Binary, hex and base64 are encodings: the same data written another way by a public rule. They look scrambled, but anyone can turn them back, so they hide nothing. Encryption needs a secret key as well: without it, the data can't be read. Use encryption to keep something secret, and hashing (Security and privacy) to store passwords.
The club app stored its admin password as cm9ib3RzMjAyNg==. It looks like nonsense. Is it safe?
Your mission: the club sends meeting places and stores passwords. Find out which ways of writing them actually keep them secret, before anyone else does.
Engage: Commit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Explore: Try it on the board and compare what happens with your prediction.
Explain: Put a name to what you saw, and why it works.
Elaborate: Use the idea in a new situation.
Evaluate: Look back at your first ideas and what changed.
Make your prediction first. Help opens once you've locked it in.
EngageCommit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Engage: does it look safe?
ExploreTry it on the board and compare what happens with your prediction.
Explore: get it past Eve
Was your prediction right?
Try it yourselfYour edits are saved in this browser.
Send the meeting message as base64. Can Eve read it?
Use the board. This ticks when you get there.
Send it so Eve can't read it but Ava can. Ava's key word is gears.
Use the board. This ticks when you get there.
ExplainPut a name to what you saw, and why it works.
Explain: encoding, encryption, hashing
Worked exampleBefore each step, say what you think comes next.
encodingBinary, hex, base64: the same data by a public rule. No key, so anyone can undo it.
encryptionA rule plus a secret key. Without the key, it can't be read; with it, it can.
hashingOne-way: you can check a password against it, but not turn it back. For storing passwords.
testAsk: is there a secret key? If not, it isn't secret.
Find the mistake
Sam stores the admin password. Click the line where it first goes wrong.
ElaborateUse the idea in a new situation.
Elaborate: decode it
Try it yourselfYour edits are saved in this browser.
Decode the stored admin password from the hook.
Use the board. This ticks when you get there.
A message from the club's old app. Which rule was used? Decode it.
Use the board. This ticks when you get there.
This one was encoded twice. Undo both layers.
Use the board. This ticks when you get there.
ElaborateUse the idea in a new situation.
Elaborate: Ava's reply
Try it yourselfYour edits are saved in this browser.
Need a hint?
Try the public decoders first: do any work?
Another hint
It's encrypted. You and Ava share a key word.
Ava replied with the door code, encrypted with your shared key word. Read it.
Use the board. This ticks when you get there.
EvaluateLook back at your first ideas and what changed.
Evaluate: look back
For teachers
Students send a message past an eavesdropper and find that binary, hex and base64 hide nothing (public rules) while encryption with a shared key does, then decode stored and layered data and read an encrypted reply with the key word (AC9TDI8K02 node 4). A 5E mission lesson. About 40 minutes.
I can say why binary, hex and base64 don't keep anything secret.
I can say what encryption needs that encoding doesn't.
I can choose encoding, encryption or hashing for a job.
Before class
Try the boards yourself. Every message and key word is made up.
The one idea: encoding is a public rule (no key), so it hides nothing; encryption needs a secret key; passwords are stored as hashes.
Simplifications: the board's cipher shifts each character by the letters of the key word (a Vigenère cipher). It stands in for real encryption, such as the AES behind HTTPS, whose keys are far too long to guess; a key word like gears could be guessed. Base64 is used everywhere to carry data safely through email and web pages, which is a good use of it: it was never meant to hide anything.
Links: Networks (Who can see your data?) shows what encryption is for; Secret messages (Code) builds and cracks ciphers; Security and privacy covers hashing.
Running the lesson
Engage: ask what makes something look secret.
Explore: ask why Eve could read the base64.
Explain: sort encoding, encryption and hashing by the test: is there a key?
Elaborate: ask how they knew which rule each layer used.
Evaluate: discuss the account page: what should it do instead?
The hard part (on purpose)
Layers: students expect one decoder to finish the job. Ask them to look at what came out and ask which rule could make that.
When students get stuck
A student thinks hex is secret (Sam's mistake). Ask: Did decoding it need anything secret? Fix: No key, no secret: encoding hides nothing.
A student picks a decoder at random. Ask: Which characters can each rule produce? Binary: 0 and 1. Hex: 0 to 9 and a to f. Base64: letters, digits, + and /, maybe = at the end. Fix: Match the characters to the rule.
Stretch and support
Stretch: Find base64 in the wild: open an email's raw source (Show original) and spot an attachment written as base64.
Support: A card with the three rules and their characters, and the test: is there a key?
Where it leads
Next: What your page gives away.
What each step is for
Engage: does it look safe?: Committing to whether scrambled-looking data is safe tests the new move: encoding is a public rule, and only a key keeps data secret.
Explore: get it past Eve: Students try every encoding against an eavesdropper and find only the keyed one works, failing first.
Explain: encoding, encryption, hashing: The teacher models deciding whether a form of data has a key. Sam trusts hex, the misconception planted after the method.
Elaborate: decode it: One change at a time: a single encoding, then layers of them, showing that stacking public rules still hides nothing.
Elaborate: Ava's reply: Reversing the explore: reading an encrypted reply needs the shared key, the one thing an encoding never has.
Now you can
Say why binary, hex and base64 don't keep anything secret.