When passwords fail

Passwords fail in three predictable ways: a site leaks its list, one password reused everywhere lets that leak open every account, and common or personal passwords are on the lists people try first. Long random passphrases, a different one for every site, fix it.

A game site Ava used once has just been hacked. Is her school email safe?

Your mission: you are the Coding Club's new security officer. Your first job: help Ava, a member, keep her accounts safe.

Engage: Commit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Explore: Try it on the board and compare what happens with your prediction.
Explain: Put a name to what you saw, and why it works.
Elaborate: Use the idea in a new situation.
Evaluate: Look back at your first ideas and what changed.

EngageCommit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.

Engage: one leak

Ava uses the password sunshine1 for her school email, a game site, the club app and an online shop. The game site leaks its passwords. How many of her accounts are now open to someone else?All fourJust the game siteNone: the passwords were secretTwo: the game site and the shop

ExploreTry it on the board and compare what happens with your prediction.

Explore: stop the spread

Was your prediction right?

Need a hint?

What would stop the game site's password working on her other accounts?

Another hint

Give each account a different passphrase, then press Leak! again.

Try it yourselfYour edits are saved in this browser.

Press Leak! How many of Ava's accounts fall?

Use the board. This ticks when you get there.

Change Ava's passwords so the next leak only reaches the game site itself. Then leak again.

Use the board. This ticks when you get there.

ExplainPut a name to what you saw, and why it works.

Explain: why passwords fail

What you just did has names. A breach is when a site's data leaks. Reuse turns one breach into many. Some passwords never needed a breach: they are guessable.

Worked exampleBefore each step, say what you think comes next.

$\text{1. a site leaks}$ You can't stop other sites being breached; you can limit the damage.
$\text{2. reuse spreads it}$ The leaked password is tried on every other site. One password everywhere means one leak opens everything.
$\text{3. guessable falls first}$ Common passwords, symbol swaps and personal details (names, birthdays, pets) are on the lists tried first.
$\text{fix: long, random, different}$ Four random words for each site, kept in a password manager so you don't have to remember them.

Find the mistake

Sam makes a stronger password. Click the line where it first goes wrong.

ElaborateUse the idea in a new situation.

Elaborate: a new set of problems

Try it yourselfYour edits are saved in this browser.

Ava changed her passwords, but a leak still opens all four. Fix them so a leak only reaches the game site.

Use the board. This ticks when you get there.

Check: is there now any account someone could guess without a leak at all?

Use the board. This ticks when you get there.

ElaborateUse the idea in a new situation.

Elaborate: let a manager do it

Try it yourselfYour edits are saved in this browser.

Need a hint?

Nobody can remember four random passphrases, and then forty.

Another hint

Use the password manager, then leak again.

Ava says she can't remember four passphrases. Switch on the password manager and test it with a leak.

Use the board. This ticks when you get there.

EvaluateLook back at your first ideas and what changed.

Evaluate: look back

A site you use emails you: it has been breached. What should you do first?Nothing: it's the site's problemChange that password, and any other account where you used the same oneChange only the breached site's passwordDelete your email account

I can explain how one leak can open many accounts, and why a different long passphrase for each site stops it.

For teachers

Students watch one leaked password open all of Ava's accounts, then stop the spread with a different long passphrase for each account and a password manager (AC9TDI8P13 node 1). A 5E mission lesson. About 40 minutes.

Open the teacher guide: answers, solutions, slides and a worksheet.

Students will be able to

I can explain how a password gets out, and why reusing one makes it worse.
I can say what makes a password hard to guess.
I can set up accounts so one leak stays at one site.

Before class

Try the board yourself. Every name and address is made up.

The one idea: one leak spreads through reuse, and guessable passwords fall without any leak. Fixes: a different long passphrase for each site, kept in a password manager.

This is a 5E mission lesson: Explore has a goal and the first attempt fails on purpose. Model the Explain live: replay the leak on the board and name each part (breach, reuse, guessable). Avoid asking students about their own passwords; talk about Ava's.

Unplugged: hand out a key ring with one key that opens every door, then ask what happens when one copy is lost.

Running the lesson

Engage: ask who picked "just the game site"; let Explore answer it.
Explore: ask what had to change for the leak to stop at one account.
Explain: replay the leak; name breach, reuse and guessable as each appears.
Elaborate: ask which of Ava's new passwords failed for which reason.
Evaluate: collect answers to the breach question; link to MFA next lesson.

The hard part (on purpose)

Students want a rule ("8 characters with a symbol"). Let the board show that a symbol swap still falls, and point at length and difference instead.

When students get stuck

A student thinks P@ssw0rd! is strong (Sam's mistake). Ask: Pick it on the board. What does it say about guessing it? Fix: Symbol swaps are on the lists; length and randomness count.
A student uses one strong passphrase for everything. Ask: Press Leak! What happens to the others? Fix: Strong but reused still spreads; each account needs its own.

Stretch and support

Stretch: Look up whether passkeys could replace passwords. What would a leak of a passkey site expose?

Support: A card: long (four random words), different for every site, kept in a password manager.

Where it leads

Next: A second lock (MFA).

Teacher note: the eSafety Commissioner and the Australian Cyber Security Centre both publish student-friendly guidance on passphrases (check current pages before linking).

What each step is for

Engage: one leak: Committing to how far one leak spreads sets up the new move: reuse turns one breach into many, and guessable passwords fall anyway.
Explore: stop the spread: Students make the leak stop at one account, discovering both fixes: a different password for each site, and passwords that can't be guessed.
Explain: why passwords fail: The teacher models the three ways a password fails, naming what students just saw. Sam's symbol swap comes after the method.
Elaborate: a new set of problems: The same idea in a new case: Ava's new passwords fail in two different ways (reuse and guessable), one change at a time.
Elaborate: let a manager do it: Students set up the habit that makes good passwords realistic: a password manager makes and remembers a different passphrase for every account.

Now you can

Explain how a password gets out, and why reusing one makes it worse.
Say what makes a password hard to guess.
Set up accounts so one leak stays at one site.

Next lesson2. A second lockMulti-factor authentication asks for something you have (a phone, a security key) or are (a fingerprint) as well as something you know. A leaked password alone is no longer enough. Codes can still be tricked out of you by a fake sign-in page; a security key only answers the real site.

Source: content/systems/cyber/passwords/lesson.md