3 ms·

I am a lector at a University and would never force my students to install something that is so privacy invading as Proctorio on student's own computers. If yo

by sireat 6y ago

I am a lector at a University and would never force my students to install something that is so privacy invading as Proctorio on student's own computers. If you absolutely need this type of monitoring it should be done at some sort of testing center on cleanly imaged computers. I could see it being done for something absolutely crucial such as a bar exam. Proctorio and its ilk should not be used for simple mid-terms or even finals. This monitoring software becomes a huge crutch to lazy administrators and teachers. I should know I am lazy too. PS While we are on the slippery slope, if Proctorio becomes standard we rapidly head to Snow Crash situation where federal jobs were heavily monitored. Already many freelancer sites use screenrecording software.

christophilus 6y ago
> I could see it being done for something absolutely crucial such as a bar exam. Why? How did we ever produce lawyers in the past without Proctorio?
- mkl 6y ago
  In person exams. In a pandemic, that can be a problem.
- elliekelly 6y ago
  The legal profession's dirty little secret is that the bar exam doesn't really matter. It's little more than a rite of passage and a good excuse for law firms to wait before bringing in the needy newbies before the summer associates have left. Cheating on the bar exam would present a serious character and fitness issue but not having the requisite knowledge to pass the bar exam would not at all impact a person's ability to practice law.
mkl 6y ago
If you have a testing centre you don't need this kind of software, and if your students are scattered across the world due to Covid-19 travel restrictions, you can't have a testing centre for them. I consider invigilation absolutely crucial in a professional engineering degree in mid-terms and finals (engineers are more likely to hurt more people than lawyers). I don't think this kind of software is a crutch for the lazy; it's more work to organise and manage than human invigilators, and doesn't scale as well. I don't think it's a slippery slope. We will have significantly more local students than remote for the foreseeable future, and the local students are invigilated in person. We have students wanting to opt into remote study, including using this software, but so far if they're local we tell them no (except under extreme circumstances).
- sireat 6y ago
  We will have to agree to disagree then. The whole term invigilation is a bit dystopian. It is a huge slippery slope because this privacy invasive software ends up being used for such mundane things like weekly quizzes. Do you really want to live in the future/present where we have to submit ourselves to daily monitoring? How about adding some monitoring via sensors of performance boosting substances? My answer is that such monitoring software should be only used under exceptional circumstances on neutral computers - my example was a testing center with insufficient human supervision.
  - mkl 6y ago
    I think you're extrapolating way too far, and hence your arguments aren't hitting the mark. The total amount of invigilation in the entirety of each course I'm involved in is 3-5 hours. This has been the case for many decades. This year, for some students, it is aided by software, due to the fact that they're unavoidably thousands of kilometres away. It is not a slippery slope, and none of your dystopian ideas seem like they could result from it. This kind of software does not monitor computer use outside of the test. It monitors the student during the test, like a human invigilator (yes, it's recorded, so not identical). During the test, the student is only working on the test, which is not private or secret. When the test is finished, the software exits. I don't see how you could have the resources for an infrequently used testing centre, but not enough to pay one person for an hour or two. That is not what this kind of software is useful for.
    - oxylibrium 6y ago
      > During the test, the student is only working on the test, which is not private or secret. You fail to consider the circumstances in which the test takes place. Students take the test in their personal spaces, and earlier in the thread, you mentioned essentially inspecting a student's living space (...angle of camera, light, checking environment, etc...) "Checking environment" is really just a cold, "process" word for inspecting a student's living space. A student's room can often have private or secret things about them. Before you ask, not every student has the privilege to use a separate, clean, blank room to take tests. A personal space is inevitably going to have personal, private things. I've brought this up before; I personally know friends who were outed to professors as trans because their personal space has things like needles - and then you even have stuff like naive professors assuming "drugs" when its really just medications. It could be anything else besides that, in fact - calendars with things scribbled on them; family photos; posters for political organizations; if you look in someone's bedroom, you're inevitably going to find out things about them that they would rather you not know. Would you take your students on a tour of your bedroom while you're teaching an online class? EDIT: In addition, there's non-traditional students and high risk students, and interruptions in general - there's not _only_ a test going on - I've had someone from my family interrupted in the middle of an exam because someone from the government knocked the door to take our temperatures and ensure we're healthy and don't have COVID. There's always more things going on, too.
jonathanstrange 6y ago
I hope that some security researchers investigate this software more closely and at the same time suspect that this lawsuit is primarily intended to scare away people from doing precisely that.
- oxylibrium 6y ago
  "Security researcher" here: Proctorio's "zero-knowledge encryption" claims were in name only, pretty much. TL;DR Canvas and Moodle use incrementing integers for both user ID and quiz ID. Proctorio's "zero-knowledge encryption" has a shared key derived from the two IDs; they store the user ID, so that's effectively a single PIN. With their older settings, you can brute force a quiz ID in a couple hours at most. They increased the time cost for the brute force to now take days/weeks, but that's still peanuts and the attack scales really well, because most exams take place at the same time (students start/end at similar times), so once you crack the quiz ID for one record, that's tens-hundreds of records; and since IDs are just increasing numbers, once you find the lower bound, working your way upwards is much easier. They also added an option for universities to use PGP keys - but that involves training faculty, or manual setup. For more details, here's my blog article: https://proctor.ninja/wave-rake-proctorio https://proctor.ninja/wave-rake-proctorio

by sireat 6y ago

christophilus 6y ago

> I could see it being done for something absolutely crucial such as a bar exam. Why? How did we ever produce lawyers in the past without Proctorio?

