Hacker News Reader

Comment by prepend | Hacker News Reader

My schools tried to require school owned apple equipment that both restricted actions (couldn’t message with parents or email) and monitored all activity, even when used from home.

I forced my own equipment and they tried to install and reinstall various spyware throughout the year.

It seems like rather than proposing a basic system of assignments and material and grades, they are trying to treat as a wholly owned ecosystem.

This is also one of the things that frustrates me about “work computers” but at least they have a bit more claim since work computers are tools for work while school should be about learning.

View on HN

Surprising that schools are requiring additional certs to be added a a device for internet access.

This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device.

https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...

It's not really surprising.

Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm).

In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.

There is a fine line between doing this to protect IP and actual privacy abuse - and as we're treading it's important to remember how important context is.

This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections.

There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.

> This is absolutely a best practice in some corporate environments for DLP.

No, it's not, and this attitude is a major cause of resentment among technical employees.

The "DLP" industry, in general, is a solution in search of a cause. If you can't trust your employees, you'll never be able to stop the determined ones.

Of course, that means you can’t use the school’s Wi-Fi since now every site with https won’t let you pass.

Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing without cause.

(Yes, this practice sucks. But it’s the only way for them to implement the legally mandated filtering in a way they can guarantee it is working.)

I'm curious what loophole will remain if/when ESNI/ECH + DNS-over-https starts becoming widespread. I guess they will have to install client-side snooping software.

Or use a VPN.

An Australian state has intentions to do this soon:

https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Inte...

I was the kid in school who told people about rebooting to single-user mode and creating hidden root user accounts :-D

Some people got in trouble for having learned about it and misusing it though >_<

I am the kid in school who tells people about jailbreaking their ipads and overriding dns records :-)