Using Gertrude
Getting Started
There are a handful of things you need to do to get up and running with Gertrude. This tutorial is meant to walk you through the required steps, and also to give you a bit of practice using all of the core features of Gertrude.
NOTE: If you'd prefer to watch a step-by-step video showing all aspects of getting started with Gertrude, click here.
Setting up your admin account
To start out, if you haven't already created a Gertrude account you'll need to do that first. To create an account click this link and follow the sign-up instructions. The first 60 days are totally free and you can cancel at any time.
Creating your first user
Once you have your Gertrude account created you'll probably want to start by creating at least one user. A "user" in Gertrude represents someone that you want to protect. This is very often one of your own children if you are a parent using Gertrude to protect your kids. You'll need at least one user to do anything useful with Gertrude.
The most common scenario is for Gertrude to be used by parents protecting their kids. But that's definitely not the only way to use Gertrude. Peers, friends, relatives, etc., can all be protected, but for the sake of brevity, we use the language of parent/child for most of our documentation.
To create a user, click the link in the dashboard of your Gertrude web admin account, or select "users" from the side bar on the left hand and click the button to add a new user.
Enter the users name, and click to save the new user.
Monitoring user activity
While you are creating your first user, you can also set up monitoring if you wish. Gertrude allows you to see everything your users have typed and also can take periodic screenshots of your users screens for you to review later. You can always change these settings later, but we recommend enabling them for the greatest safety, and also because it will help you learn about all of Gertrude's features as you work through this tutorial.
Keychains & Keys
Keychains
Near the bottom of the screen is a section that allows you to attach what we call "keychains" to your user. One of the main features of Gertrude is that it acts as an internet filter for your users Mac computers. Gertrude's filter blocks the entire internet, only allowing access to the sites and apps you specifically designate as safe.
Almost every other internet safety app which filters the internet works by blocking categories of websites. This sounds like a great idea in theory, but in practice the internet is just too large and growing too fast for this to be truly safe. Tens of thousands of new websites are being created every day. No one can possibly keep a list up-to-date enough to make blocking categories actually safe in practice.
Keys
The way you unblock part of the internet for your user is by granting them what we call a "key". A key either a) "unlocks" a single website, or b) grants a single app access to the internet. These keys are organized into groups called "keychains", and it's here on the user screen that you have the ability to add keychains to your user.
Until you add at least one keychain your user will have no access to the internet whatsoever while Gertrude's filter is enabled.
Creating your first key
You haven't created any of your own keychains yet, so currently the only keychains you can attach to this new user are publicly available keychains. We'll talk more about those later, but for now let's practice by setting up your own keychain with a single key.
Creating a new keychain
Either click the "create keychain" button in the popup shown in the image above, or alternatively you can click over to the Keychains screen from the left-hand sidebar, as shown below:
Click the add keychain button, then give your keychain a name, and optionally a description. Once you've named your keychain click the "add a new key" button, and a screen will pop up allowing you to create a new key.
Two types of keys
There are two types of keys. The first, which is the most common, we call a website key. It allows access to a specific web address. For example, if your child has a specific online educational course or program that they access through a web browser, you could add a website key granting them access to just that program's website.
The second type of key is an app key. These keys allow you to grant specific applications full access to the internet. For instance, you could create an app key that allows only the Zoom app to bypass Gertrude's filter and have complete access to the internet. You should only do this with apps that are narrowly focused and that you are sure are safe for your children to use.
Creating and attaching your first key
For the sake of this tutorial, start by creating a single website key. Enter the address of a website that you want your user to have access to, and leave the rest of the options unchanged. If you can't think of a website to unlock, enter how-to-type.com, as we'll use that example later in the tutorial. Click "Create key" to finish the process.
Now that you've got a key and a keychain, you need to do one more step: attach that keychain to your user. Go back to the users screen, click to edit the user you created earlier, and then click to add a keychain. Select the keychain you just created by its name and save the user.
