Students will learn how to keep their online information more secure by using and maintaining strong passwords. Students will learn about the principles of strong password design and the potential problems of password sharing. They will also learn how to keep their passwords safe and how to take steps to prevent unauthorized access to their accounts.
Ready?
Begin Lesson
We often don’t think a lot about the passwords we use for websites, apps, and services. However, how good your passwords are, determines how secure your information will be.
Engage students in a discussion using the following questions. Please remind students that it’s important not to share their actual passwords during this or any other exercise.
Organize students into pairs.
Along with your partner, discuss what might happen if someone who wanted to cause trouble learned the password to your favorite social media platform.
Give students five minutes to discuss and ask the groups to share out.
Now talk with your partner about what would happen if a hacker learned the password to your parent’s/guardian’s online banking account.
Give students 5 minutes to discuss. Then, ask the groups to share what they discussed.
You might be wondering how a hacker could learn a private password. There are a few ways; one way is through social engineering — or tricking someone into sharing their password. A hacker can do this by sending an email that looks like it legitimately came from a platform or website where someone has an account. The email might ask the person to click on a link and log in with their username and password; when the person logs in, this information is now available to the hacker.
Hackers sometimes try to guess passwords by using common phrases like “password123,” “test,” or your first or last name. Another way that hackers learn a private password is through what is called a brute force attack. A brute force attack occurs when a hacker tries to log in to your account by repeatedly trying various passwords. While a hacker can conduct a brute force attack by hand, it is often done by running a computer program that rapidly and automatically tries every possible combination of passwords it can think of — for example, a list of likely passwords or a set of passwords consisting of combinations of different letters and numbers — until it finds the right passcode.
Of course, some brute force attacks are more sophisticated. If your password is on a list of likely passwords, like “QWERTY” or “12345,” then some programs can guess it faster by trying those options before less likely ones or randomized possibilities. The attack can also be more refined if the hacker knows information about you. If, for example, hackers know your name, they may try your name with different variations of numbers at the end (e.g., “Issam2005,” or “Issam3020”).
The goal of this example is to show students passwords that are easy to hack, so they understand the need for strong passwords. The password examples can be further localized to reflect common passwords in the area you are teaching.
A strong password helps protect your information. While having a strong password doesn’t guarantee that your account won’t be hacked, having a weak password makes it much easier for someone to access your information.
After students provide their input, write these instructions on the board:
There are two approaches to creating strong passwords. The first is to follow a “password recipe” like this one on the board. Using such a recipe encourages you to include harder-to-guess elements in a text/numerical password, making the password itself harder to guess. The drawback of this approach is that it makes passwords harder to remember.
Another approach to creating strong passwords is connected to password length. Because password strength is related to password length, using a string of four or more unrelated words makes passwords much harder to guess for humans and brute force attacks. This method has the added benefit of resulting in passwords that are easier to remember than the recipe method.
Lastly, one can use a combination of these two methods by coming up with a string of four or more unrelated words, also including symbols and numbers. The goal of these different methods is the same: developing passwords that are unique and difficult for other people to guess.
Organize students into pairs.
In pairs, try to create a strong password using the instructions you wrote on the board earlier. Remember that a password that is hard for a computer to guess randomly might still be easy for a human or a computer with a list of common long passwords to guess. The piece of paper with your password won’t be collected at the end of the activity. You are encouraged not to actually use this password for one of your accounts, as those in the group will know it.
Give students five minutes to do this. Then go around the room and ask students what they think their strongest password examples are. Ask students if they can remember the passwords they generated without looking at them directly.
While some websites will require your password to meet a few (or all) of these conditions, others have no such restrictions. You can also create passwords using a string of random common words.
In the same pairs, have students create new passwords that are strings of words. Tell them there should be at least four words in the password to make it both strong and easy to remember. Give students five minutes to do this. Then go around the room and ask students what their password examples are. Again, remind students that the sheet of paper won’t be collected at the end of the activity, nor should the password be used for any of their accounts.
Some websites use a system called multi-factor (or two-factor) authentication to verify your identity. These websites often use text messaging, an app, or email to send a one-time code that must be entered along with the password.
This method can make your accounts much safer by adding an extra layer of security that is far more difficult to break. For instance, to log into your account, a person must have your password and access to the app, device, or email address associated with the account.
Even if you create a password that is really tough for a computer or person to crack, there are other ways a password can be weak.
