Timeline for Why would a school need to install certificates on student laptops?
Current License: CC BY-SA 4.0
27 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 16, 2019 at 19:27 | comment | added | hiburn8 | @MasonWheeler I like and appreciate your full answer to this question, but a certificate, on its own, is not software; and therefore cannot be spyware, despite the obvious parallel that it can give an attacker some level of spying capabilities. I don't mean to be incredibly pedantic, but it infuriates me when the media incorrectly use security terminology, so we have to be very precise about how we use these terms. A root certificate 'facilitates spying', that i don't think anyone can argue with. Upvoted your answer. | |
| Jan 11, 2019 at 16:18 | comment | added | Mason Wheeler | @NathanBasanese Done. | |
| Jan 11, 2019 at 16:00 | comment | added | Mason Wheeler | @user3773048 Because the certificate contains root certificate authority. This means you can issue certificates for other sites and have them be trusted by the computer, and it's possible to do this without the site owner's knowledge or consent. This means that the network operator can decrypt HTTPS traffic coming in, re-encrypt it with their own fraudulent certificates, and forward it on to the client, which has a root certificate saying "there is nothing wrong with this transaction" when it's actually compromised. | |
| Jan 11, 2019 at 9:36 | comment | added | allo |
Of course, they do not need to. But I think actual question seems to be about "Is there a reason to do this despite incepting traffic and other nasty things". And you do not know if there actually is a reason for an own CA or self-signed certificates (e.g. .local) domains. Of course you can discuss if this is a bad way to manage the DNS in your network (it probably is), but this is more a question for serverfault than for security.stackexchange.
|
|
| Jan 11, 2019 at 9:18 | comment | added | Magisch | @allo but the OP asks about "why would a school need to" and your example falls under "they don't need to, they're just too lazy to do security properly" | |
| Jan 11, 2019 at 9:13 | comment | added | allo | @Magisch Of course. But the question here is "why" and not "how can they do better". And this would be a fourth reason with some kind of legitimation, even when they could do better. | |
| Jan 11, 2019 at 8:25 | comment | added | user3773048 | To get this info right (I'm learning myself), it seems that using such a root certificate would only be considered "spyware" when going through the school's servers? So would that only be when inside their network? | |
| Jan 11, 2019 at 7:15 | comment | added | Magisch | @allo That would be just laziness on the school's part then. Getting genuine, signed SSL certificates is free as long as you have the domain. You could argue if it's internal only then it would incur the cost of maintaining the domain, but that's it. | |
| Jan 11, 2019 at 1:41 | comment | added | Nathan Basanese | // , @MasonWheeler, could you be convinced to add that comment as an answer? I consider myself a pretty secure boy, but I only really got this when you pointed it out. | |
| S Jan 11, 2019 at 1:27 | history | suggested | gatorback | CC BY-SA 4.0 |
'takeaway' in bold
|
| Jan 11, 2019 at 0:52 | review | Suggested edits | |||
| S Jan 11, 2019 at 1:27 | |||||
| Jan 10, 2019 at 22:58 | comment | added | Owen | @MasonWheeler I think the legitimate purpose is to monitor what goes on in school, and the resulting lack of security at home is a side effect of that. Maybe it's not a great way to achieve that purpose, but it is a legitimate purpose. | |
| Jan 10, 2019 at 15:34 | comment | added | Mason Wheeler | @ToddWilcox Yes, but we're not talking about in-school computer activity. We're talking about laptops that 1) get taken home and 2) are the property of the student (or, more likely, their parents). There's no legitimate purpose for the school to put spyware on such a machine. | |
| Jan 10, 2019 at 15:04 | comment | added | Todd Wilcox | Note that while seeing a root cert as spyware is reasonable, sometimes "spyware" is required on computers. For example, working on sensitive networks often involves monitoring of all user activities, including encrypted web browsing. Government laptops often have root certs installed so the firewalls can monitor all traffic and look for malware that is connecting outbound using HTTPS. Personally I'd be fine with my kid's in school computer activity being monitored in the same way, to make sure they are not being exploited or bullied, etc. | |
