- Be able to give examples of weak passwords.
- Be able to describe how weak passwords are easy for attackers to guess.
Be able to describe why it’s a risk to use variations of the same passwordacross different accounts.
- Be able
- Be able to give examples of weak passwords.
- Be able to describe how weak passwords are easy for attackers to guess.
Be able to describe why it’s a risk to use variations of the same passwordacross different accounts.
- Be able to explain the dangers of giving honest answers to “security questions.”
- Be able to describe what makes a strong password.
Be able to explain why the randomness of using dice or a book is effective at producing a secure passphrase.
- Produce a highly secure passphrase.
If you plan to have learners actually generate their own passwords and phrases, then they should bring their devices and have password managers installed on them (see module on password managers).
Learners should have a general understanding of what a web browser is, and familiarity with logging into a website.
Warmup: Partner Introduction
Write down three questions in a visible place, like on a board or in a slide:
- Your name and pronouns
- What you ate for breakfast
- What was the first time you created an account for a website? Did you make a password? If you feel comfortable sharing that first password, what was it?
Pair everyone off and have them tell each other their answers to the questions. Then, go around the room and have everyone introduce their partner to the room; e.g.: “This is Naima. She ate eggs for breakfast. The first time she made a password was in 3rd grade for a website for going on adventures with a cartoon pet. The password was ‘iamcool.’”
Things you’ll learn from this ice breaker:
- How social the participants are; how much they enjoy working in groups.
- Whether they all know what passwords are.
- How good they are at following instructions and remembering details.
Part of what’s fun about this icebreaker is that people are better at remembering than they think they will be. When you’re explaining how to remember a passphrase later on, you can remind them how easy