Skip to content

Tendy: Multi-Modal Attendance Verification

Tendy is a cross-platform attendance verification system (Flutter frontend, FastAPI + MongoDB backend) that investigates the fundamental tension between friction, trust, and privacy in classroom attendance. Rather than searching for a single "best" modality, Tendy implements three distinct check-in methods — each designed to probe a different point on the trade-off triangle — and evaluates them empirically through user studies.

The Attendance Trilemma

Every attendance system must navigate three competing demands:

  • Friction: How much cognitive and physical effort is required from the student.
  • Trust: How provably secure the check-in is against proxy fraud.
  • Privacy: How much personal data the system collects and retains.

No single modality optimizes all three. Tendy's contribution is not one optimal solution, but a rigorous mapping of the design space, enabling instructors to choose the trade-off that fits their context.

Dynamic QR with Sliding-Window TOTP

The Dynamic QR modality implements a custom modification of RFC 6238: the QR code regenerates every 2 seconds (not the standard 30), and the student must capture three consecutive valid codes (approximately 6 seconds of sustained presence) to complete check-in. This temporal-liveness requirement defeats "drive-by" scanning, photo sharing, and relay attacks by proving continuous co-presence rather than a single point-in-time capture.

Key anti-fraud properties:

  • The 2-second TOTP window renders photo sharing impractical (the photo is stale before the recipient can use it).
  • The requirement for three consecutive valid codes forces sustained physical proximity.
  • Session binding prevents token replay across different days or devices.

Bluetooth Low Energy Proximity

The BLE modality represents the passive extreme of the trilemma — minimal friction (students simply walk into the room), but at the cost of severe trust and reliability issues. The pilot study revealed two critical vulnerabilities:

  1. Signal Imitation Attack: A malicious actor can capture the static UUID broadcast by a BLE beacon and rebroadcast it from a remote location using a beacon simulator or ESP32, achieving near-100% spoofing success.
  2. RSSI Instability: Bluetooth signal strength fluctuates wildly indoors due to multipath fading, body absorption, and orientation-dependent attenuation, creating an unreliable sensing layer.

These issues produced the lowest System Usability Scale (SUS) score across all three modalities (59.6, below the industry average of 68), with high variance (SD=21.4). Paradoxically, the "invisible" nature of passive detection caused student trust deficits: without feedback, users could not distinguish between "not yet detected" and "failed."

Biometric Liveness Detection

The Biometric Selfie modality implements liveness detection via smile probability plus face capture. Images are uploaded for instructor review under an ephemeral "snap, match, delete" philosophy — the data exists only for the duration of verification and is immediately discarded.

This approach addresses the identity–device decoupling problem that plagues token-based methods: all non-biometric systems verify the presence of a device (smartphone, ID card), not the person holding it. However, it introduces significant privacy concerns, documented in research on student activism against biometric surveillance and legal precedent (Bocconi University, GDPR Article 9) establishing that student consent to biometric collection cannot be considered "freely given" under institutional coercion.

Empirical Results and SUS Evaluation

A pilot study comparing all three modalities using the standard 10-item System Usability Scale (SUS) yielded statistically significant differences (Repeated-Measures ANOVA, p < .001):

Modality SUS Score Grade Key Insight
Dynamic QR 83.9 A Active engagement → highest perceived usability
Biometric Selfie 75.7 B Above industry average; privacy concerns offset by trust
BLE Proximity 59.6 D Invisible automation → trust deficits and usability failures

The finding that the highest-friction method (Dynamic QR) scored highest in usability is a central result. It supports the HCI concept of beneficial friction — deliberately introduced effort in authentication enhances perceived security and user trust, contradicting the industry orthodoxy that zero-friction is always superior.

Beneficial Friction and Security Ceremony

The "ritual" of scanning a QR code, positioning a camera, or performing a smile challenge functions as a security ceremony — visible effort that signals system integrity. Users accept the "privacy tax" of higher-friction methods because the effort investment signals that the system takes verification seriously. This framework explains why Tendy does not default to the theoretically most convenient (BLE) method.

Future Directions

The project's roadmap points toward zero-knowledge proofs (ZKP) for privacy-preserving attendance, where a student's device generates a proof of presence and identity that the server verifies without ever seeing the identity or location data. This would decouple verification from identification, theoretically eliminating mass surveillance while preserving academic integrity. On-device signing (Ed25519) is the near-term step toward eliminating server-side biometric storage.

  • Tendy — Direct implementation of the multi-modal attendance system.
  • Serverless Notebooks — Shares the infrastructure deployment focus.

Supplementary Reading