When I tell parents that secretly spying on their kids' internet activities is not a great look, they ask me "Well, what SHOULD I do?"

There is no all-purpose parenting answer, but this report from Malwarebytes outlines many of the key considerations: https://www.malwarebytes.com/resources/attachments/parenting-and-growing-up-online-10-2022.pdf

@evacide I have told people to stop putting spyware on their kids devices for years and it always ends so badly. They never listen to me.
@hacks4pancakes @evacide The obvious solution is to make spyware that doesn't work, promote it, charge lots of money
@hacks4pancakes @evacide my answer to this is usually “educate your kids about risks, tell them there’s plenty out there that represents the best and worst of humanity, once they see something they can’t unsee it, you won’t be able to stop them if they really want to find something, and make sure they know they can always discuss anything with you”.
@fields @hacks4pancakes @evacide Develop a trusting relationship with their children? What madness is this?! /s

@JPruente @fields @hacks4pancakes @evacide

I bet you dont even dig through their stuff when they are at school!

@hacks4pancakes @evacide
From the time our kids were age 6 or so, not once did we enter their rooms without first knocking and waiting for an answer.

I can't understand parents who don't teach their kids by example that their most fundamental right is a right to privacy.

@kims As soon as mine started closing the door (which seemed pretty late to me--maybe 10 or 11?) we started doing that. I HATED it when my mom would just barge in to my room w/o knocking.
@hacks4pancakes @evacide I’ve had the same experience. Parents don’t listen. They confront their kids over BS. They’ve isolated their kids from the family. 🤷🏼‍♂️
@hacks4pancakes @evacide I've had limited success with one close friend, but most people respond with the usual "if you don't have anything to hide" crap, completely ignoring the greater risk of being surveilled and/or exploited by bad actors. The dystopian future is already here.

@hacks4pancakes @evacide installing monitoring software is basically the one thing I refuse to do for folks in the neighborhood.

None of them understand why.

The adults think I'm reckless & judging their parenting while the kids think I'm "trying to be cool".

It always comes down to education, doesn't it?

@hacks4pancakes @evacide You know, the fact that a parent doesn’t trust their kids enough to not spy on them is probably a huge part of the reason their kids don’t trust them enough to tell them what’s going on. I can’t be sure of that, having never had kids myself, but I can’t imagine it helps.

@hacks4pancakes @evacide I was at a school hosted event where parents wanted to know which spyware to use on their kids. Responded with:

A: if, and more likely when, the child discovers a parent installed spyware, the trust between parent and child will likely be irreparably harmed.

B: the day that the spyware company gets hacked, the parent has to take the responsibility for letting their child’s information fall into bad hands.

Still advocating this position.

@hacks4pancakes @evacide silver lining it's probably the fastest way to create new hackers
@hacks4pancakes @evacide or, even better, lets educate people to exchange their phone`s operating systems to also prevent lowlevel data collection.

@evacide My daughter is nine, and the number of conversations I've had with her peers' parents that treat their kid's relationship with technology as inimical is shocking. You just have to talk to them about what they're finding online and why it is (or isn't) bad.

And teach them to use a password manager from the beginning.

@will @evacide honestly talk about the architecture a bit. kids can follow the relationship between, say, cookies and tracking, and they make quite logical and sensible choices once informed.
@quinn @evacide Exactly! Explaining the difference between searching for something you want to watch on YouTube vs letting the YouTube algorithm shovel increasingly irrelevant garbage recs gave her the info she needed to make informed choices. And it worked.
@will @evacide 🙌 ain’t no replacement for really talking to your kids.
@will @evacide Getting even my SO to use a password manager has been a struggle. I think teaching children to use password managers is probably the only way it will really ever become commonplace.

@evacide

Please forgive the self-promotion but I have some thoughts on what parents can do. A few years back, I wrote a book called "Raising Cyberethical Kids," which is available here:

https://link.cybertraps.com/RCK_PB

My main take-aways are that parents can prevent the majority of problems by: 1) delaying access to technology; 2) having frank conversations with children about the risks of online activity at an early age; and ... 1/2

#parenting #cybersafety #technology #privacy

@evacide

3) conducting reasonable, age-appropriate supervision (not "surveillance") which they also discuss with their children.

I believe that secret or hidden surveillance in the home undermines trust, normalizes surveillance by existing power structures, and generally violates fundamental ethical principles. 2/2

@fsl3 @evacide is there anywhere non-amazon to get your book (as an ebook)? I'd love to give it a read, but I usually prefer to not give amazon money.

