Security and privacy

Apps never talk to hardware directly. They ask the operating system, and the OS uses a driver for each device, so one app works with any webcam or storage. Because every request goes through it, the OS can also decide which apps may use what.

1. A new webcam
2. Try: swap the hardware
3. Worked example: one request › Through the layers
4. Worked example: one request › Find the mistake
5. Worked example: one request › The gatekeeper
6. Vary: change one thing › No driver
7. Vary: change one thing › Driver installed
8. Vary: change one thing › Refused
9. Vary: change one thing › Allowed
10. Practise: the OS › Saving anywhere
11. Practise: the OS › App permissions
12. Practise: the OS › Review: packets
13. Set up a new computer

Every device on the internet has an IP address, and every packet carries the address it is going to. DNS turns a name like school.edu.au into that address, and routers use their tables to send each packet the right way. A name that only looks right gets a different address, and a different computer.

1. One letter different
2. Try: look them up
3. Worked example: following a name › school.edu.au
4. Worked example: following a name › Find the mistake
5. Worked example: following a name › Private and public
6. Vary: one name at a time › Part of the school
7. Vary: one name at a time › Another site
8. Vary: one name at a time › No such name
9. Vary: one name at a time › Reading the table
10. Practise: names and addresses › Real or not?
11. Practise: names and addresses › IP addresses
12. Practise: names and addresses › Review: HTTPS
13. Check before you click

Access control has two parts. Authentication proves who you are (a password, and with multi-factor sign-in a code from your phone too). Authorisation (permissions) then decides what you may do. Give each role only what its job needs: least privilege.

1. Signed in, but…
2. Try: sign in and try
3. Worked example: two checks › One request, two checks
4. Worked example: two checks › Find the mistake
5. Worked example: two checks › Why multi-factor?
6. Vary: one change at a time › A teacher
7. Vary: one change at a time › Wrong password
8. Vary: one change at a time › Multi-factor
9. Vary: one change at a time › The admin role
10. Practise: access control › Sort them
11. Practise: access control › Strong passwords
12. Practise: access control › Review: DNS
13. Least privilege

Good sites never store your password. They store a hash: a one-way scramble that is always the same for the same password, so a login can be checked, but can't be turned back. A salt makes the same password hash differently for each person. Public key encryption works like an open padlock: anyone can lock a message with it, but only the owner's private key opens it.

1. A stolen list
2. Try: sign in with a hash
3. Worked example: hashes and padlocks › Two tools
4. Worked example: hashes and padlocks › Find the mistake
5. Worked example: hashes and padlocks › Padlocks
6. Vary: one change at a time › Salt
7. Vary: one change at a time › Alice's padlock
8. Vary: one change at a time › Bob's own padlock
9. Vary: one change at a time › No padlock
10. Practise: hashes and keys › Emailed passwords
11. Practise: hashes and keys › Passphrases
12. Practise: hashes and keys › Which key?
13. Practise: hashes and keys › Review: access
14. A strong passphrase

A security team tests a system before attackers do. Use everything from this course to find four weaknesses in a school portal (a lookalike link, a weak password, a wrong permission and an unlocked message), capture a flag for each, then fix the portal and match each weakness to its fix.

1. Why test your own system?
2. Try: a suspicious email
3. Capture four flags › Flag 1: the real address
4. Capture four flags › Flag 2: the weak password
5. Capture four flags › Flag 3: the wrong permission
6. Capture four flags › Flag 4: the right key
7. Fix: secure the portal
8. The report