Connecting a device
The final step you will need to take before installing the macOS app is creating a new device for your user. To do so, click the "add device" button on the edit user screen. You'll see a pop-up giving you a special one-time connection code. Write this code down somewhere; you'll be using it shortly.
For the next part of the process you'll need to switch over to the computer that will be used by the child you're protecting. You might already be using that computer. But if you're a parent working through this tutorial on your own computer and your child uses a different computer you'll need that computer in front of you to do the next few steps of initial setup.
If you and your child share the same computer you'll be staying on the same device for the rest of this tutorial. You will however need to make sure you have separate macOS users—one for you, and one for your child.
Downloading the Gertrude macOS app
On the computer that will be protected, login to the macOS user that you desire to protect, then open a web browser, visit the Gertrude website download page, and click the download link to download a copy of the most recent version of the Gertrude macOS app. Double-click on the downloaded file and then drag the Gertrude application into the applications folder.
Next, double-click on the Gertrude application icon in the applications folder to launch it for the first time. Once Gertrude is launched, the only visible difference you'll see is that there will be a new icon in your menu bar, as shown below:
The first time you click this icon, Gertrude will prompt you to enter a connection code. Enter the connection code that you wrote down earlier. When you submit the code you should receive a confirmation that the Gertrude Mac app is successfully connected.
Enabling the internet filter
The next thing you need to do is to turn on Gertrude's internet filter. Getting the filter fully activated takes a couple of steps, because the operating system wants to make very clear to you that Gertrude has your permission to filter all the internet traffic on this computer. To begin the process of starting the filter, click the Gertrude icon again and then click the "Turn on" button as shown below:
At this point, the macOS operating system will block Gertrude from installing a system extension. Click the button labeled "Open Security Preferences", or manually open up the System Preferences app, and choose "Security & Privacy" > "General".
From the "Security & Privacy" > "General". screen, click the unlock icon to authorize, and then choose to allow the system extension from Gertrude.
As a final step, you should now see a prompt asking you if Gertrude can filter network activity.
Congratulations! Those steps are out of the way, and Gertrude has installed it's network filter. You won't have to repeat those steps again.
Exploring the Gertrude app
Next, let's take a few moments to explore the Gertrude app. Click the Gertrude app icon in the menu bar once again. You should now see that the filter is on. Some of the options in the drop-down menu are meant for your child to interact with, with one exception. The item labeled administrate is only for you as the Gertrude account owner.
The admin health-check screen
Click the "administrate" link now, entering your admin user and password to authenticate. You will see the Gertrude health check screen. This screen is meant to give you a glanceable overview of the Gertrude app, and to help you troubleshoot and fix common configuration issues.
Ideally, you should see all green checkmarks, although when you're first getting set up it's common to have a few issues that need to be addressed. Take a moment and review any items that are not green and resolve them.
Taking the filter for a spin
Next, I close the admin window and open up a web browser like Google Chrome or Safari or Firefox. If you try to visit an address on the internet, you will notice that the page does not load. That's because the filter is running and blocking the entire internet with the exception of the addresses that you have specifically unlocked. When Gertrude blocks something, you'll see an empty error page that looks something like this:
Earlier in this tutorial we created a website key. Let's test it now. Try to visit the website you specified when creating your first key. You should notice that your web browser does allow that page to load. This shows you that Gertrude's internet filter is working properly, that is, blocking all internet request except those that you specifically allowed.
If you look closely, the website above doesn't look quite right. That's because it often takes more than one key to get a site fully unblocked. Check out our unblocking guide for more details.
Techniques for unlocking websites
It's great to know that the Gertrude filter is working, but you probably need many more websites unblocked in order for the computer to be usable. In this section we will go over to techniques to make it simpler and faster for you to accomplish this.
