Skip to content

Questionable child security called Qustodio

Qustodio markets itself as "Best Parental Control Software". Really? I don't believe in any kind of advertisement, but after spending a year with "Kaspersky Safe Kids" I was more than sure that it couldn't be worse than that.

Turns out, I was wrong. It seems that Qustodio lacks even most fundamental functionalities when it comes to remote child security. And in addition, it fails in many other areas with nasty and stupid bugs.

Because most functionalities are not available in free version (and you must pay in order to get them) then think twice and read this article through, before you decide to give them your money. Even with 30-days money back guarantee program, this could be a wrong decision.

Configuration and usage issues

Before you even start your voyage with Qustodio, be sure that you will most likely meet sometimes very weird configuration issues.

General protection issue

I am using Qustodio on two devices with Android:

  • Motorola Moto E4 (Android 7.1.1),
  • TP-Link Neffos X9 (Android 8.1).

On second device, after using Qustodio for only 24 hours, I was already forced three times to enable (turn on) accessibility control for Qustodio. Because each time either Qustodio or something else is turning this setting off. Causing program to completely stop protection of given device.

You should never see such screen when using Qustodio on child device. I see it each and every hour.

When it comes to the first device listed (Motorola Moto E4 with Android 7.1.1) everything is perfectly normal. Accessibility control granted to Qustodio when installing child's endpoint works without any problems.

Time measuring issues

Very similar to above, my second device (TP-Link Neffos X9 with Android 8.1) is reporting time, device was used by a child, completely incorrectly. Look here:

Same time, same child, same device, two completely different measures.

I have installed Microsoft Launcher, as an addition to Qustodio, and it comes with a nifty widget showing actual time screen was on and device was used. In addition, I also measure real time my child spends on the device in given time. Thus, I was able to verify that above is happening.

Again, first device (Motorola Moto E4 with Android 7.1.1) measures time spent by my child very precisely and accurately (1-2 minute difference). So either Qustiodio has some problem with Neffos X9 device or with branded version of Android 8.1 installed on-board it.

Reporting issues

Third problem with TP-Link Neffos X9 and Android 8.1 is that device is constantly reported as being offline even though:

  • child is using it actively and,
  • other reports and stats clearly shows that device is in use.

For the third time this is Neffos X9-only or Android 8.1-only issue. Second device (Moto E4 with Android 7.1.1) works again perfectly in this area.

Serious location issues

In Qustodio you can view location via two different ways:

  • Your Family > pick a child > Activity Timeline,
  • Your Devices > pick a device > Last Location.

Even though location is updated (too many times -- see below) in Your Family, I always (I mean... always) see "Updating location..." message in Your Devices. And, for past 24 hours, I have never seen an actual address instead in that place.

You can even force-refresh location in family and still see "Updating..." in devices.

There's a very cool feature called Family Locator, which shows you location of all your protected devices in single map view. For some weird reason it is available only in Android (and maybe iOS). No such feature in web version of Qustodio.

By default location is updated once... per hour. Which is a complete joke and misunderstanding when it comes to child security issues. You have to dig through configuration to reduce this value. 5 minutes is a minimum.

Bugs

Each of above (and below) issues can, of course, be considered a bug. But, I found one really specific to give it a separate section.

Suppose following scenario:

  1. Login to Qustodio through web.
  2. Leave your browser open and Qustodio tab active.
  3. Let your computer go to auto screen-lock, sleep or hibernation.
  4. Wake it up.
  5. Click anywhere or try to do anything in Qustodio.

Time before your computer goes sleep etc. is most likely enough time for Qustodio to invalidate current user session and require it to login again. Very basic security functionality, known in most services across the Internet.

Pity thing is that Qustodio web panel isn't able to detect correctly such situation in above scenario. Instead of redirecting you to login screen, it will "hang" itself showing you dimmed page overlay and spinning "please wait" loader... forever.

You have to refresh page (best scenario) or restart browser and visit Qustodio again (worst scenario) in other to see login screen and then regain access to web panel.

I cannot find words to express this -- redirecting to a login screen after current user session was invalidated is the most fundamental feature of each and every serious security layer in each and very serious web service. Having Qustodio failing on this makes me question whether there are morons hired as system architects there? Or maybe funds for QA departament are already exhausted and nobody is testing new releases of Qustodio.

Missing obvious features

Most of these features are available out-of-the box in other child protection and monitoring solutions available in the market. Even in free ones. Unfortunately, even though Qustodio is one of the most expensive of them, it is missing many obvious and must-have features!

Absolutely no child device's battery support

A child's device with a dead battery is obviously a completely useless device for you. It does not report anything, you cannot locate your child etc. Sounds obvious?

