Week 2 · Chapter 3 Information Security: aims and threats, malware, passwords and authentication, tricks that fool people, encryption, digital signatures and secure websites · 3 lessons
2
Passwords, second steps and tricks that fool people
ICT Secondary 1 Term 1, Chapter 3: pp. 24–41
GoalExplain how passwords, a second step and tricks that fool people fit together.
New words
authentication · proving that you are who you say you aretwo-factor authentication · using two different kinds of proof to log inphishing · a fake message that tries to make you give away a secretsocial engineering · fooling the person instead of the machine
Explanation
Authentication is proving who you are. There are three kinds of proof: something you know (a password), something you have (a card or a phone that receives a code) and something you are (a fingerprint). Two-factor authentication asks for two different kinds, for example a password and a code. A one-time password works for one login only, so a spy who sees it cannot use it later. Length matters for a password: a code of 3 characters taken from 26 letters and 10 digits has 36 × 36 × 36 = 46,656 possible codes, and every extra character multiplies that by 36. Use long passwords made of unrelated words, never reuse one, and never share it. Two more tools guard a network: a firewall is a gate that checks traffic against rules, and access control decides who may do what (a pupil may read marks, only the teacher may change them). Some attacks fool people, not machines: phishing is a fake message that asks for a secret, often in a hurry; shoulder surfing is watching someone type; dumpster diving is searching rubbish for papers with secrets; skimming copies a card’s data. All of them are social engineering when they depend on trust. If a message pushes you to act fast, do not click. Tell a trusted adult.
Kind of proof
Example
Weakness
something you know
a password
can be guessed or watched
something you have
a phone that receives a code
can be lost
something you are
a fingerprint
cannot be changed if copied
Worked examples
Code type
Each place
Places
Possible codes
PIN of digits
10
4
10,000
lowercase letters
26
3
17,576
letters + digits
36
3
46,656
How many codes can a 4-digit PIN have? Each of the 4 places can hold one of 10 digits, so 10 × 10 × 10 × 10 = 10,000 codes. A code of 3 lowercase letters has 26 × 26 × 26 = 17,576 codes, which is more, because each place has more choices: length and variety both matter.
Sign
In the message
asks for a secret
“type your password”
hurry
“closed today”
unknown sender
not a person he knows
Mina gets this message: “Your school account will be closed today. Type your password here to keep it.” It asks for a secret, hurries him, and does not come from a person he knows. These are signs of phishing. He does not click; he shows it to his teacher.
Class activity
Without a device: design a two-step login for a class cupboard. Write what the first step asks (something you know) and what the second step asks (something you have), and why using both is safer than one. Do not use any real password.
Practice
1
Why is a one-time password safer than an ordinary one if a spy sees it?
It is valid for one login only, so it cannot be used again.
2
Which is two-factor: a password and a security question, or a password and a code on your phone?
A password and a code on your phone, because they are two different kinds (know and have).
3
How many codes can a 2-digit PIN have?
10 × 10 = 100.
4
A person watches over your shoulder while you type. What is this trick called?
