What’s stored in a school Google Drive account?

https://web.archive.org/web/20180919124648/https://missourieducationwatchdog.com/whats-stored-in-your-school-google-drive-account-you-might-be-surprised/

by DyslexicAtheist • 8 years ago

67 45 8 years ago

web.archive.org

jstanley• 8 years ago

I'm just seeing a 500 error.

_bax• 8 years ago

Antivirus blocked page...

fermigier• 8 years ago

https://web.archive.org/web/20180919124648/https://missourie...

(Not sure if there is a legitimate reason this has been taken out)

jwilk• 8 years ago

The original page (https://missourieducationwatchdog.com/whats-stored-in-your-s...) works for me.

jchw5• 8 years ago

I don't understand. What they are describing sounds like Chrome syncing. But you can certainly install Google Drive's sync client without using Chrome/Chrome syncing. Is this a new thing?

judge2020• 8 years ago

They must have signed into Chrome, but Chrome will explicitly tell the user if their data will be accessible to the GSuite administrator[0] so this is likely on them for not fully reading this popup or forgetting about it.

0: https://judge.sh/YILh0ozLX5.png

crispyambulance• 8 years ago

FWIW, that message with the buttons "Link Data" or "Cancel" is very confusing.

It does not address what pressing "link data" will _actually_ do and what pressing "cancel" will _actually_ do.

Notre1• 8 years ago

Being accessible to the G Suite administrator is understandable, but this is saying that anyone with an account on the school's G Suite plan could see the passwords for any other user.

This has to be something where the admins changed some default setting to change the default security on everything in G Suite, so that all other school accounts could have access to it.

Maybe someone intended to set it up so that all google sheets and docs were shared among everyone on the plan, but didn't realize the change they made applied to other things that got synced to G Suite, like Chrome sync passwords?

crottypeter2• 8 years ago

Yes, that is the pop-up and upon reading it, it is pretty clear to me that you want to start a new chrome profile to proceed (or else your home passwords will get sync'd to the controlled account). The trouble is that this is not clear to people who have never signed-in to Chrome.

robertdundon• 8 years ago

Thing is, you shouldn't expect this sort of thing to happen _by default_ Also, kids under 13 have different laws for having data about them in the US, so that's an issue, as well.

jchw5• 8 years ago

I'm pretty sure Google is COPPA compliant and will not let children, without parental consent, sign up for things on their own.

However, GSuite for Education may very well introduce a loophole whereby the onus is put on someone else to get that consent. I'm getting that vibe from this knowledge base article:

https://support.google.com/a/answer/6356509?hl=en

In any case, interesting. This story seems like something Google would be smart to respond to/clarify.

smileysteve• 8 years ago

you shouldn't expect this sort of thing to happen _by default_

When I have chrome; it always asks me if I want to save passwords....

To one extent, this is a hard lesson to the parents; Check the security settings on any computer you are using; Check the "features" of every app you install.

To another end, it's a good lesson for the parents and children that school and work supplies are for school and work.

To yet another end, those passwords, if auto generated, are likely much more secure than other ways of storing passwords.

Bedon292• 8 years ago

I wonder if some of this is cause by not logging out from everything? You can probably log out of gmail, but not the chrome browser and not realize it. And the browser will still record everything. Or the opposite.

I am a bit curious about some of the claims about sync on iPhone. I don't have one, but is it even possible for another app to reach the internals of Safari? I would think that is locked down. Or are they logged into their google account in the browser? As for google getting the voice and text from a messaging app, how would that be possible unless its an actual google app?

RandallBrown• 8 years ago

“My voice to text was being stored as well as any search my kids did, and I could say ‘sure my daughter was searching on Google,’ but my phone uses Safari. When I used my texting app on my iPhone, it recorded my voice, as well as typing out the words and saving it on my Google Drive,” said Brette Hay, the Ely’s daughter and a teacher at Pershing Middle School.

If it's possible to get voice recordings out of the iMessage app from a separate app (shouldn't be possible from an iMessage app either) this would be a major security hole and Apple would be pissed at google for doing it.

This is almost certainly a misunderstanding of what's actually going on.

Lifesnoozer• 8 years ago

The texting app might not be iMessage

Rjevski• 8 years ago

It was most likely WhatsApp, which as far as I know allows backing up to Google Drive.

PascLeRasc• 8 years ago

Could be Hangouts, but I can't imagine the type of baby boomer who's making this claim using it.

londons_explore• 8 years ago

They're probably using the Google Keyboard and it's voice typing feature.

