A little over 10 years ago I asked a question:

Authenticating a client to a server

The gist of the question was whether or not a server could absolutely determine whether a message came from it’s “authentic client software” or from another piece of software that was spoofing the authentic one.

There was no definitive answer, only one that relied on secrets and obfuscation. I decided at the time that there was no way to do this.

Zoom ahead 10 years.

A friend told me about this “lockdown browser” that she must use to take exams for her remote college course. It seems to be in place to prevent cheating. I looked at their marketing materials and they claim that the servers will only serve the exams to their real “lockdown browser”.

Hmmmmm, sounds like the same issue I had 10 years ago.

Have any new protocols been created to allow for this to happen with real security? Or is this company at risk of having one motivated undergraduate reverse engineer their system to provide the perfect platform for cheating?