HTML5 questions obfuscation to avoid cheating

Submitted by Barnou on Wed, 06/05/2024 - 10:31
Forums: 
Feature requests

Hello actually, when you're creating H5P content and upload it for education purpose, students can cheat by inspecting the source code of the H5P object and by copying and pasting the question within the search toolbar (ctrl +f). Then it will go automatically to where the question is inserted in the html5 source code, and they can find the answer to the question within the correct tag.

Here is the process to do it :

Right click on any H5P object, then open the source page:

Copy the question (ctrl + c) "What nginx is ?":

Go to the source page, open the searching tool (ctrl +f), paste the question "What is nginx" and press enter :

If there is a way to obfuscate the question that you can't just copy and paste the question to the source code to find the answer please ? Maybe encrypt the text with a javascript function.

Thanks in advance.

Summary: 
HTML5 questions obfuscation to avoid cheating
0
0
Supporter votes Members of the Supporter Network can vote for feature requests. When the supporter network has generated sufficient funding for the top voted feature request it will normally be implemented and released. More about the H5P Supporter Network

Barnou

Wed, 06/05/2024 - 10:42

Here are the images that were not uploaded in the first message

Attachments: 
Image icon image_2024-06-05_104111375.png
Image icon image_2024-06-05_104138604.png
Image icon image_2024-06-05_104200144.png
BV52's picture

BV52

Wed, 06/05/2024 - 20:30

Hi Barnou,

There are already plans to fix this limitation but I do not have any information in what stage we are on the development and when it will be released.

-BV

otacke's picture

otacke

Wed, 06/05/2024 - 23:06

According to https://h5p.org/roadmap, server-side evaluation will remain a feature exclusive to H5P.com.

Any client-side evaluation will not really be secure. You could encrypt the text, but the key would need to be located client-side, too. You could make cheating more difficult, but you cannot prevent it.

Barnou

Thu, 06/06/2024 - 10:06

Yes, I understand, thank you for your answers. Maybe the key could be located in the platform where you install H5P plugin, for instance on a moodle course, then when you submit the form at the end you could use the key stored in the moodle course to validate the form ?

Although I understand that this feature could be exclusive to H5P.com it could be nice to work with the community on this feature.

otacke's picture

otacke

Thu, 06/06/2024 - 15:29

These are two completely different things.

  1. Server-side evaluation doesn't need a key. The anwers would never find their way into the browser.
  2. If there was a key, the client (the browser) would need it to decode the parameters, so you will have to send the key over to the browser with the paratemers as well - where it then can be observed, too.