K-12 Profiteers Don't Care about Data Security for Children

Clip from NYTimes:

When Tony Porterfield’s two sons came home from elementary school with an assignment to use a reading assessment site called Raz-Kids.com, he was curious, as a parent, to see how it worked. As a software engineer, he was also curious about the site’s data security practices.

And he was dismayed to discover that the site not only was unencrypted, but also stored passwords in plain text — security weaknesses that could potentially have allowed unauthorized users to gain access to details like students’ names, voice recordings or skill levels. He alerted the site to his concerns. More than a year later, the vulnerabilities remain.

“A lot of education sites have glaring security problems,” said Mr. Porterfield, the principal engineer at a software start-up in Los Altos, Calif. “A big part of the problem is that there’s not even any consensus of what ‘good security’ means for an educational website or app.”

Contacted last week by a reporter, John Campbell, the chief executive of the Cambium Learning Group, the company behind Raz-Kids.com, said that his company took privacy very seriously and that the site did not store sensitive personal details like student addresses or phone numbers. . . .