Geolocation can be faked. Not every phone has biometrics but even if it does, it provides little practical security value in this case. It's unlikely that some

Geolocation can be faked. Not every phone has biometrics but even if it does, it provides little practical security value in this case. It's unlikely that someone will share their phone but in case they are inclined to do so, what will prevent them from enrolling a classmate as a guest user? Posting/scanning QR/OTP codes and authenticating users is logistically inconvenient and time consuming for both teacher and students. QR/OTP can be photographed and sent to classmates that are not present. An easy and nearly foolproof circumvent is to simply setup an empty/spare phone that can be passed to a classmate to use for logging you in. Last but not least, it may not be legal to *require* a battery draining app installed on student's phones. Bottom line --- It's difficult if not almost impossible to implement strong security using only devices that others control.