How is my child bypassing screentime limits?

Loren Ryter wrote:

Good idea. Not very practical for me (already have like 5 SSIDs on one router, and want to keep kid on same LAN anyway), but possible.

Five SSIDs on one router is unusual. Typical is at most two (guest, staff).

Three SSIDs is about the most I’ve ever met on one Access Point (AP) or one Wi-Fi router, and that was ugly. Here, that trio would probably be “Guest”, “Kid”, and “Parents”.

I typically recommend APs or mesh networks and careful Wi-Fi frequency coordination, rather than adding (often warring) Wi-Fi routers and adding SSIDs to manage added coverage, if that was the motivation leading to five SSIDs active here.

I get they can be bypassed, but it shouldn't be such a mystery how he's doing it. I'm pretty technically inclined and can't figure out the exploit. AFAIK any method that could involve a small budget is something like a jailbreak -- running software tethered to a computer -- and most likely can only be meant to circumvent the passcode security for the parental controls. It would be at the level of a boot injection, and I see nothing amiss in the boot sequence or any other obvious sign of such a hack. Furthermore, it would need to work by allowing him to change the screentime settings, which he's not doing.

That’s far more work than the easiest of the allowance-budget bypasses. Again, parental controls is doomed to fail, against any suitably inclined kid. Prisons fail at this. And yes, there are absolutely places and things around that parents do not want to have discussions about, and will wish to block, but that doesn’t make those conversations any less avoidable nor these blocks any more effective. Technology can’t solve people problems, IT sales reps’ claims aside.

IMO someone needs to keep an up-to-date list of exploits that a) parents can take further measures to block or otherwise handle, or b) apple can address.

Yes, and the folks maintaining that list are liars, scammers, cheats, and crooks, or those selling snake-oil and “magical” solutions, or those that wish to harvest data and metadata from you and your children, or those seeking to advertise to the children, or combinations. I manage more complex and more capable networking gear than most or the folks around here have access to, and all of what I have (including 802.1X RADIUS authentication, and redundant local DNS servers) can still be entirely bypassed by a kid on an allowance-scale budget.

And yes, the Kid-SSID will fail against even a mildly determined adversary with an allowance, too.

This is an exceedingly hard problem. Unsolvable, without (generally illegal) communications jamming.

Again, prisons fail at this.