Google Forms Test Security

[Booknerd]

After participating in UT Invitational's WGYN and Fermi Questions events, I figured I'd address a concern that I was aware of about the test security of Google Forms.

- Why is this important?
Many competitions utilize Google Forms for testing - especially with a Start Form / Answer Sheet form. However, many parts of the form are stored client side, such as answer validation or confirmation messages.

- If a tournament uses a "Start Form" with a "Answer Sheet" form, the source of the google form (ctrl-u or F12) can show competitors text in the confirmation message (the message that is displayed after submission). Competitors can easily ctrl-f and find links to tests and other forms that you link in this message.

- If you use response validation to check short answer questions, the answer is stored as a plaintext in the source - competitors can find all answers trivially.

I've included a sample form for reference: https://forms.gle/Vk449sDBEa9P74737.

TL;DR: don't use google forms for tests

[sneepity]

Does this happen with the locked mode of google forms too? (assuming it's possible for test writers to use locked mode and that it works)

[sciolyperson1]

Does this happen with the locked mode of google forms too? (assuming it's possible for test writers to use locked mode and that it works)

Locked mode is made available to g suite users only (within districts or companies), so competitions likely can't use them.

[sneepity]

Does this happen with the locked mode of google forms too? (assuming it's possible for test writers to use locked mode and that it works)

Locked mode is made available to g suite users only (within districts or companies), so competitions likely can't use them.

Oh okay, I see! I think I got used to it because of school. :D

[Longivitis]

I just want to also mention that even if you disable the Google Form to prevent responses, you can still see the description as if the form was still open, although I don't believe you can see the questions/valid answers. If you happen to still have the links for the WGYN/fermi tests for the UT Invite, you can still see it through the inspect element.

Having a start form and an end form is, unfortunately, the only way you can determine accurate times. There are some clock extensions or add-ons that could potentially force submit a form when it reaches a certain time, but they're pretty buggy and unreliable.

Both the fermi ES and I (WGYN) did all the answer validation/checking through the form response Google Sheets by using formulas/Apps Script instead of directly using the Google Forms quiz function/answer validation for the UT Invitational, and I would recommend this approach if groups really do want to run certain events through Google Forms. Even then, Scilympiad exists now, so use that instead.

[sciolyperson1]

Having a start form and an end form is, unfortunately, the only way you can determine accurate times. There are some clock extensions or add-ons that could potentially force submit a form when it reaches a certain time, but they're pretty buggy and unreliable.

When we ran the Codebusters Scrimmage (as well as SMEC September I think), we also used Start forms to keep track of time, and yea, it was also the only way we could determine accurate times unfortunately.