Hacker News Reader

Comment by twiss | Hacker News Reader

I went to a Dutch high school that used Google Accounts for email, and they once caught some students "cheating" on a group project (i.e. collaborating in larger groups than they were meant to collaborate in, I guess) via email. This made me suspect that the admins could read our school email (which people also used to talk about various other stuff, which I guess was unwise). I don't know if that was actually how they found out, but it made me very conscious of email privacy (or lack thereof).

Now I work at ProtonMail, so go figure.

View on HN

Even if it was personal email/social media I've see school computers continually log to disk a low-framerate screen capture of the student's screen. They could also watch it in realtime. My school also had keyloggers installed and while admin insisted that they would not use any captured usernames and passwords they certainly had the capacity to do so.

I think there was some news in the past where some schools took this even further with webcam and mic access, though I didn't experience this.

On a school or work computer that you don't control assume someone is watching behind your shoulder at all times, and reading every word you type. Whether if that's the case or not.

Yeah, that's also terrible. But this was an email account that we could access from our personal computers (they didn't give us a laptop) so at the time I didn't realize that they would be able to read it. IMO, it would have been good if Google had shown some warning or so, that that's the case.

I have worked for a MSP supplying internet services and groupware to institutions, and can tell you that the business and technical requirements for schools are almost indistinguishable from those of prisons.

Robbins v. Lower Merion School District: https://en.m.wikipedia.org/wiki/Robbins_v._Lower_Merion_Scho...

Yep, that's the case I was talking about. I know some students refused to fool around or gossip in front of school computers after that incident in fear that the microphones and cameras might be recording.

Talk about 1984

>> On a school or work computer that you don't control assume someone is watching behind your shoulder...

And also every computer running software you don't own/control. If you really care about privacy you really need to be running Linux on personal machines.

While at university (~2003) I realized that computers in the lab could boot from CD-ROM so I made my own live CD based on a customzied Slackware with a custom OS loader written in C that could boot to GNOME in <1 minute (all preconfigured with apps I used for school), and used that for a few years in the labs. :)

That was a nice middle ground. I could sensibly use my favorite environment even during short 10 minute visits between lectures.

In 1990s at our school it was children who installed keyloggers to get admin passwords. I guess now they have grown up and became school admins.

No one who could do that ended up a school admin.

That wasn’t exactly a rocket science back then. I know at least one person who became a CS professor at university.

Script-kiddies can grow up to do all sorts of jobs! :)

I mean, of course the email admins can read your email? Maybe I have a skewed perspective as an old school sysadmin, but when I managed servers that had mail services running on them obviously root can just read everything on disk and we even had spam filters that scanned the email content which is impossible if we couldn’t read all emails.

An old (school sysasmin) or an (old school) admin?

FWIW in a lot of SaaS companies having read access to production data for regular workflows is absolutely unthinkable. In my opinion the users who expect that their private communication is not read have it right.

Of course it's unthinkable for people working for the provider to have access to production data except in very specific, highly audited situations.

But it's absolutely understandable that an organization has administrators that are able to access data for legal or other compliance reasons, and Google provides those tools as part of the service they provide. There's nothing sketchy about this from Google's side.

The Dutch order is more concerned with whether or not data regarding students is being transferred to the US and processed in ways that it shouldn't be. --Which there's no indication that this is happening, as far as I can tell.

Regarding the last point, there is some indication that that is happening, given that Google's response (from the article) is:

> Google has indicated that it plans to fix the privacy concerns by August 2023

which means that they acknowledge that the current situation is insufficient. If the data was stored and processed only in Europe, they would likely say so. Although even that would not be sufficient, because

> American authorities can access data stored in the European cloud

(by American companies), due to the CLOUD act. So the privacy issues aren't that easy to solve, which might be why they expect it to take >1 year.

They were using Gmail though. Either the school could get privileged access since they presumably used organizational accounts, or they did TLS MITM with network proxies.

OP said "this made me suspect that the admins could read our school email." Administrators can do this.

I do not have links handy but there are DLP solutions for enterprise tools like gmail, google docs, etc... They do not need to MiTM connections are the tool has administrative access to the corporate account. Many companies use these tools to check the box in their audits around data integrity and data exfiltration. This only works for corporate accounts. Most corporate enterprise cloud services have an API for DLP monitoring.