@edihael @evacide

Sure! Happy to send you a PDF for a nominal fee. Message me for Venmo details. :)

@evacide My parents (mainly my dad) being inexplicably nosey and restrictive when it came to the internet was basically my origin story for getting into hacking and information security, in general.
His cockamamie rules are how I originally learned to steal passwords, cover my tracks, and better understand how computers worked as a whole.
I’m not a parent, but I do heavily remember what it felt like to have no privacy as a kid. It was invasive and humiliating. It only made me want to hide more from my parents, than anything else.
I wouldn’t say I have a perfect answer either, but I certainly will say that the harder you are and the less autonomy you give a kid, the more likely they are to just find a way around the thing. At least in my experiences and what I’ve discussed with my peers, anyway.
In any case, I really like how this report is laid out. It’s very well-written and informative.
Thank you for sharing.

@myraccoonhands
I, too, plan to be restrictive but also a little clumsy in the beginning for the sole purpose of motivating them to outsmart me an bypass restrictions.

So far they have only managed to install #minetest mods that I had uninstalled before. And they have figured out that they both can play these "banned" mods when the one who has them installed hosts the server.

They got so excited and proud, they told me right away 😅
@evacide

@evacide there is one all purpose answer, talk to your kids like they're human beings. build and nourish a real relationship with them.
@evacide The internet is no different than sex or drugs. On so, so many levels.
@evacide monitoring and banning does not keep your kids safe, and most likely will put them at more risk because they will not feel able to talk to you about stuff they encountered online. It's better to talk to them about what they could encounter and how to deal with it and how to protect themselves. Plus you don't own your kidd. They have a right to privacy

@Scornflakegrrrl @evacide

I agree wholeheartedly. We have to empower our youth to make informed choices and feel safe enough to come to us with concerns. I've been working on building some digital literacy skills with my 8 year old and sitting alongside him showing him how to tell what are sponsored ads, flaws in algorithms, how to discern if a resource is credible, and we have talked about general online safety as well.

As a teen who started exploring the internet in the internet in the mid-90s, I definitely got into some unsavory stuff and learned some lessons, but I wish I would have learned some of the things I am teaching my son now. With all the cuts to school media centers and specialists, a lot of kids don't get much, if any, instruction on critical digital literacy skills.

@evacide What worked for me was talking early and often. And sometimes it would be “Yeah, that YouTube was really gross, wasn’t it? Maybe don’t go to that kind of channel again.”
@wendynather @evacide I've had that same conversation with my kids. LOL
@evacide Look, I'm not actively spying on them all the time, but as a parent, I reserve the right to have a glance at the browser history once in a while. It's a healthy enough thing to know your kids aren't into something dangerous.

@heydaave @evacide You don't "know" anything of the sort though, the history is trivially manipulated (they can start with incognito mode, which is easy enough to do they can find out about it on the school playground).

So you violate their privacy and gain nothing substantial. You'd be better off with an honest relationship with your kids, and you don't get there by snooping.

@fwaggle @evacide Why does this always turn into someone on the internet telling me about my relationship with my kid? Go fuck yourself.

@heydaave

For the same reason you're telling me about mine: "It's a healthy enough thing to know your kids aren't into something dangerous" - you and I have the same level of understanding of what our kids are up to, and I'm not about to rat through their browser history... but you're effectively pretending that I don't.

You have a lovely day though.

@heydaave @evacide I do this too but I dont do it secretly and we have discussions if something comes up that seems like we need to talk about it. My kids are younger though and I do have parental controls on everything, wifi, TV, devices and they have set screen time limits by day and time. Their freedom will grow as they get older, and more responsible, and mature just as it is with everything else.
@LittleYetFierce @evacide It's pretty clear that every parent should talk to their kids, be able to show respect and trust for their kids, especially as they get older. I totally get where you're coming from with the parental controls, etc. It's one thing to trust your kids, quite another to trust everyone they might interact with online. I don't get to say, "Well, I was respecting their privacy and that's how this happened." That's being irresponsible as a parent.
@heydaave @evacide thats exactly it! We talk about internet safety, and to the extent that they can understand they do, however, I do NOT trust the strangers that can get into to my house via a device.
@evacide I now ask parents the question if they ever envision their children coming home during the holidays when they grow up and when they say of course, I reply with "then I can't help you, coz If I do that won't happen."
Sharenting, BYOD and Kids Online: 10 Digital Tips for Modern Day Parents

Today is Safer Internet Day which marks the annual occurrence of parents thinking about their kids' online presence (before we go back to thinking very little about it tomorrow!) It's also the day the Courier-Mail here in my home state of Queensland published a piece on sharenting or as Wikipedia

