Computer Science · Grade 9 · Networks and the Global Web · Term 2

Secure Passwords and Authentication

Students will learn best practices for creating strong passwords and understanding multi-factor authentication.

• Ontario Curriculum Expectations
• CS.HS.CY.6
• CS.HS.S.13

About This Topic

Secure passwords and authentication form essential defenses against cyber threats in online networks. Grade 9 students identify strong password traits: 12 or more characters blending uppercase, lowercase letters, numbers, and symbols; avoidance of common words, sequences, or personal details; and uniqueness across accounts. They compare authentication types, including passwords as knowledge-based factors, biometrics like facial recognition or fingerprints as inherent traits, and multi-factor authentication (MFA) that layers verification steps for superior protection.

In Ontario's Computer Science curriculum, this topic supports the Networks and the Global Web unit under standards CS.HS.CY.6 and CS.HS.S.13. Students explain password strength, distinguish methods, and argue MFA's value against breaches from phishing or data leaks, linking to real-world risks in social platforms, email, and apps they use daily. This builds cybersecurity awareness as a core digital literacy skill.

Active learning excels with this topic through practical simulations and peer challenges. Students who generate and test passwords with strength meters, role-play MFA scenarios, or analyze mock breaches experience vulnerabilities directly. These hands-on methods solidify best practices, encourage justification of choices, and promote secure habits beyond the classroom.

Key Questions

1. Explain the characteristics of a strong, secure password.
2. Differentiate between various authentication methods (e.g., passwords, biometrics, MFA).
3. Justify the importance of multi-factor authentication in enhancing account security.

Learning Objectives

• Analyze the components of a strong password, identifying at least four characteristics required for robust security.
• Compare and contrast at least three distinct authentication methods, including their strengths and weaknesses.
• Evaluate the effectiveness of multi-factor authentication in preventing unauthorized access to online accounts.
• Justify the necessity of using unique passwords for different online services to mitigate risks associated with data breaches.

Before You Start

Introduction to Computer Networks

Why: Understanding basic network concepts provides context for why secure access is necessary.

Digital Citizenship and Online Safety

Why: Students need foundational knowledge of online risks and responsible internet use before learning specific security measures.

Key Vocabulary

Password Strength Meter	A tool that analyzes a password's complexity based on length, character types, and common patterns, providing a score or rating.
Brute-Force Attack	A method of attempting to guess a password by systematically trying all possible combinations of letters, numbers, and symbols.
Biometric Authentication	A security process that verifies a user's identity based on unique biological characteristics, such as fingerprints, facial features, or iris patterns.
Multi-Factor Authentication (MFA)	A security system that requires two or more verification methods to confirm a user's identity, combining something you know, something you have, or something you are.
Phishing	A fraudulent attempt to obtain sensitive information like usernames, passwords, and credit card details by disguising oneself as a trustworthy entity in an electronic communication.

Watch Out for These Misconceptions

Common Misconception

Passwords with personal info like birthdays or pet names are secure because they are unique.

What to Teach Instead

Hackers gather such details from social media or public records to guess easily. Peer review activities where students guess classmates' passwords from profiles reveal this risk quickly and correct mental models through shared evidence.

Common Misconception

A single strong password works for all accounts to simplify management.

What to Teach Instead

Reuse amplifies breach impact across sites. Collaborative cracking simulations show how one compromised password exposes everything, helping students justify unique passwords via group analysis of chain reactions.

Common Misconception

Biometrics alone provide perfect security without passwords.

What to Teach Instead

Fingerprints or faces can be spoofed with photos or molds. Role-play demos expose flaws, and discussions build understanding that MFA combines factors for robust defense, making abstract risks tangible.

Active Learning Ideas

Checklist Relay: Crafting Strong Passwords

Pairs brainstorm passwords meeting criteria: length, character mix, no personal info. One partner writes while the other checks against a class rubric. Switch roles, then pairs share top examples with the class for voting on strength.

25 min·Pairs

Stations Rotation: Authentication Demos

Set up three stations: password entry with fake login, biometric scan using phone cameras, MFA simulation with app codes. Small groups rotate every 10 minutes, noting pros, cons, and security levels at each.

40 min·Small Groups

Phishing Challenge: Test MFA

Whole class views teacher-led phishing video. In pairs, students simulate responses with and without MFA, recording outcomes. Discuss which method blocks access best.

30 min·Pairs

Password Cracker Demo: Weak vs Strong

Individuals use free online tools to test sample weak and strong passwords. Note cracking times, then create and test their own. Share results in a quick gallery walk.

20 min·Individual

Real-World Connections

• Cybersecurity analysts at financial institutions like TD Bank or RBC use principles of strong authentication to protect customer accounts from fraud and identity theft, implementing MFA for online banking access.
• Software developers creating mobile applications for platforms like Instagram or TikTok must integrate secure password policies and consider MFA options to safeguard user data and prevent account takeovers.
• Government agencies, such as Citizenship and Immigration Canada, employ robust authentication measures for online portals to protect sensitive personal information submitted by citizens during application processes.

Assessment Ideas

Quick Check

Present students with five sample passwords. Ask them to rate each password's strength on a scale of 1-5 and provide a one-sentence justification for their rating, referencing specific password characteristics.

Discussion Prompt

Facilitate a class discussion using the prompt: 'Imagine you receive an email asking you to reset your password for a popular social media site by clicking a link. How would you determine if this is a legitimate request or a phishing attempt, and what steps would you take to protect your account?'

Exit Ticket

Ask students to write down: 1) One reason why using the same password for multiple websites is a bad idea. 2) One example of a 'something you have' factor used in MFA.

Frequently Asked Questions

What are the key traits of a strong password for Grade 9 students?

Strong passwords need 12+ characters mixing uppercase, lowercase, numbers, symbols; no dictionary words, sequences, or personal data; and uniqueness per account. Teach with rubrics: students score samples, then craft their own. This practice aligns with CS.HS.CY.6, emphasizing length and entropy to resist brute-force attacks over hours or years.

How does multi-factor authentication improve security?

MFA requires two or more verification types, like password plus phone code or biometric. Even if a password leaks via phishing, attackers need the second factor. Students justify its use by simulating breaches: single-factor fails fast, MFA blocks 99% of attempts, per cybersecurity reports, vital for networks curriculum.

How can active learning help teach secure passwords and authentication?

Active methods like password strength challenges, MFA role-plays, and cracking demos engage students directly with risks. Pairs testing tools see weak passwords crack in seconds, sparking discussions on criteria. Rotations through auth stations compare methods hands-on, building retention and real-world application over lectures alone.

Why teach authentication methods in Ontario Grade 9 Computer Science?

Standards CS.HS.CY.6 and CS.HS.S.13 require explaining passwords, biometrics, MFA, and their roles in global web security. With rising breaches affecting youth via gaming and social apps, lessons foster habits: students differentiate factors, justify MFA, preparing for digital citizenship in Ontario's connected curriculum.