Presentation: Strong Passwords and Privacy Settings

Slide 1 of 7 · Settling starter · PSE / Well-being · Year 7

5 minutes

Strong passwords and privacy settings

Cai is in Year 7. He plays a building game called BlocDref and has a profile on it. His passwords are easy to guess and his settings let anyone see where he is. Today you test passwords, find what his profile gives away and fix his settings.

While the register is called: write your name, class and date on your worksheet. Phones stay away. Then listen to Part 3 of the stimulus sheet, the NCSC’s password advice.

Starter question: The NCSC says the best way to make a password is from how many random words?

DCF: Interacting and collaborating → Storing and sharing Nobody writes a real password today, not even an old one

Supply teacher script (no subject knowledge needed)

Hand out: one worksheet per pupil and one stimulus sheet (Cai’s game profile and settings) between two. Pupils need a pen. Cai, BlocDref and Ysgol Cwm Derw are all invented. If a pupil tells you that someone else has got into one of their accounts, or that a stranger online is messaging them, take their name quietly and pass it to the class teacher or the school’s safeguarding lead the same day.

Say aloud: “Write your name, class and date at the top of your worksheet. Phones away. One rule before anything else: nobody writes a real password on this sheet today, not even an old one. The password you make in Step 3 is for practice only. Now listen while I read the experts’ advice.” Then read Part 3 of the stimulus sheet aloud, all 6 bullet points.

Starter answer: 3 random words, for example applenemobiro. Long enough to be strong and easy enough to remember.

Slide 2 of 7 · Today’s brief and key words · PSE / Well-being · Year 7

2 minutes

Your brief: test the passwords, then fix Cai’s profile

You will rate 8 passwords, do some multiplication to see why long beats clever, make a practice password from 3 random words, find 6 giveaway details on Cai’s profile, choose all 8 of his settings and decide where a password should live.

Three random words

The NCSC method: 3 words with nothing to do with each other or with you, such as teapotcometdaffodil.

2-step verification

A code sent to a phone or email as well as the password. A second lock on the door.

Privacy settings

The choices in an app that decide who can see your profile, message you, or see where you are.

DCF: Interacting and collaborating → Storing and sharing Keep the stimulus sheet open beside you

Slide 3 of 7 · Step 1: the password line-up · PSE / Well-being · Year 7

8 minutes

Step 1: rate all 8 passwords, Weak or Strong, with a reason

These are passwords Cai and his friends have used. Use the NCSC advice in Part 3 and Cai’s profile in Part 1. Every reason should point at something on the profile or in the advice.

No.	Password	Weak or Strong?	Reason
1	password123	Weak	One of the most common passwords there is. It is guessed first.
2	Cai2014	Weak	His name and birth year, and both are in his username.

Step 1 on your worksheet · 8 minutes Names, dates, pets and teams are all on his profile

Supply teacher script (no subject knowledge needed)

Say aloud: “The first 2 rows are on the board. Look at Cai’s profile in Part 1 while you do rows 3 to 8. Ask yourself: could a stranger who read his profile guess this? Number 8 is a trick: the words are good, but look at how he uses it.”

Quick check: 3 Weak, his dog Bella and his birthday 14 March, both on his profile. 4 Weak, his football team, in his “About me”. 5 Weak, the letters along the top of the keyboard, a very common pattern. 6 Weak, it is still “password”; the NCSC says criminals know the symbol swaps. 7 Strong, 3 random words with nothing to do with Cai. 8 Strong password, weak habit: if one app is hacked, the same password opens his email, and from his email someone can reset everything else. Only 7 and 8 are strong.

Slide 4 of 7 · Steps 2 and 3: why long beats clever · PSE / Well-being · Year 7

12 minutes

Step 2 & Step 3: do the multiplication, then make a practice password

Step 2 (7 min): someone guessing a password has to try every possibility. Work out (a) to (d).

(a) A 4-digit PIN: 10 × 10 × 10 × 10 = 10,000 possible PINs.

(b) 3 words from a list of 2,000: 2,000 × 2,000 = ________, then × 2,000 again = ________.

Step 3 (5 min): practice only, never for a real account. Pick 3 words that have nothing to do with each other or with you: look around the room, or open a book at 3 random pages. Picture them together in a silly scene. Check: free of names, birthdays, pets, teams and your school?

Steps 2 and 3 on your worksheet · 12 minutes A password is only as strong as it is hard to guess

Supply teacher script (no subject knowledge needed)

Say aloud: “7 minutes for Step 2. Part (a) is on the board: 10,000 PINs. Do (b) and (c) with the working, then use Cai’s profile to answer (d). Then 5 minutes for Step 3: make a practice password from 3 random words and draw the silly picture in words. It must never be used for anything real.”

Quick check: (b) 2,000 × 2,000 = 4,000,000, × 2,000 again = 8,000,000,000 (eight billion). (c) 8,000,000,000 ÷ 10,000 = 800,000 times more. (d) Nobody has to try millions, because anyone who reads Cai’s profile would try his name and birth year first; his username caipritchard2014 is nearly the same as his password, so it could be guessed on the first try.

