I recently came across a product called Writers Lock, a web app aimed at educators who are trying to prevent students from cheating (by AI assistance or otherwise). They claim to “prevent cheating” by forcing students to use their locked-down text editor. But is this an effective tool that prevents cheating? I have my doubts.

This website boldly claims to “prevent cheating” but I don’t know if that’s possible with their current software design. I’m not sure if it’s even possible to prevent any cheating from a web app like this. There is a fundamental design flaw that can’t be remedied by tacking on more client-side code: the webapp is limited to trusting the browser. I was able to spend a few minutes writing code that completely and trivially bypasses their safeguards on their demo. I was able to bypass the fullscreen detection, copy-paste prevention, and tab changing detection by simply executing a script in dev tools. I think it is disingenuous to state Writers Lock can “prevent cheating” when it is so easily broken.

Students can easily get past their safeguards in several different ways. Pick your favorite option:

  • (1) loading a userscript before Writers Lock’s script initialization that prevents propagation of events,
  • (2) loading a userscript that overwrites the prototype of events or other objects,
  • (3) using the browser dev tools to remove Writers Block’s event listeners (probably the easiest option),
  • or (4) proxying the request (MITM) and injecting a little snippet to do something similar as the others

I’ve seen what students today can achieve and there is no doubt in my mind that students will bypass these restrictions with little effort, if they have not done so already. I am sure students can conjure a bypass script in minutes using an AI chatbot.

Of course, these simple bypasses only work if the student has some amount of control over their browser. For example, students can only execute these bypasses if a BYOD policy is in place or if the school has insufficient IT policies.

But! I can really only imagine Writers Block being used in a BYOD environment. School districts that do not have BYOD policies, and instead provide devices, are generally required by law in to monitor students’ online activity, e.g. using GoGuardian or other similar programs. Monitoring suites like GoGuardian can typically already prevent students from switching tabs and can lock down the students’ activities, likely moreso than Writers Lock’s abilities. Districts are also required by law to filter internet content, and presumably could block AI assistants using that same filter.

So who is the target market for Writers Lock? It’s easily bypassed in a BYOD environment and it seems to become redundant with a school-provided device. You either control the students’ devices or you do not. And if you do not control the device, you absolutely cannot prevent cheating.