6 ms·

> or having to use that same crap spyware that schools use to lock down your computer by essentially rooting it. The most extreme one I’m aware of is “Lockdown

> or having to use that same crap spyware that schools use to lock down your computer by essentially rooting it. The most extreme one I’m aware of is “Lockdown Browser” and the student who lives with me has effectively rendered it useless. Students use MST with DisplayPort to mirror a monitor in a way such that the OS cannot see that two monitors exist. (I don’t think there’s a windows API for LDB to see this? Could be wrong) Anyways, one student faces the other, each looking at a mirrored display, one student out of view of the webcam. Then a microphone with a hardwired switch soldered in which, again, doesn’t alert the OS that a microphone has been disconnected, is switched off. Then student 2 can freely speak at the student taking the test and announce all the answers. The test taker is able to keep their eyes on the monitor at all times (so eye tracking won’t show anything weird). If I were black-hat enough to lead a product like lockdownbrowser, I would beat this technique by looking for electrical hum frequency signatures in the audio feed which can pinpoint what time the audio was recorded due to fluctuations in the grid electricity. https://en.m.wikipedia.org/wiki/Electrical_network_frequency_analysis https://en.m.wikipedia.org/wiki/Electrical_network_frequency... If there is zero audio waveform, that would be a flag for review. If the cheater attempts to loop pre-recorded audio, it will be noticeable that the ~60hz frequency signature is “wrong” for the time that the test was being taken. This would then in turn be defeated by the cheating student running a remote microphone to a quiet room which can be switched to. I’ve put a lot of thought into this and no matter what, the cheater eventually wins given infinite cat-and-mouse iterations. But most would be caught somewhere along the way.

jackblemming 4y ago
The solution is to trust the people you hire, treat them with respect and decency. And when they start and don't know what a for-loop is because they obviously gamed the process, you fire them. It's really that simple. If people complain it's impossible to fire anyone, that's the issue. The solution isn't to implement an insane anti-cheat hiring pipeline that will drive away competent people.
- wodenokoto 4y ago
  A common estimate is that the hiring process costs a year of salary. You kinda want to nail it and not have too many do-overs, even if firing is easy.
  - thaumasiotes 4y ago
    > A common estimate is that the hiring process costs a year of salary. To do what? Why would the cost of hiring scale with the salary of the position?
    - haimez 4y ago
      The cost of time from the interviewers is likely to be more expensive since you have senior people interview candidates for senior roles.
      - cornholio 4y ago
        If you spend an entire man year in senior productivity to vet a single employee, perhaps that's the problem then? I have often seen this problem explained (for example by Paul Graham) that a bad employee is a negative value, they make bad commits and stupid decisions that net out as a massive negative for the company. But it seems very counterproductive to try to solve this problem at the selection moment using stupid proxies such as leetcode memorization, instead of during the trial period, when the employee is, you know, interacting with your company.
    - mike_hearn 4y ago
      Recruiters work on commission and usually charge a fraction of the salary, because a higher paid role is harder to recruit for.
  - nscalf 4y ago
    The situation OP is describing would drastically cut costs by not filtering out good employees who are either bad test takers, having an off day, or didn’t have an “ahh ha” moment early enough in the evaluation.
- sdwr 4y ago
  (As a non-cheater), cheating is an honest signal to some extent. Someone who sets up a second setup, disables their mic, has an accomplice, etc, is going above and beyond to get to the goal. It's the lazy cheating that's really disappointing.
weq 4y ago
Thanks for the advice - this is a cool technique and yeh im ex defence! its funny as this remote-video stuff is hardly ever reviewed by the clients anyway in my experience, that this stage in its maturity they use it basically as a bluff. Dont discount the use of manual reviews though, our software would pickup anomolies if your moving your mouth constantly. We have organised crime targetting our events, they have done things like infiltrate IT departments and trojen horse PCs. For high-stakes, we advise clients that in person inviligation in combination with LDBs is the safest way with a freshly provisioned SOE. If you want to make this your job, work remotely and like C#, u can find our careers page with this hint: 3F27483F97C94ECF0C8F11148FBBD048DFFCDECBE5C62FA23076297AE804F6C6 Send us an unsolicated resume and say ur from HN LDB
- ozfive 4y ago
  Shrouq is that you?
  - rvnx 4y ago
    No I don't think it's him (without revealing the solution either). The person you found probably thought that SHA256 is enough to obfuscate customer names and didn't know that rainbow tables exists.
indrora 4y ago
> Students use MST with DisplayPort to mirror a monitor in a way such that the OS cannot see that two monitors exist. (I don’t think there’s a windows API for LDB to see this? Could be wrong) I have a cheap $50 capture card that is untraceable. My $75 HDMI mux has hdcp stripping and EDID pass through. I use these for streaming video games and this is a pretty standard set of kit. The only way to discover this is hoping that custom control commands are passed through to the monitor. OEMs use these to give you access to the OSD options from the operating system, such as a crosshair at the center of the screen for gamers, on when their game is running but off when it exits. > This would then in turn be defeated by the cheating student running a remote microphone to a quiet room which can be switched to. Honestly, most of the noise comes from the pickup. Using a simple switch to ground will still allow that hum through. You can also just loop a power cord around the mic line a few times and "actively" induce that noise. My headset makes a terrible warbling modulated at a frequency of 1/120th hz from the bad isolation in my KVM's power supply. No, a far lower tech option exists: more and more Console gaming targeted headsets like those from Steelseries include an aux in, which can easily be used for the snitch. Egg cartons for sound dampening and impromptu vocal booth and you're well on your way to defeating any technological measure.

