News for hackers. Stuff that matters.
Re:On the efficacy of online proctoring using Proctorio (202... by liminalsunset on Tuesday September 06, 2022 @09:05PM (#32745197)
The purpose of these kinds of tools isn't to prevent cheating. Just like most DRM schemes, the purpose of these tools is the same as any other external consultant - so that the administration or people in charge of the school can offload the responsibilities related to any cheating that may happen to an external party, and if questioned, can respond that "reasonably secure technical measures have been taken to guarantee the integrity of the exam".

Whether the integrity of the exams is actually guaranteed is immaterial, because the company that made the nanny software went on the record and took responsibility, and/or by splitting the responsibility, the school admin and the nanny software vendor can point fingers at each other and the responsibility essentially disappears like it usually does.

You can see this with most other security theater type things. As long the "general public" is unaware that they have been lied to, they will accept this kind of positioning as gospel, and not look into it further. For the most part, as expected, the world turns around just fine without real security because systems tend to be robust to a certain level of bad actors doing selfish and small scale bad things like exam cheating, and as long as nobody's feelings are hurt, it's all fine.

Re:On the efficacy of online proctoring using Proctorio (202... by AussieWog93 on Tuesday September 06, 2022 @09:15PM (#32745256)
>Just like most DRM schemes ... offload the responsibilities

Funny you mention this. I remember a senior staffer at a large games publisher talking about this back in the late 00's.

He said, quite candidly, that all of the execs at EA, Activision etc. all knew that technology like SecuROM was incredibly ineffective at reducing piracy.

They all paid millions of dollars in licence fees to use it, though, so that they when an investor asked them what they were doing to protect their IP, they had a "good" answer.

Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @09:50PM (#32745480)
And in the movie world, look at Blu-ray. HDCP (for HDMI Cable Encryption), versions 1.4 (1080p) and 2.2 (4K). BD+ (a literal VM running on the player to correct intentionally erroneous data on the disc), AACS v1 and v2 (tons of keys, player keys, device keys, permanent revocation lists, even traitor-tracing), Cinavia (audio watermarking to detect whether AACS is present), and Drive Bus Authentication (no unauthorized players can talk to the drive).

AACS was supposed to last years. HDCP, indefinitely. BD+, the creators thought it would last a decade at least. Cinavia? They thought it would never be removable. Drive Bus Encryption? Almost impossible they thought.

All of these technologies were defeated about ~2 years after their introduction. Some had minor updates breaking things for a little bit, but were broken again shortly later. And some are only partially broken (not enough to make your own player), but in practice broken enough where you can rip the disc which is all most people want.

Re:On the efficacy of online proctoring using Proctorio (202... by bawolff on Tuesday September 06, 2022 @10:42PM (#32745781)
AACS did actually work pretty effectively. Keys were discovered and then revoked. You could play old disks but not new ones.

Similarly afaict there are some sketchy closed source programs to remove cinavia,but given we are a decade in, and there is no open source implementation/public description, i would say it lasted better than i would expect.

Definitely not a total success for DRM, but better than many people predicted.

Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @11:47PM (#32746114)
Well... no. Right now there are multiple software packages available from questionable sources that break AACS offline on-demand no problem. So... yeah.

As for Cinavia, if you shift the pitch of the music, you can cause the player to stop recognizing the track. Or, as some people have experimented with, you can compare the audio to a version of the film from alternative sources (i.e. streaming) to detect and patch over potential watermark signals. Or, well, burn a streaming rip to the disc instead of the disc encode.

Re:On the efficacy of online proctoring using Proctorio (202... by bawolff on Wednesday September 07, 2022 @12:31AM (#32746333)
> Well... no. Right now there are multiple software packages available from questionable sources that break AACS offline on-demand no problem. So... yeah.

Including disks with the latest MKB?

> As for Cinavia, if you shift the pitch of the music, you can cause the player to stop recognizing the track

Sure, but that distorts sound, which people dont like.

Like its definitely not totally blocking piracy by any means, but its certainly not totally defeated the way DVDs DRM was. Its still present enough to be a little annoying, which is much better than early predictions thought would happen.

Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Wednesday September 07, 2022 @01:16AM (#32746618)
> Including disks with the latest MKB?

AFAIK, it appears so. Also AACS LA appears to have given up and stayed on v68 for a few years now. Maybe there is a new one at last... maybe. AACS 2.0 it sounds like started from v72 and counting up.

> Sure, but that distorts sound, which people dont like.

True... but if I just burn a stream rip instead to the disc, problem solved. Plus most discs do not have Cinavia.

