put more resources into IT. I've worked with schools who were desperately trying to secure their networks and prevent things like pornography and P2P file sharing, and the lack of staff and pathetic budgets they had to work with just couldn't compete with the students who had all the time in the world to probe and evade and attack those networks. Generally, the schools had plenty of money, but they didn't want to invest the resources or take money from athletics and overpaid admins. The more schools are forced to farm things out to third parties and vendors the more our kid's data gets handed over without meaningful oversight or accountability

shaftway 3y ago
> I don't believe for a moment that Google isn't collecting massive amounts of data about young people and categorizing them by their intellect while taking careful note of their test scores, conversations with friends, and their struggles. Maybe they are. But Google is a big company, and that's a lot of people who have to go along with a conspiracy and not break ranks. The only way for three to keep a secret is if two of them are dead. And at least their ToS claim that they aren't using the information for advertising. That's far better than my kids using some other random service that other kids use where there's zero accountability and they had to lie about their age, which means that they're *definitely* mining my kids' data for advertising and selling it to everyone they can. I've managed a Google Workspace domain and it's pretty turnkey and simple. I agree that there needs to be more resource in school IT, but I'd rather them put the money into staff that knows not to do things like this, rather than into basic tasks like managing the domain.
- autoexec 3y ago
  From what I've heard Google is extremely protective of the data they collect and the assumptions and conclusions derived from that data. Very few employees could look up everything google knows (or thinks that they know) about me, or even about themselves for that matter. I doubt very many would be able to tell what has been collected on kids. (if any google employee here can provide me with a complete list of what google has inferred about me using all of the data they've collected from me over the last 25 years please reach out!) It's comforting to think that people can't keep secrets, but history is filled with examples of large organizations including governments which have successfully done so for decades. Tuskegee was kept secret for over 40 years! That's a lot longer than the amount of time Google has existed. The truth is that whistleblowers are extremely rare and not a sufficient check against abuse and corruption.
  - shaftway 3y ago
    I was a Google engineer, team lead on the Play Store. I know what data we collected, but I also know controls around accessing it were very strict (rumor is in the early days of GMail an employee was caught accessing his girlfriend's email, so they went full lockdown). There were tables we could access for reporting and analytics that were aggregated heavily for anonymity. Anything that needed deeper metrics required sign offs from a pretty high level. VP if it was unique and sensitive enough. Yeah, other business areas may operate differently, but every area I worked in took this stuff pretty seriously.

Havoc 3y ago

How bizarre. Even someone with a basic understanding of passwords should have caught that nevermind an actual sysadmin