When passwords fail

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can explain how a password gets out, and why reusing one makes it worse.
• I can say what makes a password hard to guess.
• I can set up accounts so one leak stays at one site.

Timing

Engage and Explore 12 min · Explain 8 min · Elaborate 14 min · Evaluate 6 min

Before class

Try the board yourself. Every name and address is made up.

The one idea: one leak spreads through reuse, and guessable passwords fall without any leak. Fixes: a different long passphrase for each site, kept in a password manager.

This is a 5E mission lesson: Explore has a goal and the first attempt fails on purpose. Model the Explain live: replay the leak on the board and name each part (breach, reuse, guessable). Avoid asking students about their own passwords; talk about Ava's.

Unplugged: hand out a key ring with one key that opens every door, then ask what happens when one copy is lost.

Running the lesson

1. Engage: ask who picked "just the game site"; let Explore answer it.
2. Explore: ask what had to change for the leak to stop at one account.
3. Explain: replay the leak; name breach, reuse and guessable as each appears.
4. Elaborate: ask which of Ava's new passwords failed for which reason.
5. Evaluate: collect answers to the breach question; link to MFA next lesson.

The hard part (on purpose)

Students want a rule ("8 characters with a symbol"). Let the board show that a symbol swap still falls, and point at length and difference instead.

When students get stuck

Answers to the checks

1. Engage: one leak: Ava uses the password sunshine1 for her school email, a game site, the club app and an online shop. The game site leaks its passwords. How many of her accounts are now open to someone else?
   All four. Whoever has the leaked list tries the same password everywhere, and sunshine1 is on every list of common passwords anyway.
2. Leak: Press Leak! How many of Ava's accounts fall?
   
   All four: the leaked password works everywhere.
3. Stop the spread: Change Ava's passwords so the next leak only reaches the game site itself. Then leak again.
   
   With a different long passphrase on each account, the leaked one opens nothing else.
4. Explain: why passwords fail: Sam makes a stronger password. Click the line where it first goes wrong.
   line 3
   Line 3: swaps like @ for a and 0 for o are so common that they are on the guessing lists too. Length and randomness make a password strong, and it still shouldn't be reused.
5. Fix the set: Ava changed her passwords, but a leak still opens all four. Fix them so a leak only reaches the game site.
   
   Two were guessable (sunshine1, her name and year) and two shared a passphrase: every one needed a different long passphrase.
6. Guessable?: Check: is there now any account someone could guess without a leak at all?
   
   None: four different passphrases, none on any list.
7. Elaborate: let a manager do it: Ava says she can't remember four passphrases. Switch on the password manager and test it with a leak.
   
   The manager makes and remembers a different strong passphrase for each site; Ava remembers one (the manager's own), and a leak stays at one site.
8. After a breach: A site you use emails you: it has been breached. What should you do first?
   Change that password, and any other account where you used the same one
   Then turn on a second factor where you can: next lesson.

Solutions

One possible solution for each task. Other correct programs are fine.

Elaborate: a new set of problems › Fix the set

Open task: any program that does what the step asks.

Elaborate: a new set of problems › Guessable?

Open task: any program that does what the step asks.

Elaborate: let a manager do it

Open task: any program that does what the step asks.

Stretch and support

Stretch: Look up whether passkeys could replace passwords. What would a leak of a passkey site expose?

Support: A card: long (four random words), different for every site, kept in a password manager.

Exit ticket

Ava's game site leaks. Name two things that would have kept her other accounts safe.

A different password on each account; long, random passphrases (not on any common list); a password manager to make and remember them.

What each step is for

• Engage: one leak: Committing to how far one leak spreads sets up the new move: reuse turns one breach into many, and guessable passwords fall anyway.
• Explore: stop the spread: Students make the leak stop at one account, discovering both fixes: a different password for each site, and passwords that can't be guessed.
• Explain: why passwords fail: The teacher models the three ways a password fails, naming what students just saw. Sam's symbol swap comes after the method.
• Elaborate: a new set of problems: The same idea in a new case: Ava's new passwords fail in two different ways (reuse and guessable), one change at a time.
• Elaborate: let a manager do it: Students set up the habit that makes good passwords realistic: a password manager makes and remembers a different passphrase for every account.

Where it leads

Next: A second lock (MFA).

Teacher note: the eSafety Commissioner and the Australian Cyber Security Centre both publish student-friendly guidance on passphrases (check current pages before linking).