> Its still present enough to be a little annoying, which is much better than early predictions thought would happen.

From what I can gather... you can just download MakeMKV and rip Blu-rays on any PC Blu-ray drive, no problem, no internet connection required, latest MKB, BD+ completely defeated. It's only annoying if you are trying to actually copy the disc.

Re:On the efficacy of online proctoring using Proctorio (202... by hsbauauvhabzb on Tuesday September 06, 2022 @10:04PM (#32745564)
If you look at console copy protection, the controls are slowly getting better, presumably the same will happen with content control. I guess the key difference is console protection is about preventing the masses and content protection is about preventing any single failure.
Re:On the efficacy of online proctoring using Proctorio (202... by tshaddox on Tuesday September 06, 2022 @10:20PM (#32745654)
Content protection isn’t about preventing any single failure. The actual purpose of most video and audio DRM gets missed by a lot of people. The purpose is for content owners to exert control over device manufacturers and content distribution services. It’s completely irrelevant if anyone can easily go to a torrent site and download your movie. You still get to use the legal system to force device manufacturers and distribution services to do whatever you want them to do in order to be able to play your content.
Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @10:23PM (#32745669)
Not quite. If that were true, Blu-ray would have been quite happy with AACS. It had it all: key revocation, device-specific keys, blacklists, remote updates, it was plenty, and it even worked on the defunct HD DVD.

But they heaped on BD+ VMs, Cinavia watermarking, BD-ROM Mark, basically threw everything they had at the problem and hoped that something would stick. Movie studios actually say that Blu-ray supporting more DRM methods was actually a major reason they chose Blu-ray over HD DVD (which didn't support BD+, which supposedly was DRM designed to last a decade).

And again, if that perspective were true, the movie studios wouldn't have done the whole dance again with HDCP 2.2, BD+2, and AACSv2 when 4K Ultra HD Blu-ray came out (only for all of them to get broken again not long after release despite being completely-fresh implementations). You already needed the older versions, right? So, I would argue, it's actually a mixture of both.

Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Tuesday September 06, 2022 @11:00PM (#32745893)
Does audio DRM really exist? CDs were sold without any DRM and you can buy DRM free songs from the likes of itunes and amazon. Itunes used to have DRM but dropped it years ago; afaik songs bought from amazon never had DRM.

It's funny, songs are much easier to share than movies, the files are a hundredth the size, yet the movie industry thinks DRM is very important while the music industry survives just fine without it.

Re:On the efficacy of online proctoring using Proctorio (202... by elcomet on Tuesday September 06, 2022 @11:36PM (#32746075)
The "selling songs" music industry is basically dead, most people stream or use YouTube nowadays. Maybe that's why they don't bother with DRM? It would make them even less attractive compared to streaming
Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Tuesday September 06, 2022 @11:57PM (#32746158)
Maybe. But iTunes started phasing out DRM in 2007 and had 80% of their songs DRM-free by 2009. I think that's a few years before streaming became big. And Amazon was selling DRM-free mp3s from the big four labels in 2008.
Re:On the efficacy of online proctoring using Proctorio (202... by jabbany on Tuesday September 06, 2022 @10:24PM (#32745682)
There is a little bit of difference here though. Console copy protection usually doesn't prevent making copies of the media, rather it prevents _using_ those copies. It's more of an authentication mechanism.

OTOH, video is just pixels and waveforms. If you can get that raw content out somehow, copy protection cannot prevent someone from enjoying that copy (which can then be re-encoded to not have protection). So making video copy protection is much harder because you actually need to prevent copies rather than just make sure the authentication is hard to break.

Re:On the efficacy of online proctoring using Proctorio (202... by sandworm101 on Tuesday September 06, 2022 @10:31PM (#32745717)
>> which can then be re-encoded to not have protection

There are actually a handful of technologies meant to survive the transcription process only to reappear in the new medium. Probably the most effective schemes are used in money, in paper bills. There are little things there (ie the eurion constellation) that are purposely designed to be scanned. They can be copied. But then they are detected by software (Adobe Photoshop) and hardware (high-end printers) which then refuse to edit or reprint them.

https://en.wikipedia.org/wiki/EURion_constellation

Other tech is meant to leave a trail leading back to forgers, a bit like a DVD ripping software embedding your MAC/IP information in any Mp3 it generates.

https://en.wikipedia.org/wiki/Machine_Identification_Code

Re:On the efficacy of online proctoring using Proctorio (202... by jabbany on Wednesday September 07, 2022 @12:32AM (#32746336)
Persistent marks as copy protection doesn't work for media mainly because they deal with the consumption rather than copying side, so just one single non-compliant legacy device spoils the entire thing.

