Invisible Boundaries: A Comparative HCI Analysis of Active, Passive, and Biometric Digital Attendance Systems¶

Abstract¶

The proliferation of digital attendance systems in higher education creates a significant tension between the institutional goals of usability, security, and the student's right to privacy. This paper examines the two dominant paradigms for digital verification: active systems, which require explicit user action like scanning a QR code, and passive systems, which rely on automated sensing via technologies like Bluetooth Low Energy (BLE) beacons. While active systems involve clear transactional friction, passive systems introduce a more pernicious invisible friction—the cognitive load of uncertainty. The paper's core thesis is that active systems, despite higher objective time costs, foster greater user trust and practical acceptance than their passive counterparts. To empirically test this thesis, we developed "Tendy," a multi-modal attendance system serving as a comparative case study. Key findings from a user study reveal a strong preference for active Dynamic QR codes, the slowest method tested, over passive BLE. The latter's feedback voids and inherent instability created significant user anxiety, resulting in perceived unreliability. These results suggest that the design of future educational technologies should prioritize user agency and transparent feedback over the pursuit of seamless invisibility to build a foundation of trust.

1. Introduction: The Datafication of Presence in the Smart Campus¶

The administrative and pedagogical landscape of Higher Education Institutions (HEIs) is undergoing a profound transformation into the "Smart Campus," driven by the datafication of student presence. Institutions face mounting pressure to quantify student engagement to inform retention strategies, ensure visa compliance, and correlate attendance with academic success. This shift from analog roll calls to digital attendance systems, however, forces institutions to navigate a complex "usability-security-privacy trilemma," balancing the need for a frictionless classroom experience with robust fraud prevention and respect for student data rights.

This paper dissects the central conflict within this trilemma by comparing two primary authentication paradigms. The "active" paradigm is characterized by a deliberate, user-initiated action, such as scanning a dynamic QR code. This interaction serves as a "ritual of consent," creating a distinct digital handshake. In contrast, the "passive" paradigm relies on invisible, automated sensing, where a student's presence is inferred by environmental sensors like BLE beacons without any explicit user action. This approach introduces a modern "surveillance realism" into the university environment, where students become accustomed to being passively monitored.

Our central argument posits that while passive systems theoretically offer superior usability through zero-friction interaction, they create significant trust deficits and user anxiety. This is due to a pervasive lack of feedback and a heightened perception of surveillance, creating a cognitive load of uncertainty we term "invisible friction." Conversely, we contend that active systems, by preserving user agency and providing immediate confirmation, achieve higher user satisfaction and, paradoxically, better practical usability, even when they are objectively slower. To investigate this, we developed the "Tendy" project—a novel, multi-modal attendance system designed to serve as an empirical case study. Tendy was explicitly built to test the Human-Computer Interaction (HCI) trade-offs between three experimental conditions: an active Dynamic QR code, a passive BLE beacon, and a high-assurance Biometric Selfie. This paper leverages the Tendy framework to move beyond theoretical debate, grounding our analysis in the theoretical foundations of digital interaction and user trust.

2. Theoretical Framework: The Psychology of Digital Verification¶

To effectively analyze the findings from the Tendy project, it is essential to first establish a robust theoretical framework. A meaningful interpretation requires synthesizing core HCI principles of interaction design, the psychology of human-automation trust, and the specific privacy calculus that applies within the often coercive power dynamics of an educational environment. This framework provides the lens through which we can understand the nuanced user responses to different modes of digital verification.

2.1 The Usability-Security-Privacy Triad in Education¶

The implementation of any digital attendance system involves a delicate balancing act between three competing imperatives, each with its own set of design principles and psychological impacts.

