Developer Adds Device-Bound Authentication to Block Proxy Attendance Loopholes

A developer building a student attendance system identified a gap where shared account credentials — not just shared QR codes — could enable fraudulent check-ins from unauthorized devices. To address this, they implemented device-bound authentication, linking each student account to a single trusted device via a persistent identifier stored on the backend. Every attendance request now passes through multiple verification layers: user authentication, dynamic QR validation, and device identity checks. The backend makes the final trust decision, preventing clients from self-certifying their own device legitimacy. The developer acknowledges the mechanism is not foolproof but aims to make casual proxy attendance significantly harder while keeping the experience smooth for legitimate users.