Students watch leaked passwords open every account, then add second factors (SMS, app code, security key), see codes tricked out by a fake sign-in page, and protect the most important account with a key (AC9TDI8P13 node 2). A 5E mission lesson.
Cyber safety and privacy · Protect your accounts · about 40 minutes · Open the student lesson
Classroom resources
Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.
SlidesDownload Present from the browser, or export to PowerPoint or PDF.
WorksheetDownload Print the student copy; the Teacher edition has the answers.
Students will be able to
I can explain what multi-factor authentication adds to a password.
I can name the three kinds of factor.
I can choose second factors for accounts, most important first.
Timing
Engage and Explore 10 min · Explain 8 min · Elaborate 16 min · Evaluate 6 min
Before class
Try the board yourself.
The one idea: a second, different kind of proof means a leaked password alone isn't enough.
Simplifications: the board shows the outcome, not how a fake page works; real security keys and passkeys check the site's address, which is why they resist fake pages. SMS codes can also be lost to SIM swapping; mention it only if asked.
Unplugged: a locker with a combination lock and a key lock together.
Running the lesson
Engage: ask what the attacker would still be missing.
Explore: ask why every account fell in the first attempt.
Explain: list know, have, are on the board with examples from students' lives.
Elaborate: ask what the key knows that Ava might not (which site is asking).
Evaluate: discuss the phone call: what made it convincing?
The hard part (on purpose)
The fake-page task makes codes look weak. Keep the balance: codes stop leaked passwords, which is most attacks; keys also stop fake pages.
When students get stuck
What you will see
A question to ask
The fix
A student says MFA is only for important accounts (Sam's mistake).
Engage: the password is out: Ava's school email password has leaked, but she has turned on codes sent to her phone. Someone types in her password. What happens? Stopped. The password is only half; the code comes to Ava's phone, which they don't have.
Attempt: Press Attempt: someone tries the leaked passwords. What happens?
Every account falls: a password is all they need.
Add a second factor: Give every account a second factor, then try again.
Blocked everywhere: they have the passwords, but not Ava's phone or key.
Explain: something you know, have or are: Sam decides which accounts need a second factor. Click the line where it first goes wrong. line 4 Line 4: a taken game account can message Sam's friends, spend money, and help someone guess or reset other accounts. Turn MFA on wherever it's offered.
Codes and a fake page: Give every account an SMS or app code. Then switch on the fake sign-in page (Ava types her code into it) and attempt.
The fake page passed Ava's codes straight on: codes help, but they can be tricked out of you.
Hold anyway: With the fake page still on, protect every account.
Security keys: a key checks which site is asking and only answers the real one, so the fake page gets nothing.
Elaborate: one key: Ava has one security key. Use it where it matters most, give every other account a code, and attempt with the fake page off.
Email gets the key: whoever controls your email can reset everything else. Codes protect the rest against a leaked password.
The phone call: Ava gets a text with a sign-in code she didn't ask for. A minute later someone calls, says they're from the school and asks her to read out the code. What should she do? Refuse, hang up, and change her password: someone has it An unexpected code means someone has her password. The call is the trick for the second half.
Solutions
One possible solution for each task. Other correct programs are fine.
Elaborate: the fake page › Codes and a fake page
Open task: any program that does what the step asks.
Elaborate: the fake page › Hold anyway
Open task: any program that does what the step asks.
Elaborate: one key
Open task: any program that does what the step asks.
Stretch and support
Stretch: Find out what a passkey is and how it differs from a password plus a code.
Support: A card: know (password), have (phone, key), are (fingerprint). Two different kinds = MFA.
Exit ticket
Ava's password leaks but she has an app code turned on. Explain why her account is still safe, and one way it could still be lost.
The attacker doesn't have her phone, so can't get the code. She could be tricked into typing the code into a fake page or reading it out.
What each step is for
Engage: the password is out: Committing to whether a leaked password is enough tests the new move: a second factor is something the attacker doesn't have.
Explore: keep the accounts: Students watch a leaked password open everything, then add second factors until nothing opens.
Explain: something you know, have or are: The teacher models the three kinds of factor and names why a second one blocks a leaked password. Sam leaves an account unprotected, the misconception planted after the method.
Elaborate: the fake page: One change: a fake sign-in page that asks for the code as well. Codes typed into it can be passed on; a security key only answers the real site.
Elaborate: one key: Choosing factors under a limit (one security key) reverses the process: from what matters most to the protection it gets.