[judge2020]

I don't think there is a good solution. Yes, you own the network and think you should be technologically able to block access to certain websites (which the school has the right to do), but ISPs also "own" the network and would also be able to block access to certain websites if it were possible with DoH+eSNI.

I guess a solution is MDM, but that's still getting students to install something on their device.

[ronsor]

I would not install a school managed backdoor on my device.

[shittyadmin]

So your options are then:

- Cry about it and hope they change the policy (they won't)

- Accept using your cell data at school instead of their wifi (works, but is expensive)

- Bypass it using a VM (requires moderate technical knowledge, networking skills and possibly the ability to bypass vm detection)

- Reverse engineer it and crack it to behave the way you want (requires some pretty advanced technical skills)

As such, the vast majority of people will just go ahead and install it. This is the problem with these sorts of applications...

[zrm]

Or you can have the local interface and the cellular interface up at the same time, have the default route through the local interface but have a route to your preferred DNS server through cellular. Then the only traffic you have to pay for over cellular is DNS, which is very small.

[Avamander]

Kids are clever, if one of their classmates is known to be tech-literate and (s)he's saying the school is snooping on you the amount of shadow IT will rise. Vast majority will install, but also have some other device to bypass.