A study into the usability and security implications of text and image based challenge questions in the context of online examination

Abstract

Online examinations are an integral component of online learning environments and research studies have identified academic dishonesty as a critical threat to the credibility of such examinations. Academic dishonesty exists in many forms. Collusion is seen as a major security threat, wherein a student invites a third party for help or to impersonate him or her in an online examination. This work aims to investigate the authentication of students using text-based and image-based challenge questions. The study reported in this paper involved 70 online participants from nine countries completing a five week online course and simulating an abuse case scenario. The results of a usability analysis suggested that i) image-based questions are more usable than text-based questions (p < 0.01) and ii) using a more flexible data entry method increased the usability of text-based questions (p < 0.01). An impersonation abuse scenario was simulated to test the influence of sharing with different database sizes. The findings revealed that iii) an increase in the number of questions shared for impersonation increased the success of an impersonation attack and the results showed a significant linear trend (p < 0.01). However, the number of correct answers decreased when the attacker had to memorize and answer the questions in an invigilated online examination or their response to questions was timed. The study also revealed that iv) Educ Inf Technol (2019) an increase in the size of challenge question database decreased the success of an impersonation attack (p < 0.01).

Knowledge based Authentication Techniques and Challenges

“…3), memorability, usability, performance, and cost. Previous researches focus on the memorability and usability [16,17] that differs the Fig. 3 includes other collective techniques performance and cost.…”

“…According to the literature, KBA was identified as the approach used to combine some challenges (i.e. questions) to verify claimed users where the answers of these challenges came from their knowledge [16].…”

A Dynamic Profile Questions Approach to Mitigate Impersonation in Online Examinations

“…• A study [43] by authors identified that an increase in the number of questions shared, increased the success of an impersonation attack. Also, an increase in the profile (database) size decreased the success of an impersonation attack.…”

A Knowledge-Based Integrated System of Hesitant Fuzzy Set, AHP and TOPSIS for Evaluating Security-Durability of Web Applications

“…In another such episode, a renowned company Dunkin' Donuts faced a data breach on January 17, 2019, for another time in almost three months when hackers gained access to their customer's accounts through credential stuffing attacks [2]. On April 17, 2019 private data of about 100 million Just Dial end users was found undefended on openly available servers [3]. These reports of data breach are alarm bells that signal for prompt solutions and organizations cannot wait for more instances to happen.…”

“…Though significant efforts have been made to ensure security by the researchers and industry professionals, all the suggested steps are in the later stages of the development of a web application. This is one of the major flaws which render the web applications vulnerable and results in data breaches [3], [4]. The security estimation needs to be done at the initial stages of web application development.…”