• The Usability Imperative: In a classroom setting, usability is measured by "throughput"—the ability to verify hundreds of students quickly without disrupting the pedagogical flow. Any time spent managing technology instead of learning is considered "transactional friction," a failure in the system's design. A key concept here is Donald Norman's "Gulf of Evaluation," which describes the user's difficulty in assessing the system's state. Active systems bridge this gulf with immediate, unambiguous feedback (e.g., a "Success" screen), whereas passive systems widen it, leaving users in a state of "confirmation anxiety" as they wonder whether their presence has been successfully logged.

• The Security Imperative: The primary security goal is preventing "proxy attendance," where one student registers an absent peer. The core vulnerability of most non-biometric digital systems is "identity-device decoupling"—they verify the presence of a token (a smartphone) rather than the identity of the student. This has led to an arms race, with systems evolving from static codes to dynamic, time-sensitive challenges to better bind the user's identity to their physical location at a specific moment.

• The Privacy Imperative: Beyond simple data protection, privacy in education touches on "Data Justice," or the fairness of how student data is collected and used. A principal concern is "surveillance creep," the fear that infrastructure installed for attendance will be repurposed for broader behavioral tracking. Active systems promote an "ongoing consent" model, where the user affirms consent with each scan. Passive systems typically rely on a "one-time consent" model at app installation, after which tracking can become perpetual and invisible, violating user expectations for control.

2.2 The Crisis of Trust in Invisible Interfaces¶

The pursuit of "Zero UI" or invisible interfaces, while aiming for ultimate convenience, often creates a "feedback void." This directly violates one of the most fundamental principles of usability engineering, Jakob Nielsen's heuristic of "Visibility of System Status." When a system's operations are invisible, users cannot determine its state, leading to uncertainty and mistrust.

This lack of feedback has direct psychological consequences. In public settings, the fear of an invisible system failing can lead to "social anxiety" and a physical "startle response" if a gate fails to open, causing public embarrassment. This constant uncertainty erodes user trust in the system's reliability. The "Trust Calibration Model," drawn from human-automation teaming, explains that trust is built slowly through repeated positive interactions but can be lost instantly in a "trust crash" due to a single, memorable failure—a phenomenon amplified by the cognitive bias of the recency effect.

2.3 The Student Privacy Calculus¶

Privacy Calculus Theory (PCT) posits that individuals weigh the perceived benefits of disclosing personal information against the perceived risks. In higher education, this calculus is skewed by a significant power asymmetry. The environment is inherently "coercive," as students must use mandated systems to pass their courses. This often leads not to willing acceptance but to "cynical compliance" or a sense of "digital resignation."

The perceived risks are particularly acute for biometrics, given the data permanence of a facial or fingerprint scan and the documented potential for algorithmic bias. To mitigate these fears, a promising technological solution is the use of "ephemeral" biometrics. A protocol of "Snap, Match, Delete," where the biometric data is used for a momentary verification and then immediately discarded without being stored centrally, can dramatically reduce the perceived risk. By providing a technical guarantee against data retention and function creep, such architectures can have a profoundly positive impact on user trust and acceptance.

This theoretical groundwork provides the necessary context for understanding the design of the Tendy system and interpreting the results of its empirical evaluation.

3. The Tendy Project: An Experimental Framework for Comparative Analysis¶

To move beyond theoretical debate and empirically measure the HCI trade-offs of different attendance modalities, the Tendy project was developed as a high-fidelity, multi-modal prototype. It was designed from the ground up as an experimental framework to directly compare active, passive, and high-assurance biometric systems within a single, controlled application.

3.1 System Architecture and Design¶

The Tendy ecosystem consists of a cross-platform mobile application for students and instructors, built in Flutter, and a backend server developed with FastAPI. Real-time communication between the instructor's dashboard and student devices is managed via WebSocket connections, ensuring immediate feedback on attendance status.

A core design principle of the system was its capacity for collecting "Rich Metadata." Instead of merely logging a binary "present" or "absent" status, the Tendy backend was architected to store detailed proof-of-presence data for each check-in. This includes BLE Received Signal Strength Indicator (RSSI) values, QR scan intervals, and even smile probability scores from the biometric check. This granular data collection was instrumental for conducting a deep HCI analysis of the user experience across different conditions.