| Jan 10, 2019 at 10:09 | comment | added | allo | Maybe you can add a third kind of certificate to your post: When the school uses an untrusted certificate for their website, e-mail server or similar, they may install the server certificate on the clients, so it is trusted even when no trusted CA has signed it. This is another legitimate use without abuse potential, when it really is a certificate for their own domain name. | |
| Jan 10, 2019 at 8:28 | comment | added | Lie Ryan | @kutschkem: If the app you use supports constraining the certificate, then you can do that. Otherwise, you may want to install the certificate into an alternate browser profile and use that alternate profile only for accessing the school sites. Firefox uses its own certificate store and I believe it's per profile. I believe Chrome and IE/Edge uses the system certificate store, and this is shared with all instances in that profile. Don't know if there's any way to constrain certificate to a specific Chrome/IE/Edge profile. | |
| Jan 10, 2019 at 8:11 | comment | added | kutschkem | What is the alternative to installing though? The CA certificate is probably used to create certificates for internal sites. The alternative seems to be to use the sites without verification that it's the school you are talking to. That sounds also very unsecure. I think @Joshua commentary is useful, name-constraints seems, to me, better then outright not installing a certificate. | |
| Jan 10, 2019 at 0:10 | comment | added | Joshua | @JesseK: In which case they should name-constrain it. See security.stackexchange.com/a/130674/25512 | |
| Jan 9, 2019 at 23:06 | review | Suggested edits | |||
| Jan 10, 2019 at 3:47 | |||||
| Jan 9, 2019 at 21:21 | comment | added | user71659 | Not all trusted certificates need be root CAs. Windows, which relies on certificates for many authentication purposes in a domain, has the concept of "enterprise trust" certificates, which are limited to specific authentication tasks. Another example is WPA2-Enterprise/802.1x certificates, which nearly all operating systems allow you to provision a certificate trusted for network authentication only. | |
| Jan 9, 2019 at 20:45 | comment | added | Jesse K | @mtraceur Oh, I have no doubt the school system shouldn't be in the CA business, but there are lots of mediocre practices that you'll encounter in the world, and this is hardly the worst. | |
| Jan 9, 2019 at 20:22 | comment | added | mtraceur | @JesseK You're absolutely right, but I'd still trust a public CA more than I'd trust a typical school system. A school system isn't at risk of "death" as a "collective organism" if their certificates get hacked the way a public CA is, a school system has the ability to impose a severe incentive gradient to the point of forcing in favor of being trusted while a public CA has no such leverage unless it reaches sufficiently large market saturation, and a school system leaking the master keys is way less likely to get reported or dealt with properly due to institutional factors. | |
| Jan 9, 2019 at 19:43 | comment | added | Jesse K | There are semi-legitimate reasons to have a root certificate authority installed. For example, they may find it useful to use an invalid domain (.local) on their private network, but still wish to support encryption. It comes down to trust, even in the larger PKI context. A valid CA isn't always trustworthy, see DigiNotar. | |
| Jan 9, 2019 at 19:03 | comment | added | Mason Wheeler | I would state that last line a bit more strongly: a root certificate that is under the control of the same people who own the network used to connect to the Internet should be regarded as spyware. It should be avoided if at all possible, and if it's not possible, the machine should be treated as compromised and used as little as possible. There's no legitimate reason to require you to put one on your own personal property. If the school wants to do that, they can supply the laptops themselves. | |
| Jan 9, 2019 at 15:21 | history | edited | Lie Ryan | CC BY-SA 4.0 |
added 256 characters in body; deleted 19 characters in body
|
| Jan 9, 2019 at 15:15 | history | edited | Lie Ryan | CC BY-SA 4.0 |
added 113 characters in body
|
| Jan 9, 2019 at 14:59 | history | answered | Lie Ryan | CC BY-SA 4.0 |