As for fingerprinting, that's a whole 'nother can of worms. I've never seen it be used for DRM specifically but it has been successfully used many times to track down who was leaking trade secrets etc. In fact it might be more widely deployed than most people realize.

The problem with fingerprinting for DRM would be the plausible deniability of an unsuspecting user "getting hacked" and then their fingerprinted copy ending up as the illegally distributed one without their knowledge or control.

Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Wednesday September 07, 2022 @04:48AM (#32748176)
The movie industry uses something like 'fingerprinting for DRM', adding dots to film prints sent to movie theaters to figure out where bootleg telecining is being done: https://en.wikipedia.org/wiki/Coded_anti-piracy
Re:On the efficacy of online proctoring using Proctorio (202... by jabbany on Wednesday September 07, 2022 @02:34PM (#32754426)
Does it help though? I feel like bootleg recording hasn't really been affected much...
Re:On the efficacy of online proctoring using Proctorio (202... by cowtools on Tuesday September 06, 2022 @10:56PM (#32745868)
I suppose, as long as you use locked down software and hardware. But you will be usually be able to reverse-engineer whatever heuristic they use.

>Other tech is meant to leave a trail leading back to forgers, a bit like a DVD ripping software embedding your MAC/IP information in any Mp3 it generates.

It is simple: rip the media multiple times with different identifying information, and then analyze the diffs (or just take the average). You cannot hide the existence of steganographic data if there are multiple copies with different steganographic data. It is not like analog where a loss of precision is justifiable

Re:On the efficacy of online proctoring using Proctorio (202... by jamiek88 on Tuesday September 06, 2022 @09:58PM (#32745542)
Yep and there’s always the analog loophole in the interim.
Re:On the efficacy of online proctoring using Proctorio (202... by gjsman-1000 on Tuesday September 06, 2022 @10:02PM (#32745553)
Well... they tried to patch that by locking the analog outputs on Blu-ray players to 960x540 (slightly better than DVD quality), and by removing the analog outputs entirely in 2013 on all new players after that point.

However... even the best intentions went awry after the first Blu-ray player software for PC was released with the flaw of allowing Print Screen to capture frames. Which caused people to quickly figure out they could run a script using Print Screen to capture all the frames, while having their audio-out headphone jack connected with a male-male 3.5mm cable straight into Line In. No real hacks necessary!

This was, of course, patched by blacklisting the player key and rolling out new keys in updated player software (to render new discs unplayable without an update) but it was a major oversight. ;)

Re:On the efficacy of online proctoring using Proctorio (202... by judge2020 on Tuesday September 06, 2022 @09:36PM (#32745405)
I think investors weren't too slow to realize this was happening, though, and it's part of the reason why microtransaction-funded online games are loads more profitable and prioritized.
Re:On the efficacy of online proctoring using Proctorio (202... by toomuchtodo on Tuesday September 06, 2022 @09:23PM (#32745321)
Checkbox compliance is everywhere!
Re:On the efficacy of online proctoring using Proctorio (202... by WalterBright on Tuesday September 06, 2022 @11:19PM (#32745979)
> can offload the responsibilities related to any cheating

Maybe we can reframe the issue. Why is it the administration's problem? When I went to college, I went there to learn engineering. I didn't really care about the degree. I was paying to have the prof teach me, not check me for cheating.

Me, I'd make no effort to detect cheaters. If they want to pay $$$$$ to attend university, not bother doing any work, and cheat, I'll take their money.

Make it like guitar lessons. People pay to learn how to play. There's just no percentage in cheating, because you can't play.

The cheaters will see their jobs outsourced, and my salary will be higher.

P.S. In college, lots of students were always doing engineering projects on their own and with their own money. For example, a couple of EEs designed and built a pirate radio station. I wanted to learn how to do that stuff. Cheating is just no fun. And if you don't learn anything, the other students will notice that, and will have nothing but contempt for you.

Re:On the efficacy of online proctoring using Proctorio (202... by mwilliaams on Tuesday September 06, 2022 @11:25PM (#32746021)
You don’t actually need to know most of a college curriculum to perform well in most jobs. For a lot of jobs the degree is just to get hired, or even just to get an interview. I think that is the problem.

For example, a doctor doesn’t need to know history very well to be a good doctor. Yet it’s probably part of the undergrad curriculum. So cheating on the test has no consequences if they don’t get caught.

Additionally a lot of jobs are really taught via OJT, and whatever was learned from a degree is mostly unused.