jackblemming 4y ago

The solution is to trust the people you hire, treat them with respect and decency. And when they start and don't know what a for-loop is because they obviously gamed the process, you fire them. It's really that simple. If people complain it's impossible to fire anyone, that's the issue. The solution isn't to implement an insane anti-cheat hiring pipeline that will drive away competent people.

wodenokoto 4y ago
A common estimate is that the hiring process costs a year of salary. You kinda want to nail it and not have too many do-overs, even if firing is easy.
- thaumasiotes 4y ago
  > A common estimate is that the hiring process costs a year of salary. To do what? Why would the cost of hiring scale with the salary of the position?
  - haimez 4y ago
    The cost of time from the interviewers is likely to be more expensive since you have senior people interview candidates for senior roles.
    - cornholio 4y ago
      If you spend an entire man year in senior productivity to vet a single employee, perhaps that's the problem then? I have often seen this problem explained (for example by Paul Graham) that a bad employee is a negative value, they make bad commits and stupid decisions that net out as a massive negative for the company. But it seems very counterproductive to try to solve this problem at the selection moment using stupid proxies such as leetcode memorization, instead of during the trial period, when the employee is, you know, interacting with your company.
  - mike_hearn 4y ago
    Recruiters work on commission and usually charge a fraction of the salary, because a higher paid role is harder to recruit for.
- nscalf 4y ago
  The situation OP is describing would drastically cut costs by not filtering out good employees who are either bad test takers, having an off day, or didn’t have an “ahh ha” moment early enough in the evaluation.
sdwr 4y ago
(As a non-cheater), cheating is an honest signal to some extent. Someone who sets up a second setup, disables their mic, has an accomplice, etc, is going above and beyond to get to the goal. It's the lazy cheating that's really disappointing.

weq 4y ago

Thanks for the advice - this is a cool technique and yeh im ex defence! its funny as this remote-video stuff is hardly ever reviewed by the clients anyway in my experience, that this stage in its maturity they use it basically as a bluff. Dont discount the use of manual reviews though, our software would pickup anomolies if your moving your mouth constantly. We have organised crime targetting our events, they have done things like infiltrate IT departments and trojen horse PCs. For high-stakes, we advise clients that in person inviligation in combination with LDBs is the safest way with a freshly provisioned SOE. If you want to make this your job, work remotely and like C#, u can find our careers page with this hint: 3F27483F97C94ECF0C8F11148FBBD048DFFCDECBE5C62FA23076297AE804F6C6 Send us an unsolicated resume and say ur from HN LDB

ozfive 4y ago
Shrouq is that you?
- rvnx 4y ago
  No I don't think it's him (without revealing the solution either). The person you found probably thought that SHA256 is enough to obfuscate customer names and didn't know that rainbow tables exists.

indrora 4y ago

> Students use MST with DisplayPort to mirror a monitor in a way such that the OS cannot see that two monitors exist. (I don’t think there’s a windows API for LDB to see this? Could be wrong) I have a cheap $50 capture card that is untraceable. My $75 HDMI mux has hdcp stripping and EDID pass through. I use these for streaming video games and this is a pretty standard set of kit. The only way to discover this is hoping that custom control commands are passed through to the monitor. OEMs use these to give you access to the OSD options from the operating system, such as a crosshair at the center of the screen for gamers, on when their game is running but off when it exits. > This would then in turn be defeated by the cheating student running a remote microphone to a quiet room which can be switched to. Honestly, most of the noise comes from the pickup. Using a simple switch to ground will still allow that hum through. You can also just loop a power cord around the mic line a few times and "actively" induce that noise. My headset makes a terrible warbling modulated at a frequency of 1/120th hz from the bad isolation in my KVM's power supply. No, a far lower tech option exists: more and more Console gaming targeted headsets like those from Steelseries include an aux in, which can easily be used for the snitch. Egg cartons for sound dampening and impromptu vocal booth and you're well on your way to defeating any technological measure.