mkl 6y ago
In person exams. In a pandemic, that can be a problem.
elliekelly 6y ago
The legal profession's dirty little secret is that the bar exam doesn't really matter. It's little more than a rite of passage and a good excuse for law firms to wait before bringing in the needy newbies before the summer associates have left. Cheating on the bar exam would present a serious character and fitness issue but not having the requisite knowledge to pass the bar exam would not at all impact a person's ability to practice law.

mkl 6y ago

If you have a testing centre you don't need this kind of software, and if your students are scattered across the world due to Covid-19 travel restrictions, you can't have a testing centre for them. I consider invigilation absolutely crucial in a professional engineering degree in mid-terms and finals (engineers are more likely to hurt more people than lawyers). I don't think this kind of software is a crutch for the lazy; it's more work to organise and manage than human invigilators, and doesn't scale as well. I don't think it's a slippery slope. We will have significantly more local students than remote for the foreseeable future, and the local students are invigilated in person. We have students wanting to opt into remote study, including using this software, but so far if they're local we tell them no (except under extreme circumstances).

sireat 6y ago
We will have to agree to disagree then. The whole term invigilation is a bit dystopian. It is a huge slippery slope because this privacy invasive software ends up being used for such mundane things like weekly quizzes. Do you really want to live in the future/present where we have to submit ourselves to daily monitoring? How about adding some monitoring via sensors of performance boosting substances? My answer is that such monitoring software should be only used under exceptional circumstances on neutral computers - my example was a testing center with insufficient human supervision.
- mkl 6y ago
  I think you're extrapolating way too far, and hence your arguments aren't hitting the mark. The total amount of invigilation in the entirety of each course I'm involved in is 3-5 hours. This has been the case for many decades. This year, for some students, it is aided by software, due to the fact that they're unavoidably thousands of kilometres away. It is not a slippery slope, and none of your dystopian ideas seem like they could result from it. This kind of software does not monitor computer use outside of the test. It monitors the student during the test, like a human invigilator (yes, it's recorded, so not identical). During the test, the student is only working on the test, which is not private or secret. When the test is finished, the software exits. I don't see how you could have the resources for an infrequently used testing centre, but not enough to pay one person for an hour or two. That is not what this kind of software is useful for.
  - oxylibrium 6y ago
    > During the test, the student is only working on the test, which is not private or secret. You fail to consider the circumstances in which the test takes place. Students take the test in their personal spaces, and earlier in the thread, you mentioned essentially inspecting a student's living space (...angle of camera, light, checking environment, etc...) "Checking environment" is really just a cold, "process" word for inspecting a student's living space. A student's room can often have private or secret things about them. Before you ask, not every student has the privilege to use a separate, clean, blank room to take tests. A personal space is inevitably going to have personal, private things. I've brought this up before; I personally know friends who were outed to professors as trans because their personal space has things like needles - and then you even have stuff like naive professors assuming "drugs" when its really just medications. It could be anything else besides that, in fact - calendars with things scribbled on them; family photos; posters for political organizations; if you look in someone's bedroom, you're inevitably going to find out things about them that they would rather you not know. Would you take your students on a tour of your bedroom while you're teaching an online class? EDIT: In addition, there's non-traditional students and high risk students, and interruptions in general - there's not _only_ a test going on - I've had someone from my family interrupted in the middle of an exam because someone from the government knocked the door to take our temperatures and ensure we're healthy and don't have COVID. There's always more things going on, too.

jonathanstrange 6y ago

I hope that some security researchers investigate this software more closely and at the same time suspect that this lawsuit is primarily intended to scare away people from doing precisely that.

oxylibrium 6y ago
"Security researcher" here: Proctorio's "zero-knowledge encryption" claims were in name only, pretty much. TL;DR Canvas and Moodle use incrementing integers for both user ID and quiz ID. Proctorio's "zero-knowledge encryption" has a shared key derived from the two IDs; they store the user ID, so that's effectively a single PIN. With their older settings, you can brute force a quiz ID in a couple hours at most. They increased the time cost for the brute force to now take days/weeks, but that's still peanuts and the attack scales really well, because most exams take place at the same time (students start/end at similar times), so once you crack the quiz ID for one record, that's tens-hundreds of records; and since IDs are just increasing numbers, once you find the lower bound, working your way upwards is much easier. They also added an option for universities to use PGP keys - but that involves training faculty, or manual setup. For more details, here's my blog article: https://proctor.ninja/wave-rake-proctorio https://proctor.ninja/wave-rake-proctorio