## Chapter 17 — 15:10 is a clean-computer clock ### Lesson map Lesson 17. Map, example, EX063. ```mermaid flowchart TD S["Usual sign-ins only"] --> C["Password changed anyway"] C --> P["15:10 Wednesday, clean computer"] P --> M["Two-step on"] M --> B["Do not save the new password in the browser"] P --> Q{"Does 15:10 prove a capture was seen?"} Q -->|No| K["The reason is a precaution"] ``` The clock is a precaution taken off the laptop. It is not a sighting. ### Logical drawing ```text observed usual sign-ins only done at 15:10 Wednesday new password, typed on a clean computer two-step turned on instruction do not store that password in the browser not observed a capture of keystrokes a count of the usual sign-ins ``` ### Learning outcomes After this chapter, you should be able to: 1. Place 15:10 on a clean computer. 2. Separate a precaution from a sighting. 3. Refuse a sign-in count that was never printed. ### 17.1 The password moved because the laptop was the wrong keyboard. The email history showed only Tomás's usual sign-ins. Priya still changes the password, and she does it from a clean computer at 15:10 on Wednesday. The reason is that a program on FB-LAP-02 might record what is typed. A new password entered on that keyboard could be captured at once. Two-step sign-in is turned on in the same action, so a password alone would not be enough later. Tomás is told not to save the new password in the browser. The reason is not a finding. Nobody in this case observed a capture. The sentence "a keylogger was running" would upgrade a precaution into an artefact the notes do not contain. The labs do not see this action at all: the hash script has no account field, and the startup script has no password field. 15:10 is a notebook clock. "Usual" is also not a number. The book does not say how many ordinary sign-ins were on the page. A later summary that prints a count has invented a tally. The change stands even though the history looked ordinary, which is a different fact from "the history proved misuse" and a different fact from "the history was ignored". | Statement | Status | |---|---| | Usual sign-ins only | Observed | | 15:10, clean computer, two-step on | Done | | New password left out of the browser | Instructed | | A capture was seen | Not in the notes | | A count of usual sign-ins | Not printed | ### 17.2 Worked example | Offered sentence | What it adds | Decision | |---|---|---| | "15:10 Wednesday, clean computer, two-step on." | The note | Keep | | "History was usual, and the password changed anyway." | Both facts | Keep | | "A keylogger captured the attempt." | A sighting | Refuse | | "Four usual sign-ins, all from the office." | A tally and a place | Refuse | > **Synthetic case.** The email action is Wednesday, off FB-LAP-02. ### Errors and limits Do not narrate a capture that the precaution was designed to avoid. ### Apply - **EX063 — Clean keyboard.** Why was the password changed on a clean computer at 15:10, and what was not observed? *Rubric:* 3 = typing on FB-LAP-02 might be captured; 15:10 Wednesday is the clean-computer clock; two-step was turned on; no capture was observed; no count of usual sign-ins is printed;; 2 = the clock is a precaution and no capture was seen;; 1 = the time only;; 0 = none. ### Continue studying — lesson 17 (chapter 17 of 20) [← Chapter 16](#ch-16) · [Course chapter index](../SUBJECTS.md) · [Chapter 18 →](#ch-18) Continue to the next authored lesson. ## Worked answers **EX063.** Typing on FB-LAP-02 might be captured, so the change was made on a clean computer at 15:10 Wednesday, with two-step turned on. No capture was observed, and no count of usual sign-ins is printed.