If you enable it, it can keep a history of what you have said tied to your account.

crazygringo• 8 years ago

This suggests their main complaint is about logging into Chrome Sync with the EDU account, where expected behavior would be to store and sync history and passwords. (And if you don't keep separate Chrome profiles, obviously that would include everyone using the computer.)

And then they talk about saving voice recordings and transcriptions from their phone messages... I can only guess they did something like configured WhatsApp to store backups on Drive and forgot they had?

EDU accounts should be treated like work accounts: use them only for EDU- or work-related things. Don't visit your bank's website and save the password to Chrome when logged into syncing to your daughter's school account.

On the other hand, asking students, parents, and faculty to fully understand the Chrome login-and-sync model, and how it differs from website logins, may be asking too much. And it can be hard to tell the difference between Chrome sign-in and Apps sign-in, or to realize that signing out of one won't necessarily sign you out of the other.

edtechstrats• 8 years ago

More context for this story here: https://www.pogowasright.org/back-to-school-revolt-in-spring...

justjash• 8 years ago

Weird since my child is in this school district. They also don't mention much about the fact that every child (as far as I know) has a Chromebook provided, so I doubt this would be a common thing where kids are logging into Google Drive on another PC at home.

beauzero• 8 years ago

A lot of school districts allow the chromebooks to go home with the kids and there are ways to manage DNS filtering and chrome app management for those chromebooks. It is very attractive for cash strapped school districts or for eRate projects (every 5 years). G Suite is used by a lot of schools and a lot of teachers do the G Suite educational certifications as well.

zenexer2• 8 years ago

This sounds like someone who doesn’t have an understanding of how the services they’re using are designed to interact with each other. This is a problem, but it’s not specific to Google: it’s difficult, if not impossible, to ensure that your average user actually understands how these services are meant to work. As the user starts to realize how integrated these services really are, it causes a level of confusion and paranoia; humans fear what they don’t understand. This, in turn, causes them to misunderstand how the services truly integrate; they feel helpless and don’t understand just how much control they have over their own data.

Many of these claims are outright false because they’re technologically infeasible and would require the exploitation of security vulnerabilities. Companies like Google are constantly having their apps inspected by hobbyists and professionals alike; there’s no way that’d go unnoticed for any length of time, plus it’s nearly impossible to begin with.

In short: a parent has just discovered the internet. They’re scared, paranoid, and confused. This is, unfortunately, quite normal.

There are legitimate privacy concerns regarding Google’s collection of data, but none of them are raised in this article. It’s a misunderstanding at best and outright propaganda at worst.

kerng• 8 years ago

Parents complain about auto-sync of passwords, and browser history, past searches and things like that. They would like more control of what's stored/synced by default. It's not as benign as you describe it, especially when it comes to children.

zenexer2• 8 years ago

It doesn't auto-sync without your permission; you have to request that the browser save your password. If you want to save passwords locally without syncing, it's trivial to disable. You can additionally encrypt the passwords with a master password so that Google doesn't have access to them.

Auto-syncing of passwords is a core feature of every modern browser. Safari does it, Firefox does it, Vivaldi does it, Edge does it, Opera does it, and, of course, Chrome does it.

Want control over your child's account? Google has something for that: https://families.google.com/familylink/

Want the school to manage it for you? That's exactly what G Suite is.

Edit: The problem here is ignorance. It's easy to demonstrate that it's possible to control all the data about which this parent is concerned. Sure, there's data they can't easily control, but they make no mention of that. Your interests, demographics, everything else Google infers about you... you can't fully control that, and that's what parents should be worried about--not password syncing.

GlenTheMachine• 8 years ago

The academic Google Drive does some weird stuff. I let my daughter access her school's G-Suite on my work laptop once last year. For weeks afterwards whenever I tried to surf to certain websites I would automatically get redirected to the school's web logon page. Which tells me that at the very least some Google software was tracking my web usage.

I basically had to do a full reinstall of the browser to stop it. It wasn't a case where she didn't log out.

chrismeller• 8 years ago

So it set a cookie that indicated that on Google properties it should redirect you to the right place to log in, not take you to the main Google login?

I mean maybe it's not as clear as it should be, and maybe it should remove that cookie if you log out (ehhh...), and it should probably be easier to get rid of all of that... but we're hardly talking the conspiracy of the decade here.

veritas718• 8 years ago

that was not even google drive, but her myactivity page.. she logged into google when using the app. the stuff is in her account, and she looked at it. and then it was a local fox story.

What’s stored in a school Google Drive account?

Related Stories