Well... not for Qustodio designers and managers since this parental control solution comes with absolutely not battery support for child or otherwise controlled devices. You cannot remotely check battery charge level of a device in question and -- of course -- you're getting no alerts that battery level is very low and that particular device can turn itself off and become uncontrollable relatively soon.

I've put this fuckup at the top of the list, because even if all other missing features below would be eventually fixed, without the feature of checking remote device battery charge level, any serious child control is just as fake as it can be.

This feature is, of course, available in all other products, like for example in already mentioned Kaspersky Safe Kids (that I've been using previously).

No PIN lock for parent's app

There is absolutely no PIN or other means of securing parent endpoint on parent's device. Nobody at Qustodio's design team ever even thought about such an obvious feature. Which is available in most of other solutions on the market.

If your child ever gets access to your phone (i.e. while you're having an afternoon nap), they're able to change anything in terms of settings or configuration of Qustodio, because access to Qustodio Parent Control app isn't secured in any way.

If you want to do the same on PC or Mac you have to bypass Windows or MacOS screen locker, which requires you to provide PIN or password in usual scenarios. When it comes for Android app -- no such thing.

No time-controlled security lift-off

When I had child's device secured with Kaspersky Safe Kids I could lift-off that security for a given period of time (let's say half an hour). For example -- my child has access to Google Play store forbidden, but I could lift-off Kaspersky security in order to allow her to look for a new apps for a certain period of time.

In Kaspersky, all I had to do was to provide a password and set time. After that, I could easily forget about everything, because Kaspersky was re-enabling its full control over child device after given period of time has passed.

No such thing in Qustodio. You must always remember to bring control back.

No manual application addition

You cannot add an application that you wish to block manually. Simply like that -- there is no such functionality.

Each and every child must actually run each and every application on each and every device in order for it to appear in Qustodio "Games & Apps" section. Only then you can decide whether child can have:

  • full access,
  • time-limited access,
  • no access.

I can imagine someone designing such functionality without an "Add" button!

Due to above design, you will be in the very beginning actually bloated with Qustodio notifications:

  • each of your children,
  • on each of their devices,
  • using each of their applications

will generate a separate Qustodio notification in your parent app, asking you to set limits etc. for it. Imagine such madness.

There's also a bug here. It seems that using applications on Windows for the first time generates absolutely no notifications in Qustodio for parents.

Stats per child

All the stats are reported and gathered per child, not per device.

If you remove given device or Windows account (because it does not belong to a child -- see below) then all the stats "captured" by this device will still stay reported for corresponding child. Making a total mess in stats.

Separate app for texts and calls

In order to monitor your child's calls and text messages you must install a separate application, available only through Qustodio website.

The official explanation is that this is dictated by the recent change in Google Play policy. The truth is that an app offered outside Google Play store isn't guarded by anything that Google Play store offers (namely, licensing, terms & conditions etc.). I don't know like you, but for me this stinks all the way with the monitoring of my activity by Qustodio or its partners without Google having an ability to check this.

In some magical way Kaspersky Safe Kids doesn't need a separate application for text messages and calls monitoring and can offer such functionality in an application that is shipped through Google Play.

Design fuckups

In addition to many configuration issues, bugs and missing features there are a lot of things in Qustodio that has a really weird design. Far away from what modern UX books claims and from what other apps offers.

Is it blocked or not

Qustodio design is in general far from perfection and in many place you will be asking yourself what is a particular configuration switch actually doing -- is it allowing or disallowing certain things.

Consider following screen:

Application control is far from being obvious in Qustodio

Now, I don't know like you, but for me it was very not obvious whether enabling given switch will block particular application or give a child actual access to it (turned out that you "enable" apps that you want to block).

Same application on different devices

There is another bug or design issue here.

If you have the same application (here: Chrome) on more than one device (Android and Windows in my case) then you will see it in above view titled with the first device that reported its usage (Windows in my case)... and there will be no separate entry for other devices (Chrome on Android in this case).

Making you not able to set separate restriction rules for the same application on separate devices.

What blocking really means?

When it comes to blocking something (base in child control) the look at this screen:

Now, tell me children... what does "Block" is for here?

So, we have a huge knob here that allows us to set a daily limit for Sundays. We can set it from 00:00 to 24:00 hours. But... what the "Block" button is for?

When tapping it for the first time, knob becomes red. When tapping it again, it returns to above look & feel and sets itself to 24:00 (ignoring what you have set before -- another bug). And... that's it. Nobody know what does "blocking" here means? And how is it different from setting the knob to 00:00 (meaning no time limit for given day which effectively means... blocking?).

To ignore or to not ignore?

When it comes to web content ignoring you have two approaches:

  • ignore every page assigned by Qustodio to a given category (i.e. porn) and
  • in addition -- add particular website exception.

If you operate on categories then nearly everything is OK. There is a possibility to:

  • allow access to all pages in given category,
  • alert you that any page within given category was accessed,
  • block child from accessing any page in given category.