3.2 The Three Experimental Conditions¶

Tendy was built to test three distinct attendance modalities, each representing a different point on the usability-security-privacy spectrum.

• Dynamic QR (Active): This condition served as the active baseline, requiring deliberate user focus.

  • Mechanism: The instructor's device displays a QR code that regenerates every two seconds based on a custom Time-based One-Time Password (TOTP) logic.
  • HCI Principle: To prevent simple photo-sharing fraud, the student's app implements a "Sliding Window Algorithm," requiring it to successfully scan and validate 3 consecutive valid codes. This ensures the student is physically present and aiming their device at the screen for an extended period requiring the user to remain focused on the screen for at least 4-6 seconds to capture three distinct, consecutive codes.

• Bluetooth LE (Passive): This condition was designed to be the "invisible" or "zero-friction" ideal.

  • Mechanism: The instructor's device acts as a BLE beacon, advertising a unique SessionUUID. The student's app runs a background service that scans for this UUID.
  • HCI Principle: Attendance is logged automatically once the client-side app detects a sustained RSSI signal strength above a predefined threshold (e.g., > -90 dBm), indicating proximity to the instructor.

• Biometric Selfie (High-Assurance): This condition represented the "high social cost" modality, designed to maximize security against proxy attendance.

  • Mechanism: The student first enters a 6-digit class code to join the session. The app then activates the front-facing camera and uses on-device liveness detection via Google's ML Kit, requiring a Smile Probability > 0.8 before a photo can be taken.
  • HCI Principle: The captured image is then uploaded to the instructor's dashboard for manual review, binding the student's identity to their presence in a verifiable way but at the cost of social friction and privacy concerns.

With this experimental framework in place, a formal user study was conducted to compare these three conditions directly.

4. Methodology¶

To empirically compare the three attendance modalities implemented in the Tendy system, a within-subjects pilot study was conducted. This approach allowed for the direct comparison of user performance and perception across the different technologies while controlling for individual differences.

4.1 Participants and Procedure¶

The pilot study involved a pilot study of university students (N=7), who participated in a lab-based evaluation. A within-subjects design was employed, meaning each participant tested all three experimental conditions: Dynamic QR, BLE, and Biometric Selfie. To mitigate learning effects, the order in which the conditions were presented to each participant was randomized.

The study followed a three-step procedure: 1. Briefing and Consent: Participants were given an overview of the study's purpose and provided informed consent. The three technologies were explained without revealing the study's specific hypotheses. 2. Task Execution: Participants were asked to complete the check-in task for each of the three conditions. The application logged their performance data automatically. 3. Debriefing: After completing all three tasks, participants filled out post-task surveys and participated in a semi-structured interview to provide qualitative feedback on their experience and preferences.

4.2 Data Collection and Metrics¶

A combination of quantitative and qualitative dependent variables was measured to provide a holistic view of each system's performance.

• Efficiency: This was measured as Time-on-Task, automatically logged by the application in milliseconds from the moment a user initiated the check-in task until a success confirmation was received.
• User Satisfaction: This was measured using the industry-standard 10-item System Usability Scale (SUS) questionnaire. This yielded a composite score ranging from 0 to 100, providing a reliable measure of perceived usability.
• User Experience and Preference: This was measured through a post-task survey that used 5-point Likert scales to assess user perceptions of comfort and trust for each method. The survey also included open-ended questions asking participants to state their preferred method for semester-long use and their perception of each method's security.

These collected metrics formed the basis for the comparative analysis presented in the following section.

5. Results¶

The data collected from the Tendy pilot study revealed a significant divergence between the theoretical usability of the systems and their practical user acceptance. The quantitative and qualitative findings consistently pointed to a preference for active, feedback-rich interactions over passive, invisible ones, even at the cost of objective speed.

