iPad Monitoring

[ibpalle]

We used ipads in shared mode, Smoothwall browser with the app configured to store the login in icloud - this makes the login a one time deal.

 

custom browsers are horrible though, causes issues with webclips and stuff so gotta weigh up the pros and cons, its a shame the ipad cant just be made to ping the idex with the current user or something like that atleast for onsite or a pseudovpn that does the ident/scanning stuff like an adblocker

 

The browser is based on Firefox so should be reasonably compliant - it's certainly not something we have gotten reports of sites not working on. If we could install extensions in Safari that would be better but not an option.

 

I did try to get iDex agent logins working for one customer who explained they had a setup where users logged into their iPads using AD credentials. We tried but all the logins came from the same IP as the iPads were sending the credentials to an on-site device, which then authenticated the user on AD which meant that all iPad logins showed up as coming from the IP of that device - bummer.

 

One-to-one iPads are a bit easier to find a solution for - but shared is a problem, as you all are aware of.

[DGardiner]

The browser is based on Firefox so should be reasonably compliant - it's certainly not something we have gotten reports of sites not working on. If we could install extensions in Safari that would be better but not an option.

 

I did try to get iDex agent logins working for one customer who explained they had a setup where users logged into their iPads using AD credentials. We tried but all the logins came from the same IP as the iPads were sending the credentials to an on-site device, which then authenticated the user on AD which meant that all iPad logins showed up as coming from the IP of that device - bummer.

One-to-one iPads are a bit easier to find a solution for - but shared is a problem, as you all are aware of.

 

it is compliant and works fine functionally but the on device webclips wont open once you disable safari, regardless of default browser being set to firefox- i settled on using a plist to configure the browser a bit an having the kids shortcuts on a google site so the teachers could maintain it.

[Face-Man]

it is compliant and works fine functionally but the on device webclips wont open once you disable safari, regardless of default browser being set to firefox- i settled on using a plist to configure the browser a bit an having the kids shortcuts on a google site so the teachers could maintain it.

 

It depends on what MDM you use but I know with meraki you can set the application that the webclip uses to open so can prevent it using safari as default.

 

looking at https://developer.apple.com/documentation/devicemanagement/webclip it appears you need ios 14 or above.

 

On a different note if you are an LGFL or NGFL customer you can use their "HomeProtect" product to filter access on iPads not the same as monitoring which was going to be via Impero before that was removed from their offer

and https://www.facebook.com/imperosoftware/posts/addressing-the-issues-that-young-people-face-today-requires-a-robust-and-up-to-d/4019883198058733/

[ITPROF]

With the iPads apart from Meraki which other MDM solution would you recommend?

 

Also I am looking into firewalls, I am going to remove the smoothwall solution and I have had demonstrations of a few. Which one have has people found the best?

[DGardiner]

With the iPads apart from Meraki which other MDM solution would you recommend?

 

Also I am looking into firewalls, I am going to remove the smoothwall solution and I have had demonstrations of a few. Which one have has people found the best?

 

I wouldnt use anything but jamf at this point, its pricey but works a treat

[Tefters]

I wouldnt use anything but jamf at this point, its pricey but works a treat

 

Second this ^^^, JamF all the way.

 

As for firewalls, we have a Sonicwall NSA 2650 which we fully managed ourselves hooked up to an Exa router/internet line and use their Lightspeed solution off-prem.

[Tefters]

So just wanted to give people a further update on Lightspeed and their Alerting (safeguarding) product.

 

TLDR: ITS STILL CRAP!

 

They have apparently made further improvements to the algorithms bla bla bla and been chasing me for weeks to do further testing but I've been bogged down with other projects/work.

Grabbed a child iPad today, made sure everything was configured correctly, searched up their test alerting phrase "lsalerttestselfharm0" and "lsalerttestviolence0" both alerted immediately on the portal. Boom all config is working.

 

Test the following phrases off the top of my head:

 

- easy suicide methods = Alert shows.

- how to pills to go to sleep = Nothing (purposely worded wrong because you know... Kids...) - Google managed to work it out though and show me links to Samaritans as well as other support orgs.

- fall asleep forever = Nothing - Google again worked it out and showed same results for Samaritans etc...

- how many paracetamol to die = Nothing - Again Google did its magic.

 

So here we are on our 1-year anniversary and the product is still no better than when i first configured it with their cloud rocket gateway or whatever buzz name/term they give it.

 

The web filtering is still pretty good however. 1 or 2 little quibbles when it comes to blocking Youtube but Youtube thumbnails and live tiles not being blocked on Google searches but some simple URL sniffing put an end to that.

 

I wish I had the time to investigate other products out there, Smoothwall and Exa partnership come to mind along with Netsupport Cloud.Classroom but I just haven't had the time so i've left the decision to the school on how they want to handle this with Lightspeed as i've now fully given up on their Alerting product for IOS devices. I pray to god its better on PC and Mac desktops but for IOS it is not fit for purpose and the only way I will even remotely test it let alone use it properly moving forward is if they pay me as the amount of time i've sunk into testing their product with basic child protection search terms is ridiculous.