Even good passwords can be compromised or stolen, but there are things you can do to protect yourself. If there is a data breach on a website where you have an account, make sure to change your password on that website as well as any other websites where you use similar passwords. Remembering a lot of long and complicated passwords can be difficult.
Mention possibilities like someone finding the piece of paper or noticing the file on your computer. Explain that one approach is to use a password manager, an application that helps users save and organize their passwords.
Every day, we use a lot of different accounts on different websites. It can get complicated to log in and sign out of every website every time.
In this case, even though your password in the password field may be hidden by black dots or asterisks, other people using your computer can potentially figure out what your password is. Just because you can’t see what the password is on the screen doesn’t mean it’s not stored somewhere.
This example is intended to show students common websites where people might think it is okay to share their passwords. The password examples can be further localized to reflect common passwords in the area you are teaching.
You may choose to share your password with someone you care about but caring about them does not necessarily mean that they deserve full access to your online accounts.
Think carefully about your relationship with that specific person before you share, including how that relationship might change over time. For instance, sharing with a parent/guardian is a very different choice than sharing with your best friend.
Students should reflect on their own behavior when using a shared account. They should consider that their online activity is on display for other users on the account.
Discuss the possibility of someone pretending to be you and sending messages to your friends.
Organize students into pairs.
In your pairs, discuss whether you have ever logged onto a computer at school or in another community setting and saw that someone else was still logged onto their social media or email account. Ask them to consider if they would look around the account or do anything else.
Give students five minutes to discuss, then ask them to share. Engage the group in a discussion about such unauthorized use.
Please note: Part of the content of this activity has been covered in “Activity #1: Password Basics.” We defer to your judgment regarding whether or not you would like to go over this material again or skip it.
It is possible for others to access your account, even without already knowing or succeeding with a random guess of your password. If someone knows enough personal information about you, they might be able to make educated guesses about your password, or they might convince someone at a company to hand over your information. Because they’re not using technology to break into your accounts, this kind of attack is called social hacking or social engineering.
Posting information that contains the answers to your security questions can be very unsafe. Make sure to choose security questions that have answers only you know.
You can also make up answers to security questions, as long as you save them in a password manager or they’re easy to remember. Websites might contact users using a phone number or email associated with the user’s account. If a user forgets their password, websites often provide a temporary password or hyperlink that the user can use to reset their password.
Social hacking can be accomplished by people contacting you directly and trying to trick you into giving them your information. Sometimes, people will send you an email pretending to be someone else (such as a friend, a family member, or someone from the bank) and ask you to share important information with them (such as your birthdate) to verify your identity. This can also be more subtle, like if someone hacked your friend’s social media account and messaged you (and potentially many others) asking about your birthday or where you grew up. If you receive any messages from your friend that appear odd, you may first want to reach out to your friend (outside of the social media platform) to determine if they are actually sending the content.
Attacks that use a real-looking email or website are called phishing and can lead to identity theft. For instance, an identity thief may open up credit cards in your name and use them, which could make it hard for you to get a credit card when you’re older. Phishing can allow the thief to impersonate you and access more information, allowing them to snoop through your emails, message your friends while pretending to be you, or steal your money. This process could also allow the thief to block you from your account by creating a new password that you do not know.
Ask students to answer the following questions and add their responses in the form of text or visuals to the “Learning About Passwords” handout.
Congrats!
You've finished the lesson
Students will learn how to keep their online information more secure by using and maintaining strong passwords. Students will learn about the principles of strong password design and the potential problems of password sharing.
View Page
Students will learn about malicious online users who might attempt to use security weaknesses to gather information about them.
View Page
Students will learn what information verification is and why it is important for news consumers to verify the stories they read or view.
View Page
Students will learn about a five-step checklist they can use to verify the origin, source, date, location, and motivation of a news image or video.
View Page
Students will define what a scrape (a copy from an original) is and explain why this can make the verification process more difficult.
View Page
Students will learn how to keep their online information more secure by using and maintaining strong passwords. Students will learn about the principles of strong password design and the potential problems of password sharing.
View Page
Students will learn about malicious online users who might attempt to use security weaknesses to gather information about them.
View Page
Students will learn what information verification is and why it is important for news consumers to verify the stories they read or view.
View Page
Students will learn about a five-step checklist they can use to verify the origin, source, date, location, and motivation of a news image or video.
View Page
Students will define what a scrape (a copy from an original) is and explain why this can make the verification process more difficult.
View Page
Download Selected
Print All
Previous Lesson 