Public keychains
The first technique is taking advantage of previously created public keychains. As we mentioned above, keys in Gertrude are always grouped into keychains. There are several reasons for this, but probably the main one is that it allows clusters of related keys to be easily shared and re-used. As an example, the website Art of Problem Solving (AOPS) is a widely used online educational platform. In order for it to work properly on a computer protected by Gertrude, it requires a handful of keys to unlock the web addresses used by that platform. There are thousands of students enrolled in AOPS classes. So it would be a shame if every Gertrude account owner had to re-create the same set of keys to grant access to AOPS. Instead, Gertrude offers a public keychain containing just the keys to unblock apps, which many people can share.
Adding a public keychain
To see how this works, let's temporarily add the AOPS keychain to your user. Go back to the computer where you set up and created your Gertrude account. Navigate to the Users screen and select the user you recently created. Click to add a keychain, and then search through the bottom section which lists public keychains, until you find the one for AOPS. Choose that keychain and save the user.
At this point, if you go back to the computer or user that is being protected by the Gertrude Mac app, you should be able to navigate to artofproblemsolving.com and it should load properly. This demonstrates the power and flexibility of using and sharing keychains.
You may want to spend a few minutes browsing through the list of publicly available keychains, you may find that one or more of them is useful to you. You'll also notice that some of the keychains are focused on unlocking a specific website or website-based programs, while others are focused on granting access to specific, narrowly focused applications like email clients or video conferencing apps.
You can also organize your own keys into keychains, but there is no requirement that you do so. Technically every key must belong to a keychain, but if you want, you can put all of the keys you create onto a single keychain. You may however find that it makes sense to you to also group your own keys topically. If you have multiple kids this can make it easier to mix and match and share keychains without causing more work for yourself.
Unlock requests
Probably the most common way to unlock parts of the internet for your protected users is by responding to a user-initiated unlock request.
Move back to the computer or user being protected by the Gertrude macOS app. Start by thinking of a website that your child needs access to that you currently don't have a key for. Try to visit that website in a web browser and you'll notice once again that it is blocked: Gertrude's filter is not allowing access to that website, because there is no key instructing it to.
If you're not sure what to practice unlocking, you could use khanacademy.org, a popular and free learning platform, which we use in the screenshots below.
Click the Gertrude app icon in the menu bar and select the item entitled View network traffic.
This brings up a window which shows you a live display of all the requests that the Gertrude filter is handling and blocking.
Sometimes the windows that are opened by the Gertrude app can be hard to find. They sometimes appear behind other windows or don't jump to the top of the screen like you would expect. So sometimes you need to hunt around just a little bit to find the window.
With the network requests Gertrude window open, refresh the blocked page in your web browser. You should see one or more new blocked requests flowing in to the Gertrude window.
Assuming we can find the right request (more on that in a moment), the Gertrude app allows us to then send an unlock request to have that specific website unblocked. Once you get used to this, it's common that this method becomes the primary way in which you create new keys for your users.
The unlock request flow
- A user tries to access a website on the internet, and are blocked.
- They open the network traffic window, and find the request that was blocked.
- They then send an unlock request to you, the admin, requesting that that website be unlocked.
- Then you, the admin, have the opportunity to review and approve or reject that request. You approve the unlock request by creating a key that unblocks that web address.
We'll walk through all four steps now, and we have a more detailed article with advanced tips and tricks on unlocking that you can refer to later, if necessary. Start by 1) clearing the requests to help you focus and find the correct request, then 2) click to filter by the partial word khan as shown below:
Next, try the page again, by hitting the refresh button in your browser. This should trigger another block, but this time we're ready for it, we've cleared away the noise and are filtering for blocks containing khan. You should see something like this:
To submit an unlock request for the block, click the small unlock icon, optionally add a comment, and then click submit.
Accepting an unlock request
Now that the unlock request is submitted, put back on your admin hat (you've been impersonating your Gertrude user for the last few minutes), and visit the home screen of the admin web dashboard. You'll notice that there is a new unlock request visible:
Click to accept the request, and you'll be taken to a screen where Gertrude recommends a key that will unlock the given request. You're free to stop and edit the key if you want, but for now, just click to "Select keychain":
You next get to choose which keychain the key should belong to—you only have one keychain, so select it and click submit.
