Timeline for My school wants me to download an SSL certificate to connect to WiFi. Can I just avoid doing anything private while on the WiFi?
Current License: CC BY-SA 4.0
35 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 29 at 14:41 | comment | added | Nosajimiki | @ysdx Ah, that makes since. | |
| Aug 29 at 14:35 | comment | added | Hermann | @ChellCPlus It is not "malicious software", but rather "curious stance of safety vs. privacy". In Germany, the details are regulated on state-level. All schools I worked at/with/for are required to employ a filter (see schulrecht-sh.com/texte/i/internetnutzung.htm for example). Whether the filtration happens non-intrusively via IP-Address blocking, DNS blocking, or intrusively via content scanning including the MITM approach illustrated here, is up to the school's admin. The school is also required to educate students and their parents about the implications in regard to privacy. | |
| Aug 29 at 13:50 | comment | added | ysdx | @Nosajimiki, in the case of WebScreen, this is probably used to be able to block specific paths/patterns inside a given website (eg. prevent the kids from searching for the word "porn" on a web search engine). | |
| Aug 29 at 13:33 | comment | added | Nosajimiki | @ysdx You don't need a to make someone install a MITM SSL to block websites. TLS connections include an IP and SNI as unencrypted parts of the handshake which can be used to blacklist and content filter websites at the network level, even over an HTTPS connection. HTTPS prevents the network from reading your stuff, but not from seeing where you are going. It's not that they must process your data if they do this, it's that they have very little reason to do this unless they want to process your data. | |
| Aug 29 at 11:57 | comment | added | ysdx | In this case, the main goal is to block some URLs. I don't know if this falls in the scope of "processing personal data". | |
| Aug 29 at 10:19 | comment | added | ChellCPlus | @ysdx what purpose would software like this have if it doesn't process any information? | |
| Aug 29 at 10:07 | comment | added | ysdx | @ChellCPlus, if not logs are kept, it could probably be argued that there is no processing of the personal data of the child going on. | |
| Aug 29 at 8:51 | comment | added | ChellCPlus | @Nosajimiki I think under GDPR rules it would be illegal without explicit consent from parents. "Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child." | |
| Aug 29 at 7:22 | history | edited | ysdx | CC BY-SA 4.0 |
added 19 characters in body
|
| Aug 29 at 7:15 | history | edited | ysdx | CC BY-SA 4.0 |
added 19 characters in body
|
| Aug 29 at 6:10 | history | edited | ysdx | CC BY-SA 4.0 |
added 39 characters in body
|
| Aug 28 at 17:04 | comment | added | Nosajimiki | A very important detail that this answer is overlooking is that the wifi connection may not belong to the school at all. Do not trust that this came from your school unless your school has provided you with actual documentation explaining this process in your orientation paperwork. | |
| Aug 28 at 16:46 | comment | added | Nosajimiki | @ChellCPlus It depends on where you live. In the United States, some states have specific laws that make collecting PPI on children or students expressly illegal and that prevent schools from denying access to educational materials if their parents refuse to sign away this right... but there are no federal regulations preventing this. Internationally, I don't believe very many countries actually have laws about this. | |
| Aug 28 at 16:20 | comment | added | ysdx | @ChellCPlus, usage of a TLS intercepting (MITM) proxy is widespread in many organizations. The goals are: detect and block "abuse" of the network (watching Netflix, visiting illegal websites, playing video games etc.); detect and block malwares and other attacks; monitor the usage of the network. See for example: jhalderm.com/pub/papers/interception-ndss17.pdf nccoe.nist.gov/sites/default/files/2023-05/… docs.broadcom.com/doc/… | |
| Aug 28 at 16:14 | history | edited | ysdx | CC BY-SA 4.0 |
added 25 characters in body
|
| Aug 28 at 16:02 | comment | added | ChellCPlus | This can't be legal right? Its clearly malicious software | |
| Aug 28 at 14:53 | comment | added | Questor | I like this answer... But you should put school WIFI in quotes... "school" WIFI. As this doesn't sound like its from the school WIFI but rather the "school" WIFI (IE WIFI that looks like it is the schools WIFI but is actually a router that is shouting over the school WIFI to do a MitM attack. | |
| Aug 28 at 13:43 | history | edited | ysdx | CC BY-SA 4.0 |
edited body
|
| Aug 28 at 13:02 | history | edited | ysdx | CC BY-SA 4.0 |
added 125 characters in body
|
| Aug 28 at 12:55 | history | edited | ysdx | CC BY-SA 4.0 |
added 125 characters in body
|
| Aug 28 at 9:14 | history | edited | ysdx | CC BY-SA 4.0 |
added 252 characters in body
|
| S Aug 28 at 7:11 | history | suggested | Toby Speight | CC BY-SA 4.0 |
Spelling and grammar
|
| Aug 28 at 6:47 | comment | added | gerrit | Yet another option: do not use the school WiFi to connect to the internet (OP may still have to use it for the school intranet). | |
| Aug 28 at 3:33 | review | Suggested edits | |||
| S Aug 28 at 7:11 | |||||
| Aug 28 at 1:40 | comment | added | yshavit | Could the cert be both 1 and 2? If so, that seems relevant, because this answer as written seems to suggest that if it's option 2, then (a) it's easy to verify (the computer won't connect to the wifi without it) and (b) that it's safe from MITM. But if a cert can be both, then it could look like 1 while still acting like (and being subject to the same warnings as) 2. | |
| Aug 27 at 21:27 | comment | added | paj28 | The cert name is WebScteenCdrt and WebScreen is a web filtering product | |
| Aug 27 at 20:24 | history | edited | ysdx | CC BY-SA 4.0 |
added 10 characters in body
|
| Aug 27 at 19:54 | history | edited | ysdx | CC BY-SA 4.0 |
added 1 character in body
|
| Aug 27 at 19:53 | comment | added | ysdx | @paj28, thanks I have expanded this answer to include something in the line of only in Firefox". | |
| Aug 27 at 19:35 | history | edited | ysdx | CC BY-SA 4.0 |
added 364 characters in body
|
| Aug 27 at 19:29 | history | edited | ysdx | CC BY-SA 4.0 |
added 364 characters in body
|
| Aug 27 at 19:27 | comment | added | ysdx | @paj28, "we can infer it's almost certainly (1)". If the Wifi uses WPA-EAP aka WPA-Entreprise (which is what you would expect from institutions), it is certainly using some form of tunneled TLS authentication (EAP) method such as EAP-TLS, EAP-TTLS, PEAP, EAP-FAST, TEAP. In this case, you usually need the certificate of the authentication server. | |
| Aug 27 at 15:51 | comment | added | paj28 | Good answer. I think from the name we can infer it's almost certainly (1) as you assume. BTW, I think Chrome certs are system-wide not per-profile so maybe strengthen "e.g. Firefox" to "only in Firefox" | |
| Aug 27 at 15:47 | history | edited | ysdx | CC BY-SA 4.0 |
added 259 characters in body
|
| Aug 27 at 15:42 | history | answered | ysdx | CC BY-SA 4.0 |