Troy Hunt
@evacide when my kid was 12 or so, she was home from school working on a pass/fail assignment on her Chromebook. I told her I was installing a focus extension that’s requires you to type in a paragraph to disable it. I then monitored her chrome browsing history remotely while at work. What followed was a cat and mouse game of me updating the regex blocklist remotely, culminating in the entry “.*\sfun\s.*” and an infuriated text message from her “YOU BLOCKED FUN?????”
@evacide she asked if I always kept track of what she did on the internet, and I told her only when I was worried, and only in ways she knew that I could. She never bothered hiding (that I know of), and I basically never bothered looking.
@evacide my takeaway from that incident was that me knowing what she was doing didn’t help, and me trying to put controls in place wasn’t a solution. She didn’t need fewer distractions or guardrails: she just wasn’t going to do the fucking assignment, and a contest of wills was just more of a distraction.
@evacide Let me preface this by saying I have worked in IT for most of my adult life. I have always had a close relationship with my daughter but she was getting in with a bad crowd. I put on parental controls and monitoring software on her computer and phone AND TOLD HER that I did so and why.
We had already had many talks of what not to do on the internet however she ignored my advise many times over so this was a necessary action.
Doing so caught her on two different events, both times sneaking out to see someone (both older males) she met on the internet of whom she had never met before. I contacted the parents of one and contacted another who was well old enough to be prosecuted as an adult.
There is NO DOUBT in my mind that if she had met these people that she would have been raped and/or I would have lost my daughter.
Saying "this will end badly" or you need to "build trust", that's not how this works. The psychology of it is much more complicated than that and sometimes you have to take such steps to protect your children. My daughter is on her own now and we're closer than ever.

@evacide I started reading and will finish later, but do we really think writing passwords down is a bad thing? Sure, don't leave it on the bottom of your work keyboard, but I disagree that this is "bad advice".

#passwords #securityawareness #securityadvice

@hee_nalu @evacide I also strongly suggest writing passwords down on paper as an alternative to reusing passwords or trying to remember them.

For folks who have never learned any password hygiene, the cognitive overhead of using a password manager is absurdly high. Writing everything down and keeping it physically secure is a completely reasonable on-ramp to using a password manager and provides much better security than doing nothing at all.

Even using a password manager for everything (which I do), I still have master passphrases written down and locked up.

@alex @evacide yeah, I just think the threat model risks a written password adds are far smaller than all the alternatives. Especially for my kids.

@hee_nalu @evacide in security context, depends on the threat.

As a teen, I would imagine the threat as a bully that tries to steal my account to harm me, or a parent / sibling that discovers it, even by accident, breaking my trust.

In both this situations, writing them down doesn't seem ideal to me, basically because the kid doesn't have full ownership of his space like an adult, so the piece of paper where it's written down could be vulnerable.

@evacide Just a shot in the dark here. Teach your kids how to handle reality and the difference between safe and not safe.

Surveillance never works out. Nor do suppressing people.

@breadbin @evacide We've explained that they can have private journals Social networks are public and thus subject to audit by parents. So I ask them to turn in their devices from time to time to help them find vulnerabilities.
@evacide all my son (the 9 year old one) asked for from Santa was a toolkit to make things with wood, no spyware included, no phone, no ipad. I 💙 that he doesn't fill his head with the garbage fest online... well... yet

@evacide Lol, I *just* set up a computer to take a screenshot every minute for my son.

It saves them to the desktop. Trying to teach mindfulness and consideration for the purpose of tools rather than *actually spy* on him, but man finding the right thing to do here is hard.

@evacide this is why I have been advocating for years that the school district where my kids attend need to cut that shit right out. I will continue to argue that surveillance tech is not a pressing need in school budgets to anyone who will listen.
@evacide situational awareness is the key item. I don’t have any offspring. However as many people’s tech advisor, I always ask is the fallout from spying on their kids worth the sense of security?
I fully support tracking to make sure know where kids are.
So far the talk about why not spying but knowing what people are doing have worked.
It is on the parents as much as the kids.
Spying is bad. Known surveillance is acceptable
@evacide We're not there yet but have been giving the topic lots of thought. Thank you for sharing this 
@evacide @catsalad I always get weird looks from parents when they ask what I do to monitor my kids and answer with “Talk to them”. Then they ask me what software or hardware I use, and I have to explain that I just talk to them. Finding out about my kids day is almost always the best way for me to keep up with what they are doing and help ensure they’re doing the right things.
@evacide very interesting and sometimes surprising
@evacide I was lucky to have great kids, and mostly I let them have their privacy. I never spied on them, but I did talk to them a lot!
@Estarianne @evacide That's lovely..