And here is a corresponding screenshot:

Nearly, because nobody has a damn idea (and of course -- there is no information here) whether "alert" means "allow, but alert" or "block and alert"? Another stupid design fuckup.

But... when it comes into defining single page exceptions then magic happens:

Because you now have another option of "Ignore".

And another question to above -- what does "Ignore" do? Or how does it differ from "Allow"? Because, if you ignore given page then it means that you don't care about it and allow child to access it, right? But, then why do you have to add an exception? And what, in the hell, it means in general that you are adding an exception only to ignore it? What is "ignored exception"?

Too many location updates

Consider following screen. There is a design issue and a bug here:

Five location update reports per 70 minutes?

Design issue: You should never report twice of more time the same data!

If (in above example) location for the same child and device hasn't changed during given period of time then by no means an application should create five separate reports in this case. UX design guidelines are perfectly clear here -- in such scenario there should be only one location update report with the latest hour only.

Bug: In addition, there's a functionality bug here, because I have configured Qustodio to update location each and very 5 minutes. So, if designers want to show every location update then I should see fourteen reports here (70 minutes time period / 5 minutes frequency setting).

Poor Windows accounts separation

When you install Qustodio on Windows 10 with many user accounts (i.e. separate for you and your child) you can, of course, configure it to report activity only for selected account. But there is absolute no guide or instruction, in neither Qustodio for PC or web panel, on how to achieve this.

I managed to find this configuration by a total accident.

You have to go to Your Devices, pick a device corresponding to your PC with Windows and click a tiny arrow next to your child to unfold details. Only then you can assign a particular account to a particular child or leave it unprotected.

Before I managed to figure this out, I had accounts for my wife and mine reporting activity for our children, causing an absolute mess in stats.

This is a big design issue. When installing (or actually: trying to install) Qustodio for PC for the second account (I was more than sure that you must install it separately for each account) I only got an error saying that it is already installed (computer-wide instead of per-user). While I should see a clear instruction on where to go and what to click in order to assign given Windows account to another Qustodio child.

Poor configuration blocking functionality

Last and small, but still annoying.

Qustodio give you an option to protect configuration (with password) of the controlled device or not. If you choose to not protect it then still some obvious parts are protected -- for example: uninstalling Qustodio or stopping some system application is not allowed.

If you child tries to do such thing then two things happens:

  • instead of going back to previous screen you're kicked-off to the home screen,
  • often you see... default Android launcher, not the launcher you're actually using.

Second one is an obvious and yet another weird bug. Qustodio, when blocking access to some sensitive area causes launcher to somehow turn off itself or become unstable. You have to hit Home button once or more to actually see a launcher of your choice, i.e. the one you're using on daily basis.

First one is a bad design fuckup. Simple like that. Imagine that you're digging some deeply in configuration (which -- by the choice of your parents -- isn't protected with password and you have access to it). Suddenly, and most likely by a mistake, you touch something "illegal" and you're kicked off to the home screen. You have to dig your way back to the screen you were again.

Summary

Qustodio Premium Support (November 24th update)

You could call the whole article a total mistake. You could say that:

  • it shows a private perspective only,
  • I am expecting way too much (even though Kaspersky has it all),
  • I could rise a support tickets to request new features or bug fixes.

Right?

Well, them... let me tell you something about Qustodio Premium Support...

I have risen around six or seven support tickets. I don't exactly remember right now. Anyway, after last one I started writing this article, because rising more support tickets become pointless -- I'd end up rising hundred of them.

In the past whole week (Sunday-Sunday) that has lasted since initial publication of this article and since I've created all the support tickets, Qustodio Premium Support managed to answer one (!) out of six or seven tickets. And even for that one, they answered it partially, because all that they had to say was that the issue was consulted with their developers and waits for an internal answer.

They've totally ignored or failed to answer to even as simple questions as how to use this or that feature.

If that is what Qustodio calls a premium support then I don't even want to think what free support is.

I don't recall any other paid solution in my whole life support that failed to answer 80% of my support tickets. That's a joke, not a serious business.

Raw numbers

Even if there would be no issues with Qustodio then numbers are simply killing it:

  • Qustodio costs 55 USD per year (per smallest premium license) and
  • it allows you to add up to 5 children and protect up to 5 devices,
  • Kaspersky costs... 15 USD per year (there's only one license type) and
  • it allows you to add unlimited number of children and unlimited number of devices.

So it is 3+ times less for much, much more.

Even though Kaspersky has a lot of issues as well, it at least works (doesn't un-protect device by itself) and it has all the most obvious features that Qustodio doesn't have. I've been using it for past year and I am going back to it. Qustodio is, by no mean, a match to that solution.

Leave a Reply