Re:On the efficacy of online proctoring using Proctorio (202... by WalterBright on Wednesday September 07, 2022 @12:17AM (#32746246)
Some good points.

> whatever was learned from a degree is mostly unused.

What a good engineering curriculum does is teach you how to think, which transcends specific skills. It reshapes your brain.

Re:On the efficacy of online proctoring using Proctorio (202... by robotresearcher on Wednesday September 07, 2022 @01:31AM (#32746725)
I understand that point of view. However, the non-cheating, conscientious students are often very angry with professors and administrators that take this approach. Your best customers feel like their earned credentials are devalued. They are competing with the cheaters for their first job after graduation. Maybe their investment will pay off in the long run, but they are pissed off right now.

Suppressing cheating is work on behalf of the good faith students. Miserable work it is.

Re:On the efficacy of online proctoring using Proctorio (202... by WalterBright on Wednesday September 07, 2022 @11:58AM (#32752361)
That's a reasonable concern. On the other hand, by not checking for cheating, one changes the culture in the classroom.

For example, in universities that aggressively go after cheaters, an adversarial relationship develops between the students and the faculty. The students collaborate on cheating, and get social credibility for cheating. Students will brag about successfully cheating to their peers.

On the other hand, at Caltech, we had an Honor System. Exams were not proctored, and students could take the exams whenever and wherever they wanted. The students were on their honor not to cheat. And an interesting thing happened. The students developed a collaborative relationship with the professors. Cheaters were despised and ostracized. If you were cheating, you'd better keep it to yourself - the other students would turn you in, and at that point you might as well leave the university.

Re:On the efficacy of online proctoring using Proctorio (202... by robotresearcher on Wednesday September 07, 2022 @05:55PM (#32757526)
The honor system is wonderful when it works. If it was the universal answer, it would be universally applied.

"The student-faculty ratio at California Institute of Technology is 3:1, and the school has 66.7% of its classes with fewer than 20 students."

https://www.usnews.com/best-colleges/california-institute-of...

Re:On the efficacy of online proctoring using Proctorio (202... by f0e4c2f7 on Tuesday September 06, 2022 @10:57PM (#32745880)
This is a really good point that I've never heard said exactly this way.

I paticuarly like the framing of responsibility.

In modern societies we have pretty fine grained tools for chopping up risk, selling it, trading it, via financial instruments or insurance. In fact when you use these tools sometimes the goal is to vanish the risk all together (which as a result sometimes creates counter-party risk).

Likewise we have a whole cottage industry of chopping up and trading responsibility with very similar mappings to risk. In fact in many ways responsibility is treated more or less like risk itself.

How many problems today though could you follow the thread back to people creating the responsibility equivalent of CDOs.

Re:On the efficacy of online proctoring using Proctorio (202... by nopenopenopeno on Tuesday September 06, 2022 @10:29PM (#32745711)
>For the most part, as expected, the world turns around just fine

That is total projection. The consequences of such things cannot even be estimated in such a short span of time. In any case, there is no shortage of studies showing recent massive shifts in quality of education in certain major western societies. Even if you were making the fallacious presumption that what has been will be, you should then presume change over stability.

Re:On the efficacy of online proctoring using Proctorio (202... by paulcole on Tuesday September 06, 2022 @10:34PM (#32745735)
> there is no shortage of studies showing recent massive shifts in quality of education in certain major western societies

Can you share 1 study and name 1 major western society you’re referring to?

Re:On the efficacy of online proctoring using Proctorio (202... by scythe on Tuesday September 06, 2022 @10:55PM (#32745862)
https://nces.ed.gov/fastfacts/display.asp?id=38

>For 13-year-olds, the average score was lower in 2020 than in 2012 (260 vs. 263), marking the first time reading scores for this age group declined between assessments.

>Meanwhile, the average mathematics score for 13-year-olds was lower in 2020 than in 2012 (280 vs. 285), marking the first time mathematics scores for this age group declined between assessments.

Not huge, but noticeable.

Re:On the efficacy of online proctoring using Proctorio (202... by yashap on Tuesday September 06, 2022 @10:35PM (#32745742)
Nailed it. Likewise, Enterprise customers don’t demand SOC-2 and similar certifications from their vendors because they actually think that will be effective in stopping data leaks, it’s just so they can say “reasonable measure were taken to select a secure vendor.”

Any large organization, private or public, is full of checkboxes and CYA. Test proctor software is just another example.