Edited June 19, 2023 by Tefters

[tom_newton]

Thanks for this,

 

I was fortunate enough to read this thread before purchasing.

 

You have hit the nail on the head with that summary @Tefters.

 

We have purchased the solution with Impero the Contentkeeper solution. With the new KCSiE requirements we involved the Safeguarding team and they are impressed. Smoothwall and Lightspeed hold the data for 3 months, Impero hold it for 12 months so they can view data and trends. It will keep them off my back asking for reports as they all get dashboards.

 

I was reluctant to view the Impero solution but so glad I did.

 

Just for clarity - there's longer retention by default on our monitor product, and filter users can choose to hold all data for longer, or to archive and store that data themselves. Of course all safeguarding data (real problems) should be in your Record Manager product.

[tom_newton]

So just wanted to give people a further update on Lightspeed and their Alerting (safeguarding) product.

 

TLDR: ITS STILL CRAP!

 

They have apparently made further improvements to the algorithms bla bla bla and been chasing me for weeks to do further testing but I've been bogged down with other projects/work.

Grabbed a child iPad today, made sure everything was configured correctly, searched up their test alerting phrase "lsalerttestselfharm0" and "lsalerttestviolence0" both alerted immediately on the portal. Boom all config is working.

 

Test the following phrases off the top of my head:

 

- easy suicide methods = Alert shows.

- how to pills to go to sleep = Nothing (purposely worded wrong because you know... Kids...) - Google managed to work it out though and show me links to Samaritans as well as other support orgs.

- fall asleep forever = Nothing - Google again worked it out and showed same results for Samaritans etc...

- how many paracetamol to die = Nothing - Again Google did its magic.

 

So here we are on our 1-year anniversary and the product is still no better than when i first configured it with their cloud rocket gateway or whatever buzz name/term they give it.

 

The web filtering is still pretty good however. 1 or 2 little quibbles when it comes to blocking Youtube but Youtube thumbnails and live tiles not being blocked on Google searches but some simple URL sniffing put an end to that.

 

I wish I had the time to investigate other products out there, Smoothwall and Exa partnership come to mind along with Netsupport Cloud.Classroom but I just haven't had the time so i've left the decision to the school on how they want to handle this with Lightspeed as i've now fully given up on their Alerting product for IOS devices. I pray to god its better on PC and Mac desktops but for IOS it is not fit for purpose and the only way I will even remotely test it let alone use it properly moving forward is if they pay me as the amount of time i've sunk into testing their product with basic child protection search terms is ridiculous.

 

If you would like to play with the Smoothwall Monitor product, please shout. I can guarantee it will blow the socks off your DSLs, and we can get it deployed pretty sharpish.

[Mrpower]

Just wondering, how everyone has solved the issues of knowing who is using the iPad at any one time / who's using the internet on the iPad? I only ask as we have both staff used iPads for an SEND recording app called Earwig; and iPads used by pupils. the issue I find is anyone can just open the iPad and start surfing and I don't know if its a member of staff or a learner. Without pushing them to a proxy on our Smoothwall, forcing them to login. I am not sure what else I can do? Can smoothwall help me with this? @tom_newton Edited June 20, 2023 by Mrpower

[Tefters]

Ok here's the icing on the cake as of this morning:

 

Known phrases are successfully generating Alerts, therefore the search terms being used explains why some are not being generated as expected. The product is functioning correctly, we just require some patience as the known phrases are improved and expanded. Each of the undetected phrases are being reviewed, so you can expect to see them detected going forward.

 

So as I search more with weird and wonderful phrases they are going to monitor them from their side and decide whether these should be alerted on in the future while in the meantime a child has searched up something and performed on that.

[tom_newton]

Just wondering, how everyone has solved the issues of knowing who is using the iPad at any one time / who's using the internet on the iPad? I only ask as we have both staff used iPads for an SEND recording app called Earwig; and iPads used by pupils. the issue I find is anyone can just open the iPad and start surfing and I don't know if its a member of staff or a learner. Without pushing them to a proxy on our Smoothwall, forcing them to login. I am not sure what else I can do? Can smoothwall help me with this? @tom_newton

 

It's a tricky one - you are best using shared iPad mode - so folks have to put in a pin or similar to get into the ipad. Otherwise anything you do to login might "hang around" and someone else picks it up.

[tom_newton]

It did blow the socks off our DSL's Tom. They could not believe how bad it was from a reporting stand point.

 

Appreciate your offer though

 

This surprises me - Smoothwall Monitor isn't the country's most popular monitoring tool for no reason. Would love to get some of your feedback if you have time?

[Tefters]

Their is nothing you can do other than forcing some sort of logout/login or authentication on them. This is where shared iPads in education just don't work with out physical supervision over the shoulder.

 

This is why we are in the 1:1 iPad model where everyone has their own device.

[DGardiner]

Their is nothing you can do other than forcing some sort of logout/login or authentication on them. This is where shared iPads in education just don't work with out physical supervision over the shoulder.

 

This is why we are in the 1:1 iPad model where everyone has their own device.

