Shock revelation as massive American presidential election hack confirmed A student government election in California has taken a bizarre turn after one of the candidates admitted to hacking fellow students in an effort to fix results. According to local news site Berkeleyside, the unnamed student at Berkeley High School took advantage of weak passwords and default credentials to get into the email …
Seriously though, Google apps for Education takes many of the same loose security and privacy practices and applies them to small children.
Also the account management tools are a joke(Bulk updates? HAH type them in one by one or use an API, not much in between).
Think of the children!
"...unusual voting patterns ...The votes were being cast by students alphabetically, at odd hours, and all at once."
In 1948 (I think), Lyndon Johnson lost his run for the US Senate in Texas by a whisker. A few days later, a box of ballots turned up in a small town. Oddly, all the ballots were for LBJ. And everybody who signed in to vote did so in alphabetical order. And with the same handwriting.
Maybe this kid read Robert Caro's biography of Lyndon Johnson?
While Google for Education does allow for two-factor authentication, the option must be enabled by an administrator, and while most kids these days have smartphones, getting multi-factor set up for an entire school district (Berkeley High School alone has 3,000 students) may not be practical.
The question is can you set up an option to force a password change on first login? If you can there's something wrong at Berkeley Unified School District (apart from the initial too easily-guessable password), and if you can't there's something wrong with Google for Education.
"...Pseudorandom [passwords] aren't hard to generate."
I hadn't even thought about this problem until you mentioned it. But it would make sense to me to assign _random_ passwords, provide them to the students, then do the usual storage of salted, hashed passwords... there are, I'm sure, "best practices" for default passwords.
The system used does let you conveniently tell everybody : "your password is Berkeley_, followed by your student ID." Most people are willing to give up security for a little convenience, and will soon have neither.
<quote>The question is can you set up an option to force a password change on first login? If you can there's something wrong at Berkeley Unified School District</quote>
That just means that mumblehundred students never touched the system at all even though it's mandatory. Working in higher ed IT, I find that entirely plausible.
They may *think* all kids are carrying smartphones around full-time, but I can tell you my daughter isn't one of them. We *do* have a cheap TracFone for her to use for those specific occasions where she may need it, but the rest of the time it stays HOME.
That works well, until the district decrees that the _only_ way to get homework assignments, required reading, and scheduled exams (not to mention the only way to turn in homework) is "The Portal", managed, as with corporate equivalents, to provide maximum annoyance and ridicule for the masses, and endless fun (and kickbacks) for the administration.
Soon, not having your child's every thought sent to a privately run (but government mandated) data center for pre-crime analysis and ad targeting will be deemed child abuse.
The definition is supposed to be people who came of age around 2000, meaning the people in their 20s and 30s now. But people really like having categories that have no reason to exist and are completely arbitrary, hence names of generations that have to cover every year.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
