Schools ban Zoom

[win]

Now Google has banned zoom! Sounds like the CEO sold his shares just in time

 

Last week, Google sent an email to employees whose work laptops had the Zoom app installed that cited its “security vulnerabilities” and warned that the videoconferencing software on employee laptops would stop working starting this week.

 

https://www.buzzfeednews.com/article/pranavdixit/google-bans-zoom

[MartinT]

I cannot see how a school can fulfil its legal duties and allow full interactive video chats between staff and children.

 

You write a Remote Teaching policy and make sure that all parents read it and sign up to it. They must provide a quiet environment, not in a bedroom, and no other family member may be in the same room. They must be fully dressed. Backgrounds should preferably have the blur option enabled. Almost all our parents have signed it.

 

Our experience so far is that one-on-one lessons and small classes work best. Larger classes are better with broadcast and no interactivity. We use Teams only and I insisted that a couple of SLT members stopped using Zoom. So far, so good.

[Roberto]

They must provide a quiet environment, not in a bedroom, and no other family member may be in the same room. They must be fully dressed. Backgrounds should preferably have the blur option enabled. Almost all our parents have signed it.

 

Almost all your parents must be minted then because you’re effectively saying that the pupil must have their own Study in their home.

 

Can’t be a bedroom.. check. Bathrooms are obviously inappropriate too.

No family member in room and must be quiet... so not the living room or kitchen as they are shared spaces.

Not everyone has a dining room these days but I suppose that might work... Hope they don’t have more than one child!

[elsiegee40]

The quiet room for study is a dream for many. Maybe there’s a kitchen table to work at. Maybe there’s an ironing board in front of the sofa. The bedroom is shared with siblings who also have study to do. A study or dining room simply doesn’t feature in many properties.

 

Quiet may be achievable for short periods, but it may not too especially if there are much younger children around.

 

Schools must accept this is reality for possibly half their students (or more)... and quite possibly the majority of their staff too.

[Roberto]

The quiet room for study is a dream for many. Maybe there’s a kitchen table to work at. Maybe there’s an ironing board in front of the sofa. The bedroom is shared with siblings who also have study to do. A study or dining room simply doesn’t feature in many properties.

 

Yep. I’m.. well not sure if fortunate is quite the right word because we’ve worked hard... able to live in a large house now, and my partner and I each have a room - her craft room, and my study. If we had school kids with us we *still* wouldn’t be able to accommodate the requirements for kids above, as we’re both WFH in our respective rooms and the rest of the house is bedrooms or shared areas.

[MartinT]

I agree that a quiet room is a big ask, and the reality is that some teachers have reported disruption in their lessons from younger siblings drifting in and out of view.

 

Minted? Yes, most of them are. Another reality of independent schools.

[Steve21]

Another example regarding Zoom (again in all fairness a combination of open settings etc), but just an example regarding why people are concerned

 

Coronavirus: Teachers in Singapore stop using Zoom after 'lewd' incidents

https://www.bbc.co.uk/news/world-asia-52240251

 

I know they said they were adding options for locking things, anyone using it found those new options yet?

 

Steve

[Ditto]

Another example regarding Zoom (again in all fairness a combination of open settings etc), but just an example regarding why people are concerned

 

Coronavirus: Teachers in Singapore stop using Zoom after 'lewd' incidents

https://www.bbc.co.uk/news/world-asia-52240251

 

I know they said they were adding options for locking things, anyone using it found those new options yet?

 

Steve

Just a minute ago, I read the same article. My sons' schools (one primary and one secondary) have not used any video conferencing to date. I'm convinced an interactive session is rarely needed - perversely a telephone has become an under-utilised technology. For group sessions, pre-recorded videos and group chats work extremely well. That aside, this sort of media coverage is going to catch up with Zoom, and could do so at significant speed. They need to get their house in order mighty quick, but if the product design is flawed fundamental, retro-fixing is usually a much tougher task.

[Edu-IT]

Sorry my post above sound rude or nonconstructive.

 

Yes I work in education and I fully understand many posts here are taking this with the safeguarding principles in mind, which I also concur with.

 

For my school, Microsoft Teams is not really usable for many of our kids here without a VPN. When teachers need to use Zoom, we require them and kids to stay audio-only as much as possible, and record when turning on camera is needed. Also educate them about the 'controls' that Zoom provides to minimize risks.

