Secure Passwords and Authentication

Active learning helps students grasp abstract security concepts by making them concrete and memorable. When students create, test, and analyze passwords and authentication methods firsthand, they build durable understanding of why secure practices matter in real-world scenarios.

• Grade 9
• Computer Science
• 4 activities
• 20 min–40 min

Learning Objectives

1. Analyze the components of a strong password, identifying at least four characteristics required for robust security.
2. Compare and contrast at least three distinct authentication methods, including their strengths and weaknesses.
3. Evaluate the effectiveness of multi-factor authentication in preventing unauthorized access to online accounts.
4. Justify the necessity of using unique passwords for different online services to mitigate risks associated with data breaches.

Problem-Based Learning

⏱ 25 min·Pairs

Checklist Relay: Crafting Strong Passwords

Pairs brainstorm passwords meeting criteria: length, character mix, no personal info. One partner writes while the other checks against a class rubric. Switch roles, then pairs share top examples with the class for voting on strength.

Prepare & details

Explain the characteristics of a strong, secure password.

Facilitation Tip: During Checklist Relay, circulate to listen for student reasoning and gently correct misunderstandings about password composition in real time.

Setup: Groups at tables with access to research materials

Materials: Problem scenario document, KWL chart or inquiry framework, Resource library, Solution presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management
• Relationship Skills

Stations Rotation

⏱ 40 min·Small Groups

Stations Rotation: Authentication Demos

Set up three stations: password entry with fake login, biometric scan using phone cameras, MFA simulation with app codes. Small groups rotate every 10 minutes, noting pros, cons, and security levels at each.

Prepare & details

Differentiate between various authentication methods (e.g., passwords, biometrics, MFA).

Facilitation Tip: For Station Rotation, assign student roles like recorder or presenter at each station to ensure participation and accountability.

Setup: Tables/desks arranged in 4-6 distinct stations around room

Materials: Station instruction cards, Different materials per station, Rotation timer

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Problem-Based Learning

⏱ 30 min·Pairs

Phishing Challenge: Test MFA

Whole class views teacher-led phishing video. In pairs, students simulate responses with and without MFA, recording outcomes. Discuss which method blocks access best.

Prepare & details

Justify the importance of multi-factor authentication in enhancing account security.

Facilitation Tip: In Phishing Challenge, limit time per scenario to create urgency and mimic real-world pressure while observing how students apply MFA knowledge.

Setup: Groups at tables with access to research materials

Materials: Problem scenario document, KWL chart or inquiry framework, Resource library, Solution presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management
• Relationship Skills

Problem-Based Learning

⏱ 20 min·Individual

Password Cracker Demo: Weak vs Strong

Individuals use free online tools to test sample weak and strong passwords. Note cracking times, then create and test their own. Share results in a quick gallery walk.

Prepare & details

Explain the characteristics of a strong, secure password.

Setup: Groups at tables with access to research materials

Materials: Problem scenario document, KWL chart or inquiry framework, Resource library, Solution presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management
• Relationship Skills

Teaching This Topic

Teach this topic through guided inquiry and peer discussion rather than direct instruction. Research shows students retain cybersecurity concepts better when they discover flaws themselves in authentic simulations. Avoid lecturing about risks; instead, let students experience the consequences of weak practices firsthand. Use humor and relatable examples to reduce anxiety around technical details.

What to Expect

Students will confidently explain strong password traits, compare authentication types with evidence, and justify the need for MFA. They will also identify phishing attempts and recognize the risks of password reuse and weak authentication methods.

Watch Out for These Misconceptions

Common Misconception

During Checklist Relay: Watch for students who believe personal details like birthdays or pet names make passwords secure because they are unique.

What to Teach Instead

Have students swap password examples in small groups and attempt to guess each other's passwords based on social media-style profiles you provide. After the activity, discuss how easily hackers exploit publicly available information.

Common Misconception

During Password Cracker Demo: Watch for students who think reusing a strong password across accounts is acceptable for simplicity.

What to Teach Instead

Use the Password Cracker Demo to simulate a chain reaction where one breached password exposes multiple accounts. Students will see the domino effect firsthand, justifying unique passwords through evidence collected during the demo.

Common Misconception

During Station Rotation: Watch for students who believe biometrics alone provide perfect, unspoofable security.

What to Teach Instead

During the biometrics station, demonstrate how facial recognition can be fooled with high-quality photos or how fingerprints can be replicated with molds. Use role-play to show why MFA combines factors for robust defense.

Assessment Ideas

Quick Check

After Checklist Relay, present students with five sample passwords. Ask them to rate each password's strength on a scale of 1-5 and provide a one-sentence justification referencing specific traits they learned during the activity.

Discussion Prompt

During Phishing Challenge, facilitate a class discussion using the prompt: 'How did your knowledge of MFA change your approach to verifying legitimacy of requests like password resets? Share one strategy you would use in real life.'

Exit Ticket

After Station Rotation, ask students to write down: 1) One reason why using the same password for multiple websites is a bad idea, referencing what they observed during the Password Cracker Demo. 2) One example of a 'something you have' factor used in MFA that they saw at a station.

Extensions & Scaffolding

• Challenge: Ask students to design a secure password manager system for a fictional school, including how it would handle MFA and recovery options.
• Scaffolding: Provide a partially completed password checklist with missing traits, asking students to fill in examples or explanations.
• Deeper: Invite a local cybersecurity professional to discuss real-world authentication failures and how professionals respond.

Key Vocabulary

Password Strength Meter	A tool that analyzes a password's complexity based on length, character types, and common patterns, providing a score or rating.
Brute-Force Attack	A method of attempting to guess a password by systematically trying all possible combinations of letters, numbers, and symbols.
Biometric Authentication	A security process that verifies a user's identity based on unique biological characteristics, such as fingerprints, facial features, or iris patterns.
Multi-Factor Authentication (MFA)	A security system that requires two or more verification methods to confirm a user's identity, combining something you know, something you have, or something you are.
Phishing	A fraudulent attempt to obtain sensitive information like usernames, passwords, and credit card details by disguising oneself as a trustworthy entity in an electronic communication.