Back on the computer running the Gertrude macOS app, you should see a notification that the unlock request was accepted.
And if you refresh the web page, you'll now have access to the previously blocked site.
You should spend a few minutes with each of your users, showing them how to identify blocked requests and send unlock requests. In our experience, kids of all ages pick it up pretty fast. Once you're in a groove, your protected users will send you unlock requests when they need something, and you'll be notified via email, text, or Slack, and can approve or reject from your own computer or phone, no matter where you are.
Filter suspensions
There are times when, for a short period of time, it's convenient to disable Gertrude's filter completely. Examples of these sorts of situations include when your child is taking an online test, or doing some unusual activity or research. In these cases it doesn't make sense to go through the work of creating keys or unlock requests because the websites they will be visiting won't be needed again. For times like this, you as the admin have the ability to remotely suspend the filter for a designated period of time, after which it will resume normal filtering.
If you have enabled monitoring of your user, all of their activity will continue to be recorded and uploaded for your later review. As long as your users know this, we've found that these temporary filter suspensions are very safe.
The suspend filter request flow
The way filter suspensions work is similar (although simpler) than unlock requests.
- one of your users submits a "suspend filter request" from the Gertrude macOS app.
- you (the admin) receive a notification via text message, email, or Slack
- the link in the notification takes you to a screen where you can accept or deny
To request that the filter be disabled, the user begins by clicking the "Disable filter temporarily..." option in the Gertrude menu dropdown.
The user is shown a form where they can fill out the length of time they wish to have the filter suspended, and optionally a comment explaining why the filter suspension is being requested.
Once submitted (provided you've configured an admin notification in your profile screen), you'll receive an email, text or Slack letting you know that your user is requesting a filter suspension. You can grant or deny the request, and if desired, also change the amount of time requested.
Reviewing user activity
If you elected to enable monitoring of your user, you will be able to review your users activity from within the Gertrude web admin. If you enabled key logging and screenshots as recommended in the beginning of this tutorial as recommended, you should already have a few items that you can review. To see how this works, login to your Gertrude web admin account and go to the users screen and select the activity link from the user you created.
You should see on the next screen that there are some unreviewed activity items. Click to view these and you will see a mixture of screenshots and text that was typed by the user.
Approving an item is essentially the same thing as deleting it. The idea is that an "approved" item does not need to be seen again. It's rare that you'll actually approve items individually—you'll notice when you have large amounts of items to review, that Gertrude gives you the option to approve them in chunks of one hundred at a time, and also you can approve an entire day at once at the bottom of the screen.
It's not absolutely necessary that you always meticulously review each and every activity item. But we strongly recommend that you at least review some of them so that you can periodically make comments to your kids about what you've seen and read while reviewing. The knowledge that they are being watched is one of the key components of what makes your users safe.
App Administrative Actions
Gertrude is built so that after the initial setup, you can manage your protected users from any computer, phone or device where you have access to the internet. However, sometimes it is convenient to do some basic administrative tasks directly on the your users' computer. For this reason the Gertrude app has some special protected admin-only options that you as the account owner can access and make use of when you wish. To access this screen, click the Gertrude app icon in the menu bar, then select "Administrate..." and supply your admin username and password.
On the left-hand side click the actions navigation item.
From this screen you may perform a number of admin-only actions, including:
- manually stopping, starting, or suspending the filter
- checking for Gertrude app updates
- testing out screenshot permission and resolution
- reconnecting to a different Gertrude user
- quitting the app
The Gertrude app helps you protect your kids online with strict internet filtering that you can manage from your own computer or phone, plus remote monitoring of screenshots and keystrokes. $5/mo, with a 60 day free trial.
Start free trial →