Google Forms Test Security

For anything Science Olympiad-related that might not fall under a specific event or competition.
Post Reply
User avatar
sciolyperson1
Exalted Member
Exalted Member
Posts: 1008
Joined: April 23rd, 2018, 7:13 pm
Division: C
State: NJ
Pronouns: He/Him/His
Has thanked: 369 times
Been thanked: 524 times
Contact:

Google Forms Test Security

Post by sciolyperson1 » November 8th, 2020, 12:12 am

After participating in UT Invitational's WGYN and Fermi Questions events, I figured I'd address a concern that I was aware of about the test security of Google Forms.

- Why is this important?
Many competitions utilize Google Forms for testing - especially with a Start Form / Answer Sheet form. However, many parts of the form are stored client side, such as answer validation or confirmation messages.

- If a tournament uses a "Start Form" with a "Answer Sheet" form, the source of the google form (ctrl-u or F12) can show competitors text in the confirmation message (the message that is displayed after submission). Competitors can easily ctrl-f and find links to tests and other forms that you link in this message.

- If you use response validation to check short answer questions, the answer is stored as a plaintext in the source - competitors can find all answers trivially.

I've included a sample form for reference: https://forms.gle/Vk449sDBEa9P74737.

TL;DR: don't use google forms for tests :thinking:
These users thanked the author sciolyperson1 for the post (total 7):
RiverWalker88 (November 8th, 2020, 8:32 am) • Booknerd (November 8th, 2020, 8:43 am) • CPScienceDude (November 8th, 2020, 9:11 am) • sneepity (November 8th, 2020, 9:13 am) • Longivitis (November 8th, 2020, 4:17 pm) • gz839918 (November 10th, 2020, 4:46 pm) • MadCow2357 (December 21st, 2020, 9:33 am)
WW-P HSN '22, Community '18, BirdSO Tournament Director
'21: Gravity - Boomi - WICI - PPP - Cybersec

BEARSO: Gravity - 1st '21
MIT: LMMM - 1st '21, DigiStruc - 2nd '21, Gravity - 1st '20
PUSO: PPP - 1st '20, WIDI -1st '20

Team:
Nats - 3rd '18, '19
MIT - 1st '21, 3rd '20

Rate my tests!

User avatar
sneepity
Member
Member
Posts: 140
Joined: February 13th, 2020, 2:35 pm
Division: B
State: NY
Pronouns: She/Her/Hers
Has thanked: 894 times
Been thanked: 193 times
Contact:

Re: Google Forms Test Security

Post by sneepity » November 8th, 2020, 9:15 am

Does this happen with the locked mode of google forms too? (assuming it's possible for test writers to use locked mode and that it works)
oewn baded glopo
visit my rad userpage at: https://scioly.org/wiki/index.php/User:Sneepity

User avatar
sciolyperson1
Exalted Member
Exalted Member
Posts: 1008
Joined: April 23rd, 2018, 7:13 pm
Division: C
State: NJ
Pronouns: He/Him/His
Has thanked: 369 times
Been thanked: 524 times
Contact:

Re: Google Forms Test Security

Post by sciolyperson1 » November 8th, 2020, 9:36 am

sneepity wrote:
November 8th, 2020, 9:15 am
Does this happen with the locked mode of google forms too? (assuming it's possible for test writers to use locked mode and that it works)
Locked mode is made available to g suite users only (within districts or companies), so competitions likely can't use them.
WW-P HSN '22, Community '18, BirdSO Tournament Director
'21: Gravity - Boomi - WICI - PPP - Cybersec

BEARSO: Gravity - 1st '21
MIT: LMMM - 1st '21, DigiStruc - 2nd '21, Gravity - 1st '20
PUSO: PPP - 1st '20, WIDI -1st '20

Team:
Nats - 3rd '18, '19
MIT - 1st '21, 3rd '20

Rate my tests!

User avatar
sneepity
Member
Member
Posts: 140
Joined: February 13th, 2020, 2:35 pm
Division: B
State: NY
Pronouns: She/Her/Hers
Has thanked: 894 times
Been thanked: 193 times
Contact:

Re: Google Forms Test Security

Post by sneepity » November 8th, 2020, 9:41 am

sciolyperson1 wrote:
November 8th, 2020, 9:36 am
sneepity wrote:
November 8th, 2020, 9:15 am
Does this happen with the locked mode of google forms too? (assuming it's possible for test writers to use locked mode and that it works)
Locked mode is made available to g suite users only (within districts or companies), so competitions likely can't use them.
Oh okay, I see! I think I got used to it because of school. :D
oewn baded glopo
visit my rad userpage at: https://scioly.org/wiki/index.php/User:Sneepity

Longivitis
Member
Member
Posts: 35
Joined: February 17th, 2018, 7:19 am
Division: Grad
State: TX
Has thanked: 7 times
Been thanked: 22 times

Re: Google Forms Test Security

Post by Longivitis » November 8th, 2020, 4:50 pm

I just want to also mention that even if you disable the Google Form to prevent responses, you can still see the description as if the form was still open, although I don't believe you can see the questions/valid answers. If you happen to still have the links for the WGYN/fermi tests for the UT Invite, you can still see it through the inspect element.

Having a start form and an end form is, unfortunately, the only way you can determine accurate times. There are some clock extensions or add-ons that could potentially force submit a form when it reaches a certain time, but they're pretty buggy and unreliable.

Both the fermi ES and I (WGYN) did all the answer validation/checking through the form response Google Sheets by using formulas/Apps Script instead of directly using the Google Forms quiz function/answer validation for the UT Invitational, and I would recommend this approach if groups really do want to run certain events through Google Forms. Even then, Scilympiad exists now, so use that instead.
University of Texas at Austin '23
Cypress Lakes High School '19

Chemistry Lab, Codebusters, Game On, Science Word, Towers, We've Got Your Number

User avatar
sciolyperson1
Exalted Member
Exalted Member
Posts: 1008
Joined: April 23rd, 2018, 7:13 pm
Division: C
State: NJ
Pronouns: He/Him/His
Has thanked: 369 times
Been thanked: 524 times
Contact:

Re: Google Forms Test Security

Post by sciolyperson1 » November 8th, 2020, 7:08 pm

Longivitis wrote:
November 8th, 2020, 4:50 pm
Having a start form and an end form is, unfortunately, the only way you can determine accurate times. There are some clock extensions or add-ons that could potentially force submit a form when it reaches a certain time, but they're pretty buggy and unreliable.
When we ran the Codebusters Scrimmage (as well as SMEC September I think), we also used Start forms to keep track of time, and yea, it was also the only way we could determine accurate times unfortunately.
WW-P HSN '22, Community '18, BirdSO Tournament Director
'21: Gravity - Boomi - WICI - PPP - Cybersec

BEARSO: Gravity - 1st '21
MIT: LMMM - 1st '21, DigiStruc - 2nd '21, Gravity - 1st '20
PUSO: PPP - 1st '20, WIDI -1st '20

Team:
Nats - 3rd '18, '19
MIT - 1st '21, 3rd '20

Rate my tests!

Post Reply

Return to “General Competition”

Who is online

Users browsing this forum: No registered users and 5 guests