5.1 Quantitative Analysis: Efficiency and Usability Scores¶

Objective performance and satisfaction metrics showed clear and sometimes counter-intuitive differences between the three modalities.

A Repeated-Measures ANOVA conducted on the Time-on-Task data revealed a significant difference in check-in duration between the methods (p < .001). Contrary to expectations of passive systems being fastest, the active Dynamic QR was the slowest method (M=6.36s), followed by the Biometric Selfie (M=3.20s). The passive BLE method was functionally instantaneous (M=0.00s) once a connection was established, but its connection time varied significantly.

The System Usability Scale (SUS) scores provided a clear measure of user satisfaction. The Dynamic QR method achieved the highest score, indicating excellent usability, while the BLE method scored in the failing range. An ANOVA on the SUS scores confirmed that the Dynamic QR method significantly outperformed the BLE method (p < .001).

5.2 Qualitative Analysis: User Preference and Perceptions¶

When asked which method they would prefer to use for an entire semester, participants showed a decisive preference. A strong majority of participants (75%) chose Dynamic QR, 25% chose Biometric Selfie, and 0% chose BLE.

User experience ratings, collected on a 1-5 scale, further illuminated the reasons for this preference. The Dynamic QR code was perceived as the most efficient and comfortable method, while the Biometric Selfie was rated as the most trustworthy. The passive BLE method scored poorly on both perceived efficiency and trust.

The core issue with the passive BLE system was crystallized in feedback from the post-study interviews. As participant P3 stated:

"I like knowing that I'm checked in. With Bluetooth, I just have to hope."

This quote encapsulates the deep-seated user need for confirmation and control, which the invisible nature of the passive system failed to provide. A deeper interpretation of these combined results follows in the discussion.

6. Discussion¶

When interpreted through the HCI and privacy frameworks established in Section 2, the results of the Tendy pilot study provide strong empirical evidence for the superiority of active, user-controlled attendance systems in educational settings. The findings reveal a powerful user preference for agency and feedback, so much so that users overwhelmingly favored the slowest, most deliberate method over faster, automated alternatives.

6.1 The Paradox of 'Invisible Friction'¶

The unequivocal failure of the BLE modality is the study's most telling finding. Despite being designed for "zero-friction" interaction, the system's passive nature and lack of a feedback loop created a powerful form of "invisible friction." This friction was not physical but cognitive, manifesting as the mental load of uncertainty, doubt, and anxiety. This lack of confirmation created a "feedback void," leaving users with a low-grade "confirmation anxiety" and a fear of the public failure or "startle response" that would occur if the system silently failed.

Furthermore, the high variance in its connection time made the system feel unpredictable. This directly connects to the "Trust Calibration Model," as the inconsistency triggers a "trust crash." Users experienced both success and failure with no discernible change in their own actions, making the system feel arbitrary and unreliable. They interpreted this invisibility and signal variance not as seamlessness, but as failure, resulting in its dismal SUS score and complete rejection in the semester-long preference survey.

6.2 The 'Privacy Tax': Friction as a Feature¶

In stark contrast, users accepted the significant interaction friction of the Biometric Selfie method. It was rated as the most trustworthy method (5.0/5), even though its comfort level (4.25/5) was lower than that of the QR code (5.0/5). This acceptance can be understood as a willingness to pay a "Privacy Tax"—an interaction cost, including time and social awkwardness, in exchange for the high assurance of integrity and security.

This finding suggests that friction is not inherently negative. The data provides a direct measurement of this "tax": users traded a quantifiable 0.75 points of comfort for a quantifiable gain in trust. When the purpose of the friction is transparent and provides a clear benefit that the user values (in this case, ensuring that no one can cheat the system), it becomes an acceptable, and even desirable, feature.

6.3 The Primacy of Agency and Feedback¶

The success of the Dynamic QR method is the most profound finding of this study, as it was objectively the slowest method yet was overwhelmingly preferred by users. This demonstrates that its ability to strike an optimal balance within the usability-security-privacy trilemma is valued more than raw speed. Its active nature transforms the act of checking in into a "ritual of consent." By requiring the user to initiate the scan, the system preserves a fundamental sense of agency and control.