Re:On the efficacy of online proctoring using Proctorio (202... by JumpCrisscross on Tuesday September 06, 2022 @09:06PM (#32745206)
Guessing there is an assumption about deterrence, too.
Re:On the efficacy of online proctoring using Proctorio (202... by liminalsunset on Tuesday September 06, 2022 @09:17PM (#32745275)
Despite this probably being effective for casual or opportunistic people, the problem is that the opposite of the responsibility hot-potato thing happens on the "client" side too. Companies dedicated to "getting around these tools" and their ads start popping up, and now you have these companies effectively (in students' minds anyway) taking over the responsibility of dealing with the tool. So it becomes an IT pros vs IT pros cat-and-mouse game, just like jailbreaking and every other game cheating service.
Re:On the efficacy of online proctoring using Proctorio (202... by ryan93 on Tuesday September 06, 2022 @09:36PM (#32745400)
Recording students does work. The knowledge that a teacher can scrub through and see what you are doing can scared the daylights out of me. Also they required me to show whole room so i couldnt have notes. Cheating would not be worth it!
Re:On the efficacy of online proctoring using Proctorio (202... by StopHammoTime on Tuesday September 06, 2022 @10:17PM (#32745645)
Yeah, but you were already scared of contravening the rules and wouldn’t have cheated anyway.

It’s a false equivalency.

Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Tuesday September 06, 2022 @10:24PM (#32745681)
Different students have different tolerances for risk. Anti-cheating measures dissuade some but not others. Students with a lot of risk tolerance and a very high drive for success at all costs will likely find ways to cheat no matter what, but that doesn't mean simple anti-cheat measures don't work to reduce cheating.
Re:On the efficacy of online proctoring using Proctorio (202... by jcranmer on Tuesday September 06, 2022 @11:01PM (#32745896)
In my experience as a TA, cheaters are more than willing to do so even with a proctor standing right next to them staring at them.

If anything, I suspect that on net a noisily invasive anti-cheating system would actually increase cheating, as more students would be tempted to see if they could game the cheating system than would be dissuaded from cheating from hearing about a cheat-proof system.

Re:On the efficacy of online proctoring using Proctorio (202... by MichaelCollins on Wednesday September 07, 2022 @04:35AM (#32748083)
Obviously the cheaters you would catch while standing over them are the cheaters who would cheat when you're standing over them. Selection bias.

I can tell you with certainty that some cheaters are skittish. I am certain of that because I once wrote a bunch of trig identities on the side of my leg. I was very nervous about it, and only did it because I knew from previous tests in that course that I could get away with it. If the teacher had been walking around during that test, my pant leg would have stayed down.

Re:On the efficacy of online proctoring using Proctorio (202... by mannykannot on Tuesday September 06, 2022 @10:37PM (#32745754)
I agree, but it is not just a matter of risk tolerance, as the emotions desperation and/or entitlement are factors.
Re:On the efficacy of online proctoring using Proctorio (202... by rr808 on Tuesday September 06, 2022 @09:59PM (#32745544)
I feel it does more than that too. If there is no technical security measures taken it seems less of an offense to cheat, if you see real effort to stop you it makes it feel more wrong even if you can get around it.
Re:On the efficacy of online proctoring using Proctorio (202... by ALittleLight on Tuesday September 06, 2022 @10:24PM (#32745678)
My intuition is the opposite. If someone said "No cheating, on your honor" then I would probably feel much more hesitant to cheat. On the other hand, if I see you're trying to prevent cheating then I feel almost obliged to defeat the measures you thought could contain me.
Re:On the efficacy of online proctoring using Proctorio (202... by gicadin on Tuesday September 06, 2022 @10:42PM (#32745783)
This only works when no one cheats. When someone cheats easily and gets ahead with no consequence, i doubt "honor" is quite as powerful.
Re:On the efficacy of online proctoring using Proctorio (202... by acchow on Tuesday September 06, 2022 @10:51PM (#32745838)
This is basically why management consulting exists too, right?
Re:On the efficacy of online proctoring using Proctorio (202... by maxerickson on Tuesday September 06, 2022 @10:49PM (#32745823)
Being all defeatist isn't really a great response when people go chickenshit.

The students being treated like crap isn't just a rounding error here.

[dead]
Re:On the efficacy of online proctoring using Proctorio (202... by Aperocky on Tuesday September 06, 2022 @09:15PM (#32745265)
The real purpose is almost always incompetence.

Then grift.

And only then comes malice.

Re:On the efficacy of online proctoring using Proctorio (202... by markdown on Tuesday September 06, 2022 @09:51PM (#32745491)
Have you seen the Republican Parties policies over the past decade? It's pretty much "own the libs", which is malice any way you slice it.