Multiple Student Logins

[academictechnol]

How are institutions handling multiple users logging in during exams on Canvas? We use the Respondus Lockdown Browser and Monitor. We recently discovered user (student) ability to share Canvas access at different locations. Enabling others to complete exams/quizzes on their behalf.

Has anyone else experience this scenario? What are other institutions doing to prevent multiple user logins?

[Gabriel33]

I don't use the LockDown browser, and I don't know if that has any tools to help, but for an in class exam using University computers, I use the Submission Events API to check whether students have had more than one "session started" event, with different User Agents (so they would have used different computers, or at least browsers, to access the exam). It's not perfect, as different computers can have the same User Agent, but it helped me prove cheating once.

I believe admins can also check the IP address, but I don't think they'd enjoy receiving a ticket to check them for every exam.

[paul_fynn]

Can you elaborate on how you believe students are doing that @academictechnol please ? Where the assessment is a New Quiz you should be able to see the IP addresses, although that may not help if the student and their surrogate are both on campus ?

[academictechnol]

We have encountered situations using both quiz types with and without the Respondus Lockdown Browser where students are sharing MFA login credentials and accessing the same quizzes. Giving the student the opportunity to have someone else complete the quiz for them. Unless an instructor has question of cheeting they are non the wiser. Our investigation shows Canvas allowing multiple account access and using the RLDB does not prevent.

[paul_fynn]

@academictechnol - We are currently investigating a exam conditions quiz where student were asked to complete a coding task in time limited conditions (no lockdown browser). We have two students submitting exactly the same code.

We are struggling to identify logs that will give us sight of the sequences taken by both, and possibly a third, student(s).

• One specific issue that we have noted is that the New Quiz LTi is reporting the browser used as "Chrome" when the student page views log shows that it is quite a different browser.
• A further issue is that we are unable to download the submitted file to check the metadata, as the download is immediately treated as newly created by the downloading colleague. 

What we require in order to be able to investigate and report on instances such as this is for all Canvas submission points / types to capture the MAC address of the device used, in addition to the IP, and the (correct and accurate) browser type.

It would seem intuitive that Canvas should not allow multiple concurrent login either to the site or to individual assessments.

It is a further minor irritation that the start time is reported at the top of the New Quiz moderate activity log, whilst reported in 12 hour format in the session started event.

Have you picked any of this up with your Canvas Customer Success Manager or Canvas Support ?

[paul_fynn]

Cross referencing to the Mobile security discussion here Security and UX are in Harmony in Canvas Mobile - Instructure Community - 645969 and particularly Christine_Cair_1's contribution.