Walk the room, Step 3: a good answer looks like “kettle, penguin, ladder” with a picture such as a penguin climbing a ladder to reach a kettle, and “yes” in the last box. Send back any answer that uses a name, date, pet, team or the school.

Slide 5 of 7 · Steps 4 and 5: the profile and the settings · PSE / Well-being · Year 7

20 minutes

Step 4 & Step 5: what Cai’s profile gives away, then fix his settings

Step 4 (10 min): read Part 1. Find 6 details a stranger could use to work out who Cai is, where to find him, or what his password might be. Then put 2 together. Step 5 (10 min): use Part 2. Choose the safest sensible option for all 8 settings and say what each protects Cai from. Then name 2 things he must delete or change himself.

Detail on the profile	What a stranger could work out
Username caipritchard2014	His full name and the year he was born, and a big clue to his password.
Setting	My choice, and what it protects Cai from
1. Who can see my profile	Friends only: strangers reading his details. “Only me” is also fine.

Steps 4 and 5 on your worksheet · 20 minutes Small clues add up · settings alone are not enough

Supply teacher script (no subject knowledge needed)

Say aloud: “10 minutes for Step 4. One detail is on the board; find 5 more, and for each one say what a stranger could work out. Then the question underneath: put 2 details together. After 10 minutes move to Step 5: setting 1 is on the board, choose the other 7 and say what each one protects him from.”

Quick check, Step 4: the school jumper photo with the badge (which school, and what he looks like); “Left wing for Bangor Juniors, Saturdays 10am on the top pitch” (exactly where he will be, and when, every Saturday); “Last seen near Heol y Coleg, Bangor, 4 minutes ago” (where he is right now); “Home on my own every Tuesday till 6” (when he is at home without an adult); the photo of Bella outside his front door with the house number (roughly where he lives, and Bella is a password clue). Put together: the Tuesday post, the front door photo and the location tell a stranger which house Cai lives in and the exact time every week he is there on his own.

Quick check, Step 5: 2 Friends only (people he has never met contacting him privately). 3 Never (anyone seeing where he is; a game does not need it). 4 Off (his birthday used to guess passwords or pretend to be him). 5 Only me (strangers using his friends to pretend they know him). 6 Friends only (strangers pulling him into games with open chat). 7 On (a guessed password still cannot get in without the code). 8 Off (the next person on the library computer opening his account). Delete or change himself: the “home on my own every Tuesday” post, and the profile picture with his school badge; his 312 friends can still see everything and he has met only about 30 of them.

Slide 6 of 7 · Step 6 and self check · PSE / Well-being · Year 7

3 minutes

Step 6: where should passwords live? Then check your work

Write Safe or Not safe next to each of the 6 places, with a few words of reason. Then tick the success criteria you have met and correct 1 thing.

I can explain why a password made from names, dates, pets or teams is weak, even if it looks complicated.
I can make a password from 3 random words and use numbers to explain why length makes it strong.
I know my email password must be different from all my others, and that 2-step verification adds a second lock.
I can spot details on a profile that tell a stranger who I am, where I am, or what my password might be.
I can choose privacy settings and explain what each one protects me from.
I know safe and unsafe places to keep a password.

Step 6 on your worksheet · 3 minutes Finished early? Write Cai a new “About me” in 25 words

Supply teacher script (no subject knowledge needed)

Say aloud: “3 minutes. Step 6 is quick: Safe or Not safe for the 6 places, with a reason. Writing a password down is not automatically wrong; what matters is who else can get to it. Then tick the success criteria and correct 1 thing, for example a Step 1 reason that just says ‘it’s obvious’.”

Quick check: a Not safe (anyone who picks up the laptop can read it). b Safe (the NCSC says saving in the browser is a good idea, as long as the device is locked). c Not safe (friends fall out, and might tell someone else). d Safe (the NCSC says writing it down is OK if it is kept somewhere safe). e Not safe (anyone who picks up the unlocked phone can read it). f Safe (a trusted adult at home can help if something goes wrong).

Extension answers: the new “About me” may mention football and Bella but no school, town, times, places or birth year. The fake “BlocDref support” message: real support never asks for your password, it threatens to delete the account to rush him, and it arrives as a message out of the blue; Cai should not reply, should tell an adult and report the message. The poster has no single answer: 5 short lines from the Part 3 advice.

Slide 7 of 7 · Plenary review · PSE / Well-being · Year 7

2 minutes

Quick-check answers before handing in

Check your main answers before your worksheets are collected.

Question	Correct answer
How many possible passwords are there from 3 random words out of 2,000?	8,000,000,000 (eight billion), which is 800,000 times more than a 4-digit PIN.
Why is seagulltoasttrumpet a problem even though it is strong?	Cai uses it for his email as well; anyone who gets into his email can reset everything else.
Which setting should Cai turn off before he plays on the library computers?	Keep me logged in on this device, so the next person cannot open his account.

Check your name and class are on your worksheet Leave stimulus sheets neat on the desk