Chapter 4 — Passwords and sign-in
Lesson map
Lesson 04 published. Map, example, EX013.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Strong passwords"]
N2["4.2 Multi-factor sign-in"]
N3["4.3 Password resets"]
N4["4.4 Shared passwords"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX013"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Strong passwords"]
N2["4.2 Multi-factor sign-in"]
N3["4.3 Password resets"]
N4["4.4 Shared passwords"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]
[Learning outcomes]
|
v
[4.1 Strong passwords]
|
v
[4.2 Multi-factor sign-in]
|
v
[4.3 Password resets]
|
v
[4.4 Shared passwords]
|
v
[Worked example] --> [Exercise EX013]
Learning outcomes
You will (1) explain what makes a password strong; (2) set up multi-factor sign-in; (3) help users safely with password problems.
4.1 Strong passwords
Chloe learns that long passwords made of several random words are easier to remember and harder to guess than short complex ones. Passwords should be different for each service, because criminals try passwords leaked from one site on many others. A password manager helps people keep many different passwords. She also learns that common passwords such as the shop name followed by a year are among the first that attackers try. She shows classmates how a random word passphrase can be long but still easy to type on a till keyboard.
4.2 Multi-factor sign-in
Multi-factor sign-in asks for something extra after the password, such as a code from an app. Even if a password is stolen, the attacker cannot sign in without the code. Chloe helps Mr. Doyle turn it on for email and the online shop administration page, starting with office staff. She writes a one-page guide with pictures. Some staff do not want apps on personal phones, so Mr. Doyle provides small key fobs instead. She records who received fobs so they can be collected when staff leave.
4.3 Password resets
Staff sometimes forget passwords. Chloe learns that resetting a password for the wrong person is a common way attackers get in. Before resetting, she must confirm the person's identity, for example by calling them back on the number in the staff records, not a number they give on the call. She practises this in a role-play where a classmate pretends to be a manager in a hurry. She learns that pressure and urgency are common tricks. She writes the call-back step into a short reset guide.
4.4 Shared passwords
Chloe finds that the online shop administration password is written on a sticky note in the office. She tells Mr. Doyle, who changes it and gives each person who needs access their own login. Mr. Appiah explains that shared passwords spread over time to people who should not have them, including former staff, and that nobody can tell who used a shared login. She also checks the other centres' offices and finds no more notes. Mr. Doyle thanks her and asks staff in the next team meeting not to write passwords down, explaining the reason.
Worked example
Chloe learns passphrases and unique passwords, helps enable multi-factor sign-in with key fobs as an option, practises safe resets and removes a sticky-note password.
Synthetic case. Examples are synthetic.
Errors and limits
Resetting a password without confirming identity can let an attacker in.
Exercises
- EX013 — Reuse danger. Why use different passwords for each service? Rubric: 3 = leaked passwords are tried elsewhere;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX014 — Fob reason. Why are key fobs provided? Rubric: 3 = some staff refuse apps on personal phones;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX015 — Reset check. How is identity confirmed before a reset? Rubric: 3 = call back on the number in staff records;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX016 — Sticky note. Where was the shop admin password found? Rubric: 3 = on a sticky note in the office;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 04 (chapter 04 of 18)
← Chapter 03 · Course chapter index · Chapter 05 →
Continue to the next authored lesson.