Personal accounts would require a going through a process for lawful intercept. I have no idea how formal this process is today or if Google even ask for a copy of the warrant. When I set up monitoring for cell phone conversations in the cellular industry, not at google I always had a copy of the warrant.

Google workspace administrators can easily access mail via delegation or api: https://sites.google.com/jis.edu.bn/gam-commands/services/gm...

MX gateways are also a valid option.

A long long time ago I remember a sysadmin opened a senior director's email on his computer. He wasn't the type to do something like this, but he recently bought a house, and kids were the likely next step. The senior director in question would likely have been involved in layoff discussions. Unfortunately an email had a read receipt, so the sender got a messaging saying that "sysadmin read your email"... So he got the sack.

That admins can read the emails in their managed accounts is working as intended. School accounts aren't for privacy, period.

Maybe, but it should be disclosed, at least, and students reminded to only use these accounts for school-related stuff, then. And even then, I'm not sure that there should be no privacy in school accounts - what if you want to complain about a teacher? What if that teacher happens to be an admin and retaliates? Sure, there may be cases where having some oversight is good, but it's not necessarily clear-cut.

All the examples you're giving existed before school-provided email accounts. https://xkcd.com/1494/

I'm not disputing how things are, I'm giving my opinion on how things ought to be :)

Almost all schools have a acceptable use waiver the kids (and maybe parents) have to sign to use Internet and it calls out monitoring of internet etc. It's just nobody reads those terms.

This is not what the law says. This why courts absolutely will rule against such practices. And this is why if some person goes to court against that, the snooping admin will get into quite some trouble.

There is a big difference between being able to do something and being allowed to do something.

Of course the right to privacy applies to children as well, and to messaging in school between peers, just like in civilized jurisdictions it's illegal for employers to read read email between employees.

Except schools have a responsibility to ensure that they safeguard their students against online abuse which is extremely common between students. Students will routinely bully each other over school messaging systems so it's important schools have systems in place to deal with this.

This sounds like just an excuse for spying on students. There is plethora of methods to prevent bullying that do not require an all time access to students' communication.

Pervasive monitoring of private communications doesn't sound like the right tradeoff - more like "something must be done, this is something, therefore we must do it"[1].

[1] https://en.wikipedia.org/wiki/Politician%27s_syllogism

Having the technical possibility doesn't mean you have the moral, corporate and legal rights to use that possibility.

Be it emails, databases, file servers, anything reading content from anything else but a test account/db/folder is a no go for a sysadmin/dba unless given explicit consent by the user owning that content.

Please read up on the relevant legislation in NL before displaying your ignorance. Employers don't even have blanket access to their employees' email accounts because of privacy laws. The laws concerning minors are even stricter.

That's up to the account admins, not Google. The NL government is making a big mistake here: it's trying to keep things "local" to EU, and replacing products that are secure and private (while also providing admins with the necessary tools to implement policy) with ones that have far less engineering. \ I also don't think it's necessary to use the word "ignorance", as I read the article pretty carefully. I'm quite read up on GDPR- having implemented policies for a company I worked for- and often times when people say Google is not compliant with GDPR, they're dead wrong.

So if it's not ignorance of the law that's making you make silly statements like "school accounts aren't for privacy, period", what is?

Thankfully in Finland that would be massively illegal. The contents of letters and by extensions by email is so strong that employer or school would need to get specific permission to even try to access the headers.

It's illegal in many places, but happens everywhere. If the tools allow it, even if it's not the intended use for a feature, people will do it in the worst ways eventually.

This applies for school staff managing student emails, startup founders managing cloud apps for staff, and Google employees... in general.

The problem is email is a plain text format end to end, so all those emails are just text files on disk. In various situations admins might end up seeing mail headers and contents even if they don’t want to just by investigating various issues. Acting on that content is a different question though.

If your're on a paid plan it's pretty trivial for superadmins to read your mail. It's logged, but they can.

It's really easy to impersonate any user using domain wide delegation, and subsequent accesses aren't logged.

https://developers.google.com/admin-sdk/directory/v1/guides/...

