Google Addons/Extensions GDPR Safety Etc

[keyboards]

We've had an influx of teachers using/suggest add-ons extensions etc such as Nearpod, Peardeck, Spiral etc, what are people doing about these? Are they safe in essence as they have a sign-on with Google button, intrigued to know

[gh5000]

You need to be checking the privacy policies of each of these ideally. Although there is not a real way of enforcing these as some are just websites rather than extensions that you approve so you will find teachers just off doing their own thing.

 

As of my last check PearDeck isn't GDPR compliant. I don't think it's doing anything dodgy as it is compliant with the US based systems - Coppa? etc, they just say that they are working towards GDPR compliance.

 

Nearpod on the other hand have references to GDPR compliance on their privacy policy.

[Primus]

We've gone to whitelist only and we're doing a DPIA for each.

[dhicks]

Are they safe in essence as they have a sign-on with Google button, intrigued to know

 

If you look at the API for Google's OAuth implementation, a site can request various different levels of access. At the most basic level it doesn't even need to request to know your user's email address or name, just the domain and a Google-generated unique ID for that user. You think more sites would make use of that - license your whole domain for use with whatever it is, no need to worry about any personal data.

[DGardiner]

id recommend setting all high risk api scopes to whitelist only.. then you get to control what they plug in. Were considering setting chrome extensions to whitelist only to

[keyboards]

id recommend setting all high risk api scopes to whitelist only.. then you get to control what they plug in. Were considering setting chrome extensions to whitelist only to

 

We have on-site whitelisted extensions, where is the high risk APi setting?

[synaesthesia]

Sound advice above - starting to get a few requests for addons for Teams too. Whilst it's a far more curated list of apps than anything on the Chrome store for example, they're not always going to be ready to use here as opposed to the US. I'm likely to need advice at some point regarding an addon called Polly for Teams - it's a globally enabled app (well it was) for which the online, paid for presence via polly.ai appears to be GDPR compliant, however the addon has a very different set of policies and does not appear to comply. I've said no until further notice to cover ourselves first on the basis that all data is stored in the US and the "we can use your data anywhere we like" policy can do one too.

[DGardiner]

We have on-site whitelisted extensions, where is the high risk APi setting?

 

https://admin.google.com/ac/owl

 

click manage google services

 

Change Drive/Email, press restricted and then tick the high risk scopes only

 

This will allow them to use basic oauth stuff that will share name/email but will stop things hooking in and reading their drive/emails for example unless on the whitelist

[TMBS]

https://admin.google.com/ac/owl

click manage google services

 

Change Drive/Email, press restricted and then tick the high risk scopes only

This will allow them to use basic oauth stuff that will share name/email but will stop things hooking in and reading their drive/emails for example unless on the whitelist

 

Thanks this has been really useful! When you say 'on the whitelist' where do you mean in Google Admin?

[DGardiner]

Thanks this has been really useful! When you say 'on the whitelist' where do you mean in Google Admin?

 

Any app that connects to the api has an appID, if you go to the page above and press the "third party apps" you can add app id's to the list and set them as trusted. this will allow them to connect to those high riskscopes - anything not on the list will get an app not authorised error

Edited February 2, 2021 by DGardiner