Using Google Slides for Information Screens around the School

[dapaulio]

We do Google slides and Chromebit, once it all setup we don't touch, the staff manage the slide depending on where it is ie cateen, reception, sixth form, staff room and so forth

 

They work really well when sensible do them and they have quick concise messages on, it's when people try to turn them into a full-on presentation they become pointless

 

I have always built xibo installs for anyone who has asked but this requires a bit of a technical understanding even just to update content.

 

I have been looking into google slides where the content is shared with responsible staff to keep updated but...

 

I am a Newbie to google suite, so How do you go about maintaining security to the slideshow.

 

my understanding with google slides shows that if you want to enable auto loop and advance slide for the purpose of eg digital signage you have to publish to the web, effectively making the slide show public. I can see the issues of the slide show must comply with GDPR rules, photographs of children, name are abbreviated etc

 

granted the slide shows url are complicated making it more security by obscurity but surely this would not be enough.

 

am I missing something where google have this covered somewhere that I have not seen

Thanks

Edited December 23, 2019 by dapaulio

[mavhc]

That's not what security through obscurity means.

 

A username and password can be guessed more easily than a 100 random char url.

 

The question is more: will it be indexed by search engines?

[elsiegee40]

Split into own thread

[Arthur]

A username and password can be guessed more easily than a 100 random char url.

Based on the maths here, a public Google Slide document ID has a key space of 480 bits which would take a computer somewhere in the region of 6,578,002,821 quadragintillion years to work out all URLs. For someone to guess the exact slide URL would be unfeasible.

 

Bruteforcing a G Suite super admin password would probably be quicker and then you have access to all documents on the domain.

 

Example URL
https://docs.google.com/presentation/d/e/2PACX-[color="#FF0000"]1vSYdFibaBi83eH_ea-DR9IAlJngMrwoMKTSXyEJx6mey5s7kEM025DhdZLO4rbOjS-6Bf_CMSKMyqt-[/color]/pub?start=false&loop=false&delayms=3000

* 80 characters long
* 64 character alphabet (26 uppercase + 26 lowercase + 10 digits + hyphen + underscore)

[b]Total combinations possible[/b]: 64[sUP]80[/sUP]
[b]Key space[/b]: 480 bits (⇐ 80 * log[sUB]2[/sUB](64))

 

Btw, Google does a similar thing with shared Google Photos...

 

Google Photos and the unguessable URL

 

So why is that public URL more secure than it looks? The short answer is that the URL is working as a password. Photos URLs are typically around 40 characters long, so if you wanted to scan all the possible combinations, you'd have to work through 10^70 different combinations to get the right one, a problem on an astronomical scale. "There are enough combinations that it's considered unguessable," says Aravind Krishnaswamy, an engineering lead on Google Photos. "It's much harder to guess than your password." Because web traffic for Photos is encrypted with SSL TLS, it's also kept secret from anyone on the network who might be listening in.

 

[...]

 

Google also has engineers on the lookout for anyone making scans or otherwise fishy requests from their servers, so if someone did try to scan through the duovigintillions of possible URLs, they would be blocked before getting through a couple million.

 

Being sure that no one will guess the URL at random, Google engineers are free to give significantly more freedom to anyone who has the URL.

 

The question is more: will it be indexed by search engines?

Apparently search engines can only index public Google Docs if they are linked to or embedded on a website. I assume @dapaulio's slideshow will only ever be accessed on school-owned devices and not linked to anywhere publicly (outside of the G Suite domain)?

 

http://www.theregister.co.uk/2009/09/19/google_apps_public_docs_crawling

(https://support.google.com/docs/forum/AAAABuH1jm0Bzoy5sTfmHs/?hl=en&gpf=d/category-topic/docs/sharing/Bzoy5sTfmHs)

 

Note. This article was written a decade ago so things may have changed.

[mavhc]

Interestingly google photo urls change every few hours

[dapaulio]

I think I need to explain and looking to poll your ideas and responses.

 

The school haven’t got a google tenancy. don’t know why to be honest but I’ll broach that topic when I get more time.

 

The school have loads of tv screens dotted around for the sole purpose of digital signage which have one of xibo or PowerPoint running from a most compute stick or chrome cast device etc

 

I want to somewhat automate and consolidate this solution so that ICT pretty much have zero input after the fact with all the content thereafter managed by the staff. It want it to be effectively zero cost so looked into google slides.

 

Google slides looks as though it will work with revolver tabs extension refreshingevery day to update content modified throughout the day.

I will manage all slideshows from one gmail account and share the tv slideshow to the staff member responsible to modify the content.

 

From my finding to effectively deliver this free solution which ticks a box in their eyes has some caveats which I feel they need to understand before I implement the solution across somewhat 30 tv.

 

Once the slideshow is published it becomes public (unless I’m missing something) therefore anyone can view the slideshow if they were to know/guess the long 80 odd character url.

 

The slides I’m concerned may include personal information and photos of children. My concern as little a chance of someone out side the organisation managing to view the slides it is possible and feel they should understand that slight risk. I’m looking for positive ways to spin it without the school clamming up straight away

 

I’m open to suggestions also as I said I’m new to google. I want to explore free solutions where the teachers are capable of managing the content easily before exploring paid for solutions

Hope this makes more sense

TIA

[Steve21]

I mean in reality that’s more a user training issue, no different to how do you stop staff emailing student pictures to parents etc. Either you give access to edit the PowerPoint to people you trust not to put images up that you don’t have permissions etc, or you don’t allow student photos on it at all (Guessing if you have signage in reception you already have this setup right?)

 

No different to the fact you shouldn’t then be setting up children’s photos on a personal (non Edu) slide in the first place really

 

But in terms of ease, any reason you don’t just use PowerPoint? If you already have screens etc setup that can run it, you can easily script a copy (or direct run) of the PowerPoint from a shared drive to local machine, then all staff do is edit the PowerPoint on the shared drive and when the script runs it updates it etc. You’d do the config/kiosk setup in the original PowerPoint layout on the shared drive so not that users need to do anything complicated etc

 

Steve

[mavhc]

Might as well set up GSuite anyway now, just requires registration, could just have 1 user for doing this for the moment.

 

Can Web Office Powerpoint do the same thing if you have O365?

 

Problem with standard ppt is locking for writing/multiple copies

[dhicks]

I want to somewhat automate and consolidate this solution so that ICT pretty much have zero input after the fact with all the content thereafter managed by the staff.

 

This was our requirement, too, and seems to have worked well - we've set up a Google Slides document and granted access to the appropriate admin staff, now information screen content gets updated on a regular basis and I don't think we've had to do anything or change any settings for the last 6 months. About the only way the URL to view the slideshow could get public is if people start emailing it around (because a lot of people are currently used to emailing an Office document to someone for editing, then getting a copy emailed back, etc), so I would suggest not telling / showing anyone at the school the public URL bit, just get them used straight away to sharing documents via Google's "share" facility - much easier to keep tabs on.

[jmak]

Not necessarily the most elegant option, but could you embed other Google docs into the published slide show? You could then make the embedded documents private. If by any chance someone accessed the published slideshow, they'd only see an error message for embedded documents.

 

As a side benefit of that approach, you could give access to each document to different people.