Skip to content
Snippets Groups Projects
New look: Off

Logging in students securely and without pain

    • Closed Issue created by Henrik Brosenne @hbrosen

    Description / Overview

    When students get the opportunity to see their submissions with grade and tutor feedback they somehow have to login to Grady. In a first test, long passwords printed on lists were used. This approach is slow and ultimately insecure since passwords are printed out on paper and therefore easy to eavesdrop. Another hurdle is that students are not reliable. Any concept involving tokens sent to email accounts or the students smartphone is too error-prone.

    The proposal for a solution is to use a combination of pre authentication with a username in combination with a manual confirmation by already authenticated tutors. The student arrive at the exam room where computers are present. It works like this:

    1. The student sits down, opens the website of their exam and enters their username.
    2. The username is then displayed in large friendly letters on the screen, while the session is registered in the system.
    3. All authenticated tutors have an overview of all students that currently request access.
    4. (Optional) The student can enter their seat number (or some other form of geo information) to give the tutor a hint.
    5. The tutor checks if the identity of the session matches that of the student via student identity card.
    6. The tutor confirms the login on their phone/laptop. The student webpage reloads and they can now see their submissions.
    7. (Optional) It would be easy to extend this system, so students can request help even after login.

    Use cases

    For students so the may login without entering a password and for reviewers/tutors so they can effortlessly login students.

    Links / references

    This is the original proposal before discussion:

    Possible solution to the password during exam access problem:

    When trying to access their exam, the students are prompted for their Matrikelnr. and their @stud.uni-goettingen.de mail. A Session token is generated and sent to the specified email-adress. Clicking a link within the email or entering the token manually authenticates the Student for the duration of the exam access. After the end of the exam access or when the student logs out, the token is deleted. This would require that the e-campus or OWA mail client is accessible.

    Feature checklist

    • Student can enter their username and a session is logged.
    • The tutor has an overview of all students that requested access.
    • The tutor may authenticate a student after checking their identity.
    • No passwords or additional tokens are used.

    /label Feature proposal

    0 of 4 checklist items completed · Edited

    Designs

      Child items ...

      2. Activity

      Please register or sign in to reply