Question

I’m developing a feature for a client in which users voluntarily take an important test online. The test is difficult and the users will be highly motivated to do well (think SATs or GRE, etc)… so there’s also a high incentive to cheat. Apparently there are 3rd party services in which a human virtually monitors the test taker via a webcam, but they’re really expensive and we don’t quite have the budget. We still need to make it as hard as possible for a user to game the system. Some of the things we suspect they might try are:

• Getting someone else to take the test for them (a pinch hitter).

• Taking the test multiple times with different profiles to practice
  and gain an unfair advantage.

• Taking the test alongside friends or while in contact with a friends
  to tell them the answers.

The question order will change, as well as the order of the answers. The test will be timed, and an “open book” format, so we’re not really worried about the user looking things up online, but we can’t have them sharing their screen and having others assist them. So the main concern at this point is ensuring that the user is, in fact, who they say they are (and not someone else).

Here are a few of the security measures we’re considering:

• Requiring the user’s device to have a webcam, which we’ll activate and either record/photograph the user during the test (with the user’s consent of course).

• Asking users to verify an arbitrary bank deposit amount (presumably via PayPal). There’s nothing to stop them from opening up multiple bank accounts, but at least it’s a big hassle.

• Really scary terms of use that threaten legal action if the user is caught cheating.

QUESTION: Are there any other measure we can/should take to make sure our test is secure and the results are reliable?

CLARIFICATION: We realize that with enough resources and determination, any security system can eventually be beaten. The goal of this question is not to find a magically unbeatable solution, but to find ways to raise the stakes enough so that it won’t be worth it for most users to cheat. In this spirit, I’d much prefer answers that focus on what can be done as opposed to what can’t.

Answer 1

As you know there are many ways of cheating. Your goal is limit the possibility of cheating as much as possible. Cheating in online courses has been a hot topic.

• A pinch hitter:

This type of attack can be conducted a number of ways. Even if you have a cam looking at the person, the video that the test taker is seeing could be mirrored on another screen. A pinch hitter could see the question and just read him the answers or otherwise feed answers the test taker in a covert channel.

Possible counters to this attack is to also enable the mic to see if they are talking to anyone. You can also record the screen while they take the test. This could prevent them from opening a chat window or viewing other unauthorized content. (Kind of like the Elance tracker)

• user verification:

In order to register the person should attach a scanned copy of their photo-id. This way you are linking a photo of the person to a unique identifier, such as a drivers license number. Before the person starts taking the test, ask the user to look directly at the camera and make sure you get a good image of them that can be verified against their photo id.

A simple attack against this system is to use photoshop to modify the id. To make this attack more difficult you could verify their name against a credit/debit card transaction. The names should match on both cards.

An evercookie could be used to track machines to see if the same computer is being used. This could happen though legitimate reasons, but it could also be used to flag tests for further review. A variant on the evercookie is to drop a file with a random value or set a registry key with a random value to “mark” that machine.