You are the security officer for the Coding Club's new app. Years 7–8: why passwords fail, how a second factor protects an account, spotting phishing, and keeping a digital footprint small. Years 9–10: a threat model of the app, the three kinds of weakness, and the Australian Privacy Principles. Then a security review: find and fix every weakness to earn the flags. Everything is defensive and fictional.
★ Challenge completeYears 7–8: passwords, second factors, phishing and your digital footprint.
Passwords fail in three predictable ways: a site leaks its list, one password reused everywhere lets that leak open every account, and common or personal passwords are on the lists people try first. Long random passphrases, a different one for every site, fix it.
Multi-factor authentication asks for something you have (a phone, a security key) or are (a fingerprint) as well as something you know. A leaked password alone is no longer enough. Codes can still be tricked out of you by a fake sign-in page; a security key only answers the real site.
Phishing messages pretend to be someone you trust to get a password, money or a click. The signs: a sender address that isn't quite right, pressure or a deadline, a request for a password or payment, and a link that goes somewhere other than its text. When unsure, go to the site or person yourself.
Your digital footprint is everything apps record about you: what you give them, and what they collect as you use them (where you are, what you open, when). A good app collects only what its purpose needs. You manage your own footprint by checking settings, which often start open.
Years 9–10: threat models, kinds of weakness and the Australian Privacy Principles.
A threat model follows the data through a system on a data-flow diagram: where it travels, where it is stored, and who can change it. Each point has its own risk (read on the way, copied from storage, used by the wrong person) and its own defence (HTTPS, hashing and encryption, access control and MFA). One defence doesn't cover them all.
Systems have three kinds of weakness. Software: a flaw in the app's own code (fix: update and test). User: what people do, like weak or shared passwords or being tricked (fix: training, strong passwords, MFA). Supply chain: something the app relies on, like an add-on or library, goes bad (fix: check and update what you rely on). Perfect code alone doesn't make a system safe.
The Australian Privacy Principles (APPs) say what organisations must do with personal information: collect only what they need (APP 3), tell people what and why (APP 5), use and share it only for that purpose unless people agree (APP 6), keep it secure (APP 11), and let people see and correct it (APP 12). A privacy policy doesn't override them.
Inspect the club app, fix every weakness, collect the flags.
Before the club app launches, review it like a security team: inspect its accounts, its data and its system, choose the fix that really closes each weakness, and collect a flag for each section you make safe. Everything from the course comes together: unique passphrases and MFA, collecting only what is needed, hashed passwords, a real privacy notice, HTTPS and updates.
Progress is saved in this browser only. Nothing is sent anywhere.
For teachers: Teacher guide (notes, answers, solutions, slides and worksheets)