Yeah, it's not great. We had to add logging into our custom app to get around this. The only thing you'll see in logs when adding a delegate is the OAuth log entry for Gmail, which doesn't tell you a lot.

As far as I can tell, adding a delegate or forward isn't even logged anywhere, and being able to see what a delegate is doing was added as a feature only a few months ago: https://workspaceupdates.googleblog.com/2022/03/gmail-delega...

If this wasn't too long ago you should report the case to the AP since it was likely illegal even before gdpr was a thing. Depending on how the email was offered this could be a major violation of privacy. Even in commercial employer/employee instances you do not have a carte blanche and in cases of students it's even more murky especially if it was done without adult consent.

That's why you use public key cryptography, for example with a Precursor.

Problem with ProtonMail is its JavaScript. If we want to use e-mail with public key cryptography (perhaps we shouldn't), we need to use standards which work in any MUA, and are completely FOSS.

I believe we are better off with a protocol which has a FOSS reference spec, is federated, and from the ground up build with privacy and security in mind.

i am a long time proton paid user but im in the process of moving business to fastmail.

Here is why:

- No autofwd. This is essential for any business Fastmail has this. - No imap/ POP (usecase: integrating with clickup email) - no iOS calendar app - recent pricing changes - pricing on a per domain basis

Ive wanted to support proton and ive paid to so that for a while, but my understanding is that product releases are very slow.

Ive come to believe that protons cadence of releases is not sufficient for a regular business that has to move faster to keep with competition.

I was a big supporter of proton, but starting a business using the proton suite now is a poor and expensive business decision.

i hope this changes in the future.

My criticism is on the business plans. Personal may suffice for most needs. (Email search is a pain, but that is the sword you fall on, given encryption)

Thanks for your work! Happy proton user here.

Google has Vault https://support.google.com/vault/answer/2462365?hl=en

Not sure if/what other admin tools they might have

It’s a good lesson for the real world :/ people in power will read anything you let them.

Europe is making it easy for Microsoft.

Yes but is Microsoft any better from a data privacy/ownership standpoint? They’re an American company too and they have an ad business. How is Microsoft different for Europe?

Outlook servers let admins read user emails ... worse than that, outlook has a built in API for filtering mails and chats that allow automated monitoring of what a user does. (I programmed a tool for it that stored a record for a callcenter company that associated chats with the current call a user was handling. The admins got a log that had a bunch of data on a per-call basis that listed who they chatted and mailed and what was said. They claimed it was necessary for some financial (this was a bank) compliance thing)

You have already a lot of solutions for that https://fortune.com/2021/09/08/germany-sovereign-cloud-googl.... Azure has the same kind of services. If in Germany we could take this decision in a Federal level, you could have your gov sovereign cloud, and stand on the shoulders of giants to be able to accomplish the necessary school digitization at Scale.

Google is making it easy for Microsoft.

IBM made it easy for Microsoft.

Glad IBM didn't lock down their PC platform the way Apple did with theirs. The computing industry would be completely different, and I'm sure not in a good way.

But Microsoft is not making it easy for Microsoft.

Yeah of course, gsuite administrators can access everything, and because gsuite admins are just modern-day instances of bofh-type obnoxious IT guys, there's no way you'll convince them to give up those powers.

I don't know about Google for Education, but the business flavor doesn't let you spy the email of your users, at least I haven't found it. There are ways that allow you to copy every email to an "audit" address, if you're persistent enough, but good luck managing that mess and liability.

There's the option of quarantining emails that have specific keywords. That's the likely way to catch students discussing cheating, attachments and all.

Edit: as the comment below has pointed out, this might not be true. Different editions have different tools, the one i use is not the most complete.

You can view full email content in the investigation tool, use the APIs to download their mail via MBOX and read it there, or if you're feeling bold, just add yourself as a delegate to their inbox.

Probably our edition doesn't include the Security Investigation Tool, I'll have to check if the APIs are available anyway.

Or change their password and remove the mfa token. The instructions for how to do so are in my administration toolkit for account recovery - and they are just as valid for hijack.

It's not as easy as Microsoft, but can be done via their API. Tools like GAM have been made to make this easier: https://sites.google.com/jis.edu.bn/gam-commands/services/gm...

Email routing is also an option, although far more heavy handed.

Reply on news.ycombinator.com