---
title: "A second lock"
subtitle: "Cyber safety and privacy · Protect your accounts · Lesson 2"
---

# A second lock

**Name:** {{field-24}} **Date:** {{field-15}} **Class:** {{field-15}}

> **Key question:** Ava's passwords have all leaked. Can she still keep her accounts?


:::teacher-note

**In one sentence:** Students watch leaked passwords open every account, then add second factors (SMS, app code, security key), see codes tricked out by a fake sign-in page, and protect the most important account with a key (AC9TDI8P13 node 2). A 5E mission lesson.

**Students should be able to say:** I can explain what multi-factor authentication adds to a password. I can name the three kinds of factor. I can choose second factors for accounts, most important first.

**Width:** the unmarked parts are the floor every student does (Engage, Explore, Explain, Evaluate). Typical and Wider sections add contexts, not difficulty. Students work in the online tutorial alongside this sheet.

:::


## Engage


:::keep-together

**Ava's school email password has leaked, but she has turned on codes sent to her phone. Someone types in her password. What happens?**

☐ They are asked for the code, and they don't have her phone, so they're stopped

☐ They get straight in: they have the password

☐ Ava's phone gets the password

☐ The account is deleted

My prediction, and why:

{{lines-3}}

:::


:::teacher-note

**What happens:** Stopped. The password is only half; the code comes to Ava's phone, which they don't have.

:::


## Explore

Try it on the board in the tutorial. Was your prediction right? What was different?

{{lines-2}}

## Explain: something you know, have or are

**Multi-factor authentication** (MFA) asks for two different kinds of proof:

1. $\text{something you know}$ — A password or PIN. This is the part that leaks.
2. $\text{something you have}$ — A phone (an SMS or app code) or a security key you plug in or tap.
3. $\text{something you are}$ — A fingerprint or face, usually to unlock the phone or key.
4. $\text{two kinds} \Rightarrow \text{a leak isn't enough}$ — Someone with the password still needs the thing Ava has.

### Find the mistake

:::keep-together

**Sam decides which accounts need a second factor. Click the line where it first goes wrong.**

```
 1  Sam has a second factor on the bank app.
 2  Sam's game account just has a password.
 3  Nobody would bother breaking into a game account.
 4  So nothing bad can happen if someone gets into it.
```

Line: {{field-15}}

Why is it wrong?

{{lines-2}}

:::


:::teacher-note

**Answer:** line 4

Line 4: a taken game account can message Sam's friends, spend money, and help someone guess or reset other accounts. Turn MFA on wherever it's offered.

:::


:::typical

## Elaborate: the fake page

:::


## Make: Elaborate: one key


Work in the tutorial. Plan first: what will you change, and how will you test it?

{{box-4}}

## Exit ticket

:::keep-together

**Ava's password leaks but she has an app code turned on. Explain why her account is still safe, and one way it could still be lost.**

{{lines-3}}

:::


:::teacher-note

**Answer:** The attacker doesn't have her phone, so can't get the code. She could be tricked into typing the code into a fake page or reading it out.

:::