Crucially, this action is met with immediate, unambiguous feedback, satisfying the user's need for visibility of system status and closing the Gulf of Evaluation. This tangible confirmation loop provides psychological closure and eliminates the anxiety that plagued the passive BLE system. The study's results strongly indicate that this sense of agency and certainty is far more valuable to users than the promised convenience of invisible automation.

7. Future Directions and Implications for Educational Technology¶

The lessons learned from the Tendy project not only inform the technical evolution of this specific system but also suggest a clear trajectory for the future design of attendance systems and other educational technologies. The findings point toward an architectural and ethical framework that prioritizes user trust and control over surveillance-based automation.

7.1 Technical Evolution¶

Based on the pilot study, several technical improvements are planned for the Tendy system. To address potential connectivity issues in large lecture halls, we will implement an "Offline-First Architecture." This will involve using on-device cryptographic signing (e.g., Ed25519) to create a verifiable proof of presence that can be cached and uploaded later when a network connection is available. Furthermore, to enhance the security of proximity-based methods, we plan to integrate geofencing as a secondary factor to augment the reliability of BLE signal strength.

7.2 Architectural and Ethical Imperatives¶

Broadening the discussion beyond the Tendy project, our findings strongly support an industry-wide shift away from surveillance-based passive tracking technologies in educational settings. The user anxiety and trust deficit created by "invisible" systems suggest that their potential for harm outweighs their convenience.

Instead, we advocate for the adoption of Privacy-Preserving Architectures that can provide verification without requiring centralized data collection. These architectures are not just future technologies but direct solutions to the "coercive environment" and "cynical compliance" problems defined in our theoretical framework. Emerging technologies like Zero-Knowledge Proofs (ZKP) offer a path to mathematically prove presence without revealing a student's identity to the verification server. Similarly, leveraging on-device processing (Edge AI) for tasks like biometric matching ensures that sensitive data never leaves the user's control. These approaches resolve the core dilemma of the privacy calculus by offering security without surveillance. The ethical design of EdTech must be rooted in principles of transparency, user control, and data justice, building tools that empower rather than monitor.

8. Conclusion¶

This paper set out to analyze the critical trade-offs between active and passive authentication paradigms in digital attendance systems. Through the development and evaluation of the multi-modal Tendy project, we have demonstrated that the theoretical ideal of a frictionless, invisible system fails to meet the practical and psychological needs of users in an educational context. The key findings reveal that the "invisible friction" of passive BLE systems—characterized by a lack of feedback and inherent unreliability—renders them less usable and less trustworthy than active QR-based systems that preserve user agency, even when the active systems are objectively slower. While biometrics offer the highest level of security, they impose a significant "social cost" that must be carefully weighed against their benefits. Ultimately, the future of effective and ethical educational technology lies not in perfecting invisible surveillance, but in designing transparent, user-centric tools that empower students and foster a trusted, collaborative learning environment.

9. References¶

Hutchinson, J. L. (2022). The Perception of Automation Reliability and Acceptance of Automated Advice in a Maritime Classification Task. University of Western Australia.

Nielsen, J. (1994). 10 Usability Heuristics for User Interface Design. Nielsen Norman Group.

Norman, D. A. (1986). Cognitive engineering. In D. A. Norman & S. W. Draper (Eds.), User Centered System Design: New Perspectives on Human-Computer Interaction (pp. 31-61). Lawrence Erlbaum Associates.

Portolano Cavallo. (2021). The Italian Data Protection Authority fines Italian university Bocconi for unlawful processing of students' personal data. Retrieved from portolano.it.

Stone, A., & Landau, M. (2023). Tracking technology: exploring student experiences of surveillance in a UK university. Educational Review, 1-18.