 

Again if anyone find my above post offensive I apologize, I just meant to provide a different perspective here.

Why does Teams need a VPN?

[Roberto]

Why does Teams need a VPN?

 

I missed that. It doesn’t. Might need protection with things like MFA and DLP but that’s another story.

[Boredguy]

I read it as they had to use a VPN to access Teams as otherwise it was not accessible locally, rather than as a security feature, based on the posters location.

[computer_expert]

Why does Teams need a VPN?

 

The great firewall of China blocks it (or at least most of it). I know of a few other schools that have the same problem with students located within China. It's not available on the on the Chinese office 365 instances operated by 21vianet either

[Arthur]

Now playing Devil's Advocate to myself, how many of us have properly risk assessed out Office 365 or G Suite option?

Google has a blog post about the security of Google Meet. This was posted a few days ago.

 

Secure connections: How Google Meet keeps your video conferences protected

 

Proactive protections to combat abuse and block hijacking attempts

Google Meet employs an array of counter-abuse protections to keep your meetings safe. These include anti-hijacking measures for both web meetings and dial-ins.

 

Google Meet makes it difficult to programatically brute force meeting IDs (this is when a malicious individual attempts to guess the ID of a meeting and make an unauthorized attempt to join it) by using codes that are 10 characters long, with 25 characters in the set. We limit the ability of external participants to join a meeting more than 15 minutes in advance, reducing the window in which a brute force attack can even be attempted. External participants cannot join meetings unless they’re on the calendar invite or have been invited by in-domain participants. Otherwise, they must request to join the meeting, and their request must be accepted by a member of the host organization.

 

In addition, we're rolling out several features to help schools keep meetings safe and improve the remote learning experiences for teachers and students, including:

 

• Only meeting creators and calendar owners can mute or remove other participants. This ensures that instructors can't be removed or muted by student participants.
  
• Only meeting creators and calendar owners can approve requests to join made by external participants. This means that students can’t allow external participants to join via video, and that external participants can’t join before the instructor.
  
• Meeting participants can’t rejoin nicknamed meetings once the final participant has left. This means if the instructor is the last person to leave a nicknamed meeting, students can’t join later without the instructor present.
  

Secure deployment and access controls for admins and end-users

To limit the attack surface and eliminate the need to push out frequent security patches, Google Meet works entirely in your browser. This means we do not require or ask for any plugins or software to be installed if you use Chrome, Firefox, Safari, or Microsoft Edge. On mobile, we recommend that you install the Google Meet app.

 

To help ensure that only authorized users administer and access Meet services, we support multiple 2-Step Verification options for accounts that are secure and convenient. These include hardware and phone-based security keys and Google prompt. Additionally, Google Meet users can enroll their account in our Advanced Protection Program (APP), which provides our strongest protections available against phishing and account hijacking and is specifically designed for the highest-risk accounts.

 

For G Suite Enterprise and G Suite for Education customers, we offer Access Transparency, which logs any Google access to Google Meet recordings stored in Drive, along with the reason for the access (support team actions that you might have requested, for example). Customers can also use data regions functionality to store select/covered data of Google Meet recordings in specific regions (i.e. US or Europe).

 

Secure, compliant, and reliable meeting infrastructure

In Google Meet, all data is encrypted in transit by default between the client and Google for video meetings on a web browser, on the Android and iOS apps, and in meeting rooms with Google meeting room hardware. Meet adheres to IETF security standards for Datagram Transport Layer Security (DTLS) and Secure Real-time Transport Protocol (SRTP). For every person and for every meeting, Meet generates a unique encryption key, which only lives as long as the meeting, is never stored to disk, and is transmitted in an encrypted and secured RPC (remote procedure call) during the meeting setup.

 

Security is an integral part of all our operations at Google. Our team of full-time security and privacy professionals supports our software engineering and operations to ensure that security is always a part of how we build and run our services. All of our Google Cloud and G Suite customers benefit from these capabilities, including:

 

• Secure-by-design infrastructure: Google Meet benefits from Google Cloud’s defense-in-depth approach to security, which utilizes the built-in protections and global-private network that Google uses to secure your information and safeguard your privacy.
   
