Dear developers of the Attendance-Plugin,
I am very
interested in using your module to track attendance of students within
Moodle. However, in my university the option of restricting the
IP-addresses to avoid external registrations is not useful, because
the IPs of the student's mobile devices can not be fixed or assigned to specific
locations.
Another possibility is to extract the BSSID of the WiFi access points of the student's phone/PC when connected to the
universities WiFi. I would like to be able to give a list of admissible
BSSID (MAC-adresses) of APs in the vicinity of the class room (instead
of IPs) which are cross-checked by moodle on the student's devices when
they register their attendance.
Is it possible that you extend the implementation of you module?
As mentioned in your github issue (but here is a better place for this so I've closed it there...)
I can't see how this would work - the users SSID is not passed in the request headers from their browser to the web server - so "Moodle" can't find this information out. Usually in this sort of scenario I've seen organisations add the full IP range of known addresses, and then use the QR Code rotation process for marking sessions - that way it forces both the use of the university network, and access to the current QR code... of course that doesn't stop people bringing in multiple devices and taking attendance for their friends.
We only get the users originating IP address - The only way I can think this would be possible is to have some form of API that allows Moodle to ask your network infrastructure "what access point does this IP address use" - but that would be heavily dependent on your network infrastructure and heavily custom to your specific environment (and hard to make it generic/useful for other organisations not using the same infrastructure.)
Of course - I'm open to ideas if you have a network engineer that has further ideas on how we could obtain this information safely and reliably from the webserver/moodle.
Also - keep in mind I don't tend to do "feature development" like this for free..
I can't see how this would work - the users SSID is not passed in the request headers from their browser to the web server - so "Moodle" can't find this information out. Usually in this sort of scenario I've seen organisations add the full IP range of known addresses, and then use the QR Code rotation process for marking sessions - that way it forces both the use of the university network, and access to the current QR code... of course that doesn't stop people bringing in multiple devices and taking attendance for their friends.
We only get the users originating IP address - The only way I can think this would be possible is to have some form of API that allows Moodle to ask your network infrastructure "what access point does this IP address use" - but that would be heavily dependent on your network infrastructure and heavily custom to your specific environment (and hard to make it generic/useful for other organisations not using the same infrastructure.)
Of course - I'm open to ideas if you have a network engineer that has further ideas on how we could obtain this information safely and reliably from the webserver/moodle.
Also - keep in mind I don't tend to do "feature development" like this for free..
Thanks for your quick reply.
For various reasons in our seminar we try to come close to that physical process of "stamping with a time clock". The WiFi access point takes the role of a piece of physical hardware the students have to shake hands with. In our case, opening the entire IP space is really not optimal, because we also must rely only on a single QR-code displayed to all the students, which would be quickly shared to anybody at home...
BSSIDs can be detected by eg Android apps, but it seems not really possible in a browser with php/javascript, which is probably what you refer to. The API should use things like this:
Java Examples & Tutorials of WifiInfo.getBSSID (android.net.wifi) | Tabnine, I guess, but no idea how to realize this. Maybe this would work inside a Moodle android app? Quite a bit of an effort, though...
Money is not the problem, but rather to go through the administrative offices of our university to be allowed to use the money to fund you. Depending on your experience with such interactions we can surely talk about a project.
haha "Money isn't the problem"? - not often I hear that (I work for the Moodle Partner Catalyst IT, so yes we have a lot of experience working for universities)
Keep in mind - that the QR code sign-in process has a QR rotation feature, allowing you to have a WR code that expires within 5 seconds or less - which does make it harder, but of course a student could pull up a video call with their friends and allow them to see the qr code on a device and scan it remotely.....
Yes - we can get at the SSID from a Mobile app, however in your initial post you stated that you wanted to allow it from the "student's phone/PC" - (not just phones) - If you could force all your users to use an android or iOS device and install a custom mobile app so they could track their attendance, then yes, it might be possible.
There are probably 2 ways to do this - we could build you a custom app just for attendance tracking, but it would probably be better to build you a branded Moodle Mobile app and bake the attendance improvements into the custom build for you. It's possible we could push some of the improvements into the open-source mobile app build, but we'd probably need to discuss the details and you'd likely need a good sized budget to support it.,
But... here's the big thing - you need to work out, how important is attendance tracking - and how much will the feature actually decrease the ability of learners to game the system - the answer is - probably not by much.... devices are extremely cheap, it's relatively easy to bring in multiple devices into a large room and they can just scan themselves and their friends in using different devices...
Could that expense be better spent on other methods of attendance tracking that would be more accurate and better prevent "cheating the system" - possibly? - but feel free to reach out privately if you'd like to fund some development on this.
Keep in mind - that the QR code sign-in process has a QR rotation feature, allowing you to have a WR code that expires within 5 seconds or less - which does make it harder, but of course a student could pull up a video call with their friends and allow them to see the qr code on a device and scan it remotely.....
Yes - we can get at the SSID from a Mobile app, however in your initial post you stated that you wanted to allow it from the "student's phone/PC" - (not just phones) - If you could force all your users to use an android or iOS device and install a custom mobile app so they could track their attendance, then yes, it might be possible.
There are probably 2 ways to do this - we could build you a custom app just for attendance tracking, but it would probably be better to build you a branded Moodle Mobile app and bake the attendance improvements into the custom build for you. It's possible we could push some of the improvements into the open-source mobile app build, but we'd probably need to discuss the details and you'd likely need a good sized budget to support it.,
But... here's the big thing - you need to work out, how important is attendance tracking - and how much will the feature actually decrease the ability of learners to game the system - the answer is - probably not by much.... devices are extremely cheap, it's relatively easy to bring in multiple devices into a large room and they can just scan themselves and their friends in using different devices...
Could that expense be better spent on other methods of attendance tracking that would be more accurate and better prevent "cheating the system" - possibly? - but feel free to reach out privately if you'd like to fund some development on this.
OK, I start to see the dimensions of that. Thanks much.
I might get back to you.
cool - I saw your message - will reply shortly... but one thing I realised last night while thinking on this further that might make also this a bad investment of funds.
Student 1 - connects in class - finds the access point BSSID (pretty easy with a range of different tools/apps.) - sends the BSSID to their friend... or just takes a record of the BSSID, wanders around the site and generates a full list of BSSID values on site and shares it with all their friends.
Student at home modifies the mac address (BSSID) on their cell-phone(easy with a number of different free apps) turns mobile hot-spot on, connects their laptop or other mobile device to that hotspot with the modified address and bingo - it lets them record attendance without being on site.
lets take a stab in the dark at the cost of developing a custom mobile app with these features and include time spent by university staff/meetings to discuss/lawyers to sign contracts etc.. - lets say USD $60,000 (probably more) worth of effort between all parties, thwarted by a student with an hour of free time then a simple method of reproducing a way to get around it for all your students on site.
Student 1 - connects in class - finds the access point BSSID (pretty easy with a range of different tools/apps.) - sends the BSSID to their friend... or just takes a record of the BSSID, wanders around the site and generates a full list of BSSID values on site and shares it with all their friends.
Student at home modifies the mac address (BSSID) on their cell-phone(easy with a number of different free apps) turns mobile hot-spot on, connects their laptop or other mobile device to that hotspot with the modified address and bingo - it lets them record attendance without being on site.
lets take a stab in the dark at the cost of developing a custom mobile app with these features and include time spent by university staff/meetings to discuss/lawyers to sign contracts etc.. - lets say USD $60,000 (probably more) worth of effort between all parties, thwarted by a student with an hour of free time then a simple method of reproducing a way to get around it for all your students on site.