Hacker News Reader

Comment by darkwizard42 | Hacker News Reader

After reading the article, I didn't feel like any of these were particularly nefarious intrusions as they largely involved the student knowingly using Brown's services (buildings, wifi, access management system IPs, physical presence on campus). The article was pretty well-written and informative in general on how a number of services we take for granted can be used to locate you.

I do take issue with Brown's extremely harsh language in one of the linked articles where they threatened students with suspension...all for being in the local Providence area?!

View on HN

My criticism is with how likes like these are bolded, almost like it's trying to say "beware! they're logging everything, don't get on the administration's bad side!"

> The C•CURE 9000 lets administrators view the complete historical building access history of a person.

> Combined, these logs paint a very accurate picture of your location on campus at any time.

But I did see the author's comments elsewhere in this thread[0], so there's no ill intent. This is an overall educational article.

0: https://news.ycombinator.com/item?id=25319883

This article was aimed at non-technical members of Brown community, who were very surprised that Brown has any geolocating capacity like this. When they think of security and privacy, they think of the campus's guards and surveillance cameras — not the course materials portal or their email!

A friend does work at a state university for an early intervention program for at risk students in their opportunity program.

If you are buying snacks or sodas at 3am, don’t utilize your card keys over the weekend or do some other things, you’ll get flagged as a risk and your advisor get notified.

If buying snacks at 3am is considered at risk then that's probably 90% of college students at one point or another.

Very true. Some bureaucrat would have been clutching their pearls if they were following my undergrad habits for sure.

I think the point is excess. They are specifically working with students with the iq to succeed, but with bad circumstances that make failure likely. Some need to be taught 9th grade math for example. My understanding is they mentor them intensely and almost 80% graduate in 5 years.

Probably phd students excempted (isnt 3am peak productivity?)

No. That's sleeping time.

If your kids shoot up a school, look in the mirror to find the problem...

And people wonder why people like cash...

Bad conscience because you are neglecting your children? No problem, just use www.socialsentinel.com ...

Sorry if my edit caught you off guard - Thanks for the informative article, even if it is seen as obvious/reasonable for most of the HN crowd!

The students have agreed to follow certain rules related to Covid. Why is it shocking that the university is evaluating whether they are following the rules and doing some enforcement?

To provide a little more context...

Students faced a ternary choice prior to the Fall semester: 1. enroll as an on-campus (and thus live in a dorm), or 2. enroll as a remote student (and thus live at home), or 3. take a leave of absence (and thus live wherever)

Only students in that second bin were subject to the requirement stay out of Providence. A cynical take on this is that Brown has always had strict residency requirements for its students, and residency fees are far above the market rate in Providence. If students could simply mark themselves as "remote" to get out of paying dorm fees, I'm sure many would.

The other key bit of context is just how poor of a job Brown did at geolocating students. Dozens of students (some international!) received baseless notices of reprimand. The most compelling theory I've seen is that these students were using Brown's VPN, and were identified as on campus via IP geolocation.

Thanks for the context! Could you please explain to me as a European what's wrong with a student commuting to the university (if we put COVID aside, of course)? In Europe, university accommodation is usually below the market rate and is hard to get and many students end up subletting a room in a regular apartment.

(Again, this is a rather cynical take, but...)

Brown's monopoly on undergraduate housing is an essential source of revenue. Brown generates twice the $/ft² in revenue as private landlords in the area, but pays only a fraction of their running costs (Brown pays no income tax on this revenue, nor property tax on its dorms). There's nothing wrong with students commuting, per se, but for a University that's come to rely on residency fees, ditching the residency requirement is no easy financial feat.

It's not a US vs. Europe thing. I went to a school in the US where the vast majority of students commute. I think at the time, it was something like 700 people living on-campus vs. 30,000 living off-campus.

Covid is the whole point. They don't want students to sign up for the remote option and then interact with the on campus students.

I have no idea what Brown's policy is but a lot of 4 year universities have requirements that out of town first year students live in the dormitory rather than renting an apartment. It you were already living in town then you are normally exempt. It sounds like Brown is a lot stricter than that though?

Wouldn't it be more reasonable to assume that they're not trying to profit from their real estate side business and are instead legitimately interested in slowing the spread of COVID-19? They probably did some risk analysis and that guided how many on-campus students they could accept. They then accepted that many students. If other students show up on campus after agreeing not to, then their risk assessment is wrong, and the entire program is jeopardized.

The language in the letter triggers my "the lawyers are panicking" detector more than my "you're screwing us out of a few bucks" detector.

> Wouldn't it be more reasonable to assume that they're not trying to profit from their real estate side business and are instead legitimately interested in slowing the spread of COVID-19

No, if this is what they truly cared about, there wouldn’t be 3 different choices for students. All would be required to stay remote with special exemptions for those who don’t have a safe home otherwise.

That's the zero risk approach, but you can have a risk tolerance above zero.

And that tolerance is represented by how loose you make those exemptions.