   
  
• Compliance certifications: Our Google Cloud products, including Google Meet, regularly undergo independent verification of their security, privacy, and compliance controls, including validation against standards such as SOC, ISO/IEC 27001/17/18, HITRUST, and FedRAMP. We support your compliance requirements around regulations such as GDPR and HIPAA, as well as COPPA and FERPA for education.
   
   
  
• Incident management: We have a rigorous process for managing data and security incidents that specifies actions, escalations, mitigation, resolution, and notification of any potential incidents impacting customer data.
   
   
  
• Reliability: Google’s network is engineered to accommodate peak demand and handle future growth. Our network is resilient and engineered to accommodate the increased activity we’ve seen on Google Meet.
   
   
  
• Transparency: At Google Cloud, we’re clear about our commitments regarding customer data: we process customer data according to your instructions; we never use customer data for advertising purposes; and we publish the locations of our Google data centers, which are highly available, resilient, and secure.
  

During COVID-19 and beyond, we will continue to protect Google Meet users and their data, and keep innovating with new features to make our tools helpful, secure, and safe.

[ADMaster]

I’m a bit late to the party here, but I’ve been debunking all the negativity about zoom for two weeks now.

Several LEAs have evaluated it and recommend it.

Clever is offering / recommending it as a video conference solution. These are the ways I learned about it and trust in the recommendations of the two entities.

The zoom bombing is all preventable with a few settings that zoom as now rolled out by default.

The webcam hack was fixed in July, but brought up as a new issue in March

The UNC path issue was fixed very quickly and what teacher would click on links from students anyway.

I’ve issued advice on staying as compliant as possible such as no recording the meetings, and students should join with first name only and students should not have their own accounts.

 

We are a Google school, although I do have some Azure setup. Teams isn’t an option, we didn’t want to introduce too many new platforms in this situation. The teachers and students should use the platforms we have been using all school year.

I evaluated both zoom and Google Meet. I have the clever integrated version of zoom which gives me a school account to change settings, see usage reports, diagnostics etc, akin to the meet quality tool.

Zoom allows the teacher to manage participants mute them, kick them out, not allow them to share their screen and not allow students to join the meeting without the teacher. Simply put zoom has a lot more controls for the teachers.

Google Meet allows students to join at any time, get into the meeting to hang out before or after the teacher, anyone to share their screen and doesn’t allow the teacher to mute students.

Also I’d have to turn on hangouts to make it work, which opens up more chat options that we don’t want younger students having.

Google has announced some changes with nicknamed meetings and Google classroom integration is coming. However we are all using zoom now.

I have a few admin staff using meet for their meetings, but you don’t need the control to mute a lot of kid’s vs a few adults.

The whiteboard is great in zoom too. We have teachers recording lessons and uploading them. I made the suggestion they could create a zoom meeting with just them to record if they found that easier than other screen recording tools. Just don’t record with students present.

 

My remaining complaint with zoom is students able to create accounts even though their policy says no under 16s. However you’ll have that with any service. Overall configured properly zoom is a great tool.

[Ditto]

I’m a bit late to the party here, but I’ve been debunking all the negativity about zoom for two weeks now.

Several LEAs have evaluated it and recommend it.

Clever is offering / recommending it as a video conference solution. These are the ways I learned about it and trust in the recommendations of the two entities.

The zoom bombing is all preventable with a few settings that zoom as now rolled out by default.

The webcam hack was fixed in July, but brought up as a new issue in March

The UNC path issue was fixed very quickly and what teacher would click on links from students anyway.

I’ve issued advice on staying as compliant as possible such as no recording the meetings, and students should join with first name only and students should not have their own accounts.

 

We are a Google school, although I do have some Azure setup. Teams isn’t an option, we didn’t want to introduce too many new platforms in this situation. The teachers and students should use the platforms we have been using all school year.

I evaluated both zoom and Google Meet. I have the clever integrated version of zoom which gives me a school account to change settings, see usage reports, diagnostics etc, akin to the meet quality tool.

Zoom allows the teacher to manage participants mute them, kick them out, not allow them to share their screen and not allow students to join the meeting without the teacher. Simply put zoom has a lot more controls for the teachers.

Google Meet allows students to join at any time, get into the meeting to hang out before or after the teacher, anyone to share their screen and doesn’t allow the teacher to mute students.

