How is my child bypassing screentime limits?

Some possibilities:

https://www.cloudwards.net/how-to-hack-screen-time/

Ensure that the iPad has been updated to iPadOS 16.6.

Some questions:

1) Did you (or another adult) as Family Organizer create the child’s AppleID as described here:

Create an Apple ID for your child - Apple Support

2) Did the Family Organizer personally setup the child’s device after it had been Factory Reset (or purchased new) … specifically selecting “This is a Child’s Device” during setup?

3) Did the Family Organizer additionally setup Screentime on the child’s device - again selecting “This is a Child’s Device” AND use a unique secret passcode unknown to the child?

Use parental controls on your child's iPhone, iPad, and iPod touch - Apple Support

4) If the Organizer selected to use their OWN AppleID for Screentime passcode revovery, is the adult’s AppleID password indeed unknown to the child?

5) Within Screentime - specifically within the final group “Other Settings and Features” are restrictions set to prevent child from:

• Changing AppleID
• Changing Device Passcode
• Changing Data Plans

A very good “source.”

Thanks!

Thanks.

FYI, I’ve been “experimenting” on-the-side in an attempt to duplicate this behavior.

Your calm and “factual” Q&A is most appreciated!

Change your Screen Time passcode daily (keep it very different each time) & see if it still happens. It may be a PITA but if the unauthorized access still happens, you maybe he DOES know (by whatever means) the Screen Time passcode and may be keeping the access at a minimum (or within certain parameters) to draw attention away from it. It's worth a try anyways, especially if you don't change the Screen Time passcode regularly.

If changing the passcode daily does NOT stop the access, then he is gaining access in some other way (of which you are indeed trying to figure out).

Set up a parallel SSID and lock them to that, and shut that off on a schedule. This can be done with various approaches, including a cheap timer on a cheap router, or a mid-grade router with some scheduling controls.

To be blunt, all of this Parental Controls stuff can be bypassed, and that on an allowance scale budget, if the kid is inclined. Only reliable use I’ve found for these controls is keeping less technical folks locked down and away from random changes to settings. Kids, kids can bypass these, if not directly (password surfing, etc) then through readily available alternatives.

MrHoffman wrote:

Set up a parallel SSID and lock them to that, and shut that off on a schedule.

Excellent suggestion & very helpful.

Loren Ryter wrote:

Good idea. Not very practical for me (already have like 5 SSIDs on one router, and want to keep kid on same LAN anyway), but possible.

Five SSIDs on one router is unusual. Typical is at most two (guest, staff).

Three SSIDs is about the most I’ve ever met on one Access Point (AP) or one Wi-Fi router, and that was ugly. Here, that trio would probably be “Guest”, “Kid”, and “Parents”.

I typically recommend APs or mesh networks and careful Wi-Fi frequency coordination, rather than adding (often warring) Wi-Fi routers and adding SSIDs to manage added coverage, if that was the motivation leading to five SSIDs active here.

I get they can be bypassed, but it shouldn't be such a mystery how he's doing it. I'm pretty technically inclined and can't figure out the exploit. AFAIK any method that could involve a small budget is something like a jailbreak -- running software tethered to a computer -- and most likely can only be meant to circumvent the passcode security for the parental controls. It would be at the level of a boot injection, and I see nothing amiss in the boot sequence or any other obvious sign of such a hack. Furthermore, it would need to work by allowing him to change the screentime settings, which he's not doing.

That’s far more work than the easiest of the allowance-budget bypasses. Again, parental controls is doomed to fail, against any suitably inclined kid. Prisons fail at this. And yes, there are absolutely places and things around that parents do not want to have discussions about, and will wish to block, but that doesn’t make those conversations any less avoidable nor these blocks any more effective. Technology can’t solve people problems, IT sales reps’ claims aside.

IMO someone needs to keep an up-to-date list of exploits that a) parents can take further measures to block or otherwise handle, or b) apple can address.

Yes, and the folks maintaining that list are liars, scammers, cheats, and crooks, or those selling snake-oil and “magical” solutions, or those that wish to harvest data and metadata from you and your children, or those seeking to advertise to the children, or combinations. I manage more complex and more capable networking gear than most or the folks around here have access to, and all of what I have (including 802.1X RADIUS authentication, and redundant local DNS servers) can still be entirely bypassed by a kid on an allowance-scale budget.

And yes, the Kid-SSID will fail against even a mildly determined adversary with an allowance, too.

This is an exceedingly hard problem. Unsolvable, without (generally illegal) communications jamming.

Again, prisons fail at this.

Just a thought...I don't know that you mentioned it in what you've tried. Since these seem to be online apps (SnapChat and TikTok) that he wants to use, have you tried adding parental controls to the router/gateway to block all access to the internet from his specific device?

My teen has admitted to getting around screen time and restricted contacts by turning his phone off. When the phone is powered back on, it gives him access to apps and phone numbers for a few moments (I haven't timed how long) before the regular parental control settings start working again.

Momofabunch wrote:

My teen has admitted to getting around screen time and restricted contacts by turning his phone off. When the phone is powered back on, it gives him access to apps and phone numbers for a few moments (I haven't timed how long) before the regular parental control settings start working again.

Have you confirmed this?

It may also be that he knows your passcode and does not want to tell you. Even it it allowed access to an app for a few seconds it does not seem like it would be beneficial to restart your phone 30 times for just a minute of extra use.