Whoa there is a Brown VPN service?! I didn't see that mentioned in the article, but certainly could explain some of the issues.

For some more context: you cannot usually read scientific papers without a university IP, hence you need to connect via VPN if even briefly to download PDFs from Elsevier etc. unless you want to go the scihub route.

Many publishers explicitly forbid VPN accesses or proxies. So it is more probably just accessing lecture resources.

Interesting. I've never had any trouble VPNing in for journal articles (in the UK) though there are a few specialised resources (normally expensive databases) which can only be accessed from the library itself.

Mind you, Oxford is sparing as to who gets VPN access, so it doesn't open a hole for non-members of the university to get access to the serial's collection.

I'd be surprised if most universities did not offer a VPN service. I know mine does so that you can access resources only available on the intranet (like course websites) while being off-campus.

I think the fine print about being around Providence is what probably tripped some students up. I am also betting that a few students had their plans change and didn't quite update their registration.

That all being said, I think threatening suspension is a bit too harsh for what is probably a simple mistake for a bunch of 17-22 y/os

"Agreed" is a bit unfair. Transferring schools is a huge ordeal and can mean losing scholarships, credits not transferring, and graduating late. Except for the freshmen who enrolled after those rules were already in place, the rest of the students agreed under duress.

If they simply logged all MACs that passed by their routers, that would be a little concerning given the urban setting. If these people didn't turn off their WiFi autojoin and their devices were actively connecting, then that's on them.

It’s easy to fall into the trap of confusing how the system behaves with what your actually allowed to do.

Legally computers can’t give consent even if it seems like they do so. This is why people can be convicted of hacking for going to public URL’s etc. Presumably, the same rules apply in the reverse where if people are unaware that’s what’s happening then it should be illegal to track them like this.

If anything it’s legally ok because as a student they may have unknowingly agreed to such somewhere.

I'm surprised tracking MACs would be that reliable. Most phones and phone OSes > 2017 have had MAC randomization built in. Retail wifi points used to track MACs in order to profile foot traffic, but this technique hasn't been effective since 2017.

https://blog.elevensoftware.com/how-mac-address-randomizatio...

These are presumably students that have signed into the wifi, not just passerby

Yeah, sounds like if you don't physically access the buildings, don't log onto the campus wifi (which requires authentication to use), and use a VPN (on computer and phone, for 2 factor auth) to access all your online course materials they can't really know where you are... Not too surprising, still good to know!

Is it an intrusion when Google/Android does the same thing when you access their servers?

The difference is you usually don't directly access their servers. You just walk in to a store and your phone grabs your location, sends it to google and then asks if you want to leave a review of the store.

You turned on location services.

I should not have to choose between giving Google a free for all access to my location data or having no location functionality on my device.

This is one of the primary reasons I won't use Android. They always bundle critical features in with privacy violations.

> I should not have to choose between giving Google a free for all access to my location data or having no location functionality on my device.

Location indoors is made possible by sending a list of visible WiFi AP MAC addresses and relative signal strengths to a web service. WiFi MAC addresses are globally unique serial numbers, and Google/Apple maintain huge MAC-to-location databases. Enabling location doesn't just turn on GPS, it sends your location to Apple/Google constantly to retrieve the lat/lon from visible WiFi triangulation.

The only way to keep your mobile location halfway private (your carrier still gets it, and leaks it to your national military) is to keep all location services disabled on the device. Otherwise, simply enabling location access at all gives Google and Apple the aforementioned "free for all access".

I agree that it shouldn't be this way, but it is today.

It used to be much easier for Android users to be able to choose which location service they wanted to use, for example Mozilla’s location service downloaded from F-Droid. However, Google made a change to AOSP that requires third-party location services to now be installed as a system app, not a regular app. (Only a tiny amount of people will have the skills to use the Android shell to move the package to the right place.) It is hard to not see this as a way for Google to lock Android users into using only its service and giving it all their location data.

As sibling comment wrote, the "do you want to review $location?" prompts come from you enabling location history, which is a Maps feature they offer to users who want to keep track where they've been.

You can enable location services (needed for apps like Maps, Lyft, Tinder, Find My Device) without enabling location history. Whether they still record your history, who knows.

If you turn off location history, you shouldn't get the notifications to review stores and the like, IME. I've had location history off but location services on (damn you, uber!) for ages, and I don't get those any more.

They still lock features out if you do. You can't set your home location in google maps unless you allow them to track and store your location 24/7. Meanwhile ios manages perfectly fine keeping that data on your phones local storage.

A company selling a product to a few isn’t an issue, yet one who controls the market is. It’s all about the scale

These students have paid a non-trivial amount of money to attend this school, and passed up the chance to attend others. They are a market that Brown has almost complete control over.

What meaningful choice could a student make to avoid being tracked in the login they use to take classes is what tracks them?

What company? It an issue if Google runs ads against your location history and lets you delete it whenever you request, but not an issue that Flashlight App sells your permanent location history forever to brokers to aggregate and resell to anyone who asks for it?

Reply on news.ycombinator.com