Also I’d have to turn on hangouts to make it work, which opens up more chat options that we don’t want younger students having.

Google has announced some changes with nicknamed meetings and Google classroom integration is coming. However we are all using zoom now.

I have a few admin staff using meet for their meetings, but you don’t need the control to mute a lot of kid’s vs a few adults.

The whiteboard is great in zoom too. We have teachers recording lessons and uploading them. I made the suggestion they could create a zoom meeting with just them to record if they found that easier than other screen recording tools. Just don’t record with students present.

 

My remaining complaint with zoom is students able to create accounts even though their policy says no under 16s. However you’ll have that with any service. Overall configured properly zoom is a great tool.

Good to hear some detailed feedback, thanks. One quick question, which version of Zoom are you referring to - is it the free version, the education version or another?

[ADMaster]

Good to hear some detailed feedback, thanks. One quick question, which version of Zoom are you referring to - is it the free version, the education version or another?

 

I forgot to mention I've read the entire privacy policy and separate K-12 privacy policy.

 

I have some sort of licensed / education version through clever. Its free for a few months.

As I understand it my account lifts the time limit and participant count on basic accounts associated to me. I also get one licence for more pro features.

 

Clever / Zoom setup

[Ditto]

I see. I think a lot of concern around Zoom related to the free version and education staff insisting using it. Perhaps even the free version is much improved, but I think most IT support staff would for the present, feel more secure on MS Teams or Google option where they already have licenses for those. The Clever/Zoom collaboration is a interesting approach and I can see the appeal. Unfortunately, I suspect it won't be an option for UK/EU schools. There are a few of us that were/are really keen on Clever Badges, but that was stopped by Clever due to GDPR concerns, which as far as I am aware remains the case today.

[synaesthesia]

It still has quite a large cloud over it regarding security which makes me nervous - that on it's own wouldn't have been enough to warrant asking staff not to use it, but the companies attitude towards that lax security firmly drove the nail into the coffin. They may well have apologised and detailed a resolution, but haven't gone looking for it yet until back to work

[Arthur]

The end to end encryption thing is a non-issue - none of the corporate video tools offer it

As mentioned above, E2EE isn't offered on any of the common tools as it would prevent centralised management. However, if by some magic it could be enabled then why not? If something is more secure than it needs to be, great.

Jitsi Meet will have E2EE at some point in the (hopefully) not too distant future.

 

https://jitsi.org/news/e2ee/

 

Some of the people watching our repos have been asking us what the deal was with this little new HIPS project (which by the way stands for Hidden In Plain Sight). Well, now you know! HIPS is about using a new Chrome WebRTC API called “Insertable Streams” to add a second layer of end-to-end encryption to media streams in a way that would make them inaccessible to the video router.

 

While there is a ton of work left on getting authentication and key distribution to work, the project is already advanced enough for us to engage in two very important steps:

 

Continues...

 

[Mr.Ben]

Technical Security aside, we are advising that our schools use Teams because of the audit logs that it creates.

 

That protects the staff members by showing details of calls, who initiated them etc - really important for safeguarding staff as well as students.

 

If schools wish to purchase the education version of Zoom they can do, although it is again centrally controlled.

[Boredguy]

Doesn't Jitsi require you to setup a server for it in the first instance? That would put the connectivity on to the school connection to manage/ensure uptime, where as with Teams/Hangouts Meet that is down to the big data centre providers.

 

For some it might not be a practical option depending on what server capacity they have on site, regardless of internet connectivity.

[xlandhenry]

Why does Teams need a VPN?

 

The school I'm working at is in China. Here many things aren't working great without the use of VPN.

 

Here's a Microsoft recommendation for using VPN if you're using Teams in China:

https://docs.microsoft.com/en-us/office365/enterprise/office-365-networking-china

[Arthur]

Doesn't Jitsi require you to setup a server for it in the first instance? That would put the connectivity on to the school connection to manage/ensure uptime, where as with Teams/Hangouts Meet that is down to the big data centre providers.

It does if you don't want to use meet.jit.si, although you can run Jitsi Meet on a VPS so that it isn't reliant on your school's Internet connection.

 

Google Meet, Microsoft Teams and Zoom for Education are going to be better options for most. The former two being free for schools.

 

Jitsi is the obvious choice for those who prefer open source software however.