Multi-factor authentication asks for something you have (a phone, a security key) or are (a fingerprint) as well as something you know. A leaked password alone is no longer enough. Codes can still be tricked out of you by a fake sign-in page; a security key only answers the real site.
Ava's passwords have all leaked. Can she still keep her accounts?
Your mission: the worst has happened. Every one of Ava's passwords is on a leaked list. Keep her accounts hers anyway.
Engage: Commit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Explore: Try it on the board and compare what happens with your prediction.
Explain: Put a name to what you saw, and why it works.
Elaborate: Use the idea in a new situation.
Evaluate: Look back at your first ideas and what changed.
Make your prediction first. Help opens once you've locked it in.
EngageCommit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Engage: the password is out
ExploreTry it on the board and compare what happens with your prediction.
Explore: keep the accounts
Was your prediction right?
Try it yourselfYour edits are saved in this browser.
Press Attempt: someone tries the leaked passwords. What happens?
Use the board. This ticks when you get there.
Give every account a second factor, then try again.
Use the board. This ticks when you get there.
ExplainPut a name to what you saw, and why it works.
Explain: something you know, have or are
Multi-factor authentication (MFA) asks for two different kinds of proof:
Worked exampleBefore each step, say what you think comes next.
something you knowA password or PIN. This is the part that leaks.
something you haveA phone (an SMS or app code) or a security key you plug in or tap.
something you areA fingerprint or face, usually to unlock the phone or key.
two kinds⇒a leak isn’t enoughSomeone with the password still needs the thing Ava has.
Find the mistake
Sam decides which accounts need a second factor. Click the line where it first goes wrong.
ElaborateUse the idea in a new situation.
Elaborate: the fake page
Try it yourselfYour edits are saved in this browser.
Give every account an SMS or app code. Then switch on the fake sign-in page (Ava types her code into it) and attempt.
Use the board. This ticks when you get there.
With the fake page still on, protect every account.
Use the board. This ticks when you get there.
ElaborateUse the idea in a new situation.
Elaborate: one key
Try it yourselfYour edits are saved in this browser.
Need a hint?
Which account would hurt most to lose? Email can reset all the others.
Another hint
Key on the school email; app codes on the rest.
Ava has one security key. Use it where it matters most, give every other account a code, and attempt with the fake page off.
Use the board. This ticks when you get there.
EvaluateLook back at your first ideas and what changed.
Evaluate: look back
For teachers
Students watch leaked passwords open every account, then add second factors (SMS, app code, security key), see codes tricked out by a fake sign-in page, and protect the most important account with a key (AC9TDI8P13 node 2). A 5E mission lesson. About 40 minutes.
I can explain what multi-factor authentication adds to a password.
I can name the three kinds of factor.
I can choose second factors for accounts, most important first.
Before class
Try the board yourself.
The one idea: a second, different kind of proof means a leaked password alone isn't enough.
Simplifications: the board shows the outcome, not how a fake page works; real security keys and passkeys check the site's address, which is why they resist fake pages. SMS codes can also be lost to SIM swapping; mention it only if asked.
Unplugged: a locker with a combination lock and a key lock together.
Running the lesson
Engage: ask what the attacker would still be missing.
Explore: ask why every account fell in the first attempt.
Explain: list know, have, are on the board with examples from students' lives.
Elaborate: ask what the key knows that Ava might not (which site is asking).
Evaluate: discuss the phone call: what made it convincing?
The hard part (on purpose)
The fake-page task makes codes look weak. Keep the balance: codes stop leaked passwords, which is most attacks; keys also stop fake pages.
When students get stuck
A student says MFA is only for important accounts (Sam's mistake). Ask: What could someone do with your game account? Fix: Message friends, spend money, reset other accounts: MFA wherever it's offered.
A student puts keys on everything in the Make. Ask: How many keys does Ava have? Fix: One: the account that resets the others (email).
Stretch and support
Stretch: Find out what a passkey is and how it differs from a password plus a code.
Support: A card: know (password), have (phone, key), are (fingerprint). Two different kinds = MFA.
Where it leads
Next: Spot the phish.
What each step is for
Engage: the password is out: Committing to whether a leaked password is enough tests the new move: a second factor is something the attacker doesn't have.
Explore: keep the accounts: Students watch a leaked password open everything, then add second factors until nothing opens.
Explain: something you know, have or are: The teacher models the three kinds of factor and names why a second one blocks a leaked password. Sam leaves an account unprotected, the misconception planted after the method.
Elaborate: the fake page: One change: a fake sign-in page that asks for the code as well. Codes typed into it can be passed on; a security key only answers the real site.
Elaborate: one key: Choosing factors under a limit (one security key) reverses the process: from what matters most to the protection it gets.
Now you can
Explain what multi-factor authentication adds to a password.
Name the three kinds of factor.
Choose second factors for accounts, most important first.