 

actual shared ipad mode works fine. You push the cutsom browser and configure the plist appropriate for your environment

[Tefters]

@tom_newton

 

I had time for a demo when your partnership with Exa was announced but unfortunately I got bumped off as everyone was at BETT. Personally this was a little frustrating as BETT to me is a glorified sales roadshow and having some staff office based still capable of dealing with potential customers would of been nice.

 

I need to have a proper conversation with Exa to understand how I can draft up a solution between their product SurfProtect and your product to meet our needs and for me to test with but unfortunately time is against me as always and haven't had the chance to revisit since getting cancelled.

 

Maybe sometime over summer I can start speaking with people and work out how a solution would look and get testing but as you have seen from my posts above I can be quite honest. I don't expect an all singing, all dancing product but I do expect a product to meet basic expectations.

[Tefters]

actual shared ipad mode works fine. You push the cutsom browser and configure the plist appropriate for your environment

 

So how do you distinguish between a teacher or a student picking up the iPad and just surfing.

How do you deal with different access levels?

 

I might be understanding you wrong so apologies in advance if I am but if your just pushing a browser with a plist isn't that just generic? Isn't some sort of authentication required somewhere to know who is actually using the device?

[DGardiner]

So how do you distinguish between a teacher or a student picking up the iPad and just surfing.

How do you deal with different access levels?

 

I might be understanding you wrong so apologies in advance if I am but if your just pushing a browser with a plist isn't that just generic? Isn't some sort of authentication required somewhere to know who is actually using the device?

 

Ours is configured to require the user to log into their google account, which then saves the session details to their icloud drive and follows them from device to device - from then on its filtered/reported on just like the chromebooks on the cloud filter

[DGardiner]

Ours is configured to require the user to log into their google account, which then saves the session details to their icloud drive and follows them from device to device - from then on its filtered/reported on just like the chromebooks on the cloud filter

Heres the plist info https://kb.smoothwall.com/hc/en-us/articles/4404006049810-Installing-Cloud-Filter-for-iOS depending on your mdm it looks like you can configure it per user so they wouldnt even need to do that

[Tefters]

Ours is configured to require the user to log into their google account, which then saves the session details to their icloud drive and follows them from device to device - from then on its filtered/reported on just like the chromebooks on the cloud filter

 

Right... I get the whole saved Google credentials in the icloud drive so it follows from device to device but ultimately then the users have to log in and out of iPads as and when they use them?

[tom_newton]

@tom_newton

 

I had time for a demo when your partnership with Exa was announced but unfortunately I got bumped off as everyone was at BETT. Personally this was a little frustrating as BETT to me is a glorified sales roadshow and having some staff office based still capable of dealing with potential customers would of been nice.

 

I need to have a proper conversation with Exa to understand how I can draft up a solution between their product SurfProtect and your product to meet our needs and for me to test with but unfortunately time is against me as always and haven't had the chance to revisit since getting cancelled.

 

Maybe sometime over summer I can start speaking with people and work out how a solution would look and get testing but as you have seen from my posts above I can be quite honest. I don't expect an all singing, all dancing product but I do expect a product to meet basic expectations.

 

I have been in with Exa's CTO and we're happy Monitor and Surfprotect can work together just fine. I'm sorry you had that experience during BETT! I am happy to act as a point of contact to help organise things over the summer

[DGardiner]

Right... I get the whole saved Google credentials in the icloud drive so it follows from device to device but ultimately then the users have to log in and out of iPads as and when they use them?

 

ours is configured to sso with google, so first time round the kids put their email in, it forward to google where they login - they then set an ipad pin.

 

from then on their email/pin will log them into any ipad

 

open the smoothwall browser, login with google and whenever that users logged into an ipad the browser filter against that users config on the cloud filter(not requiring yet another login), the onsite appliance also regularly ingests the cloud filter data that allows you to run reports as normal if needed

 

its also not so much a logout thing, just lock/sleep the ipad and unless the user puts their pin in, someone else would have to login to gain internet acces, which again would require them to login/identify as appropriate

Edited June 20, 2023 by DGardiner

[tom_newton]

Spot on @DGardiner - unless there's something to demarc one user from another at "pick up" time, you always have the chance for users to get jumbled up

[DGardiner]

im not sure if theres something your MDM can do to deploy the plist per user and prefill the username, but that would be great

[Tefters]

ours is configured to sso with google, so first time round the kids put their email in, it forward to google where they login - they then set an ipad pin.

 

from then on their email/pin will log them into any ipad

 

open the smoothwall browser, login with google and whenever that users logged into an ipad the browser filter against that users config on the cloud filter(not requiring yet another login), the onsite appliance also regularly ingests the cloud filter data that allows you to run reports as normal if needed

 

its also not so much a logout thing, just lock/sleep the ipad and unless the user puts their pin in, someone else would have to login to gain internet acces, which again would require them to login/identify as appropriate

 

Yes precisely, so authentication has to happen one way or another to identify the user on the device.

 

Whoever it was earlier was asking if there was a way of doing it without which there isn't and I was simply commenting on the fact we use 1:1 devices to avoid all this hassle not to mention the other issues with Apps, accounts not signing in and out properly, credentials in apps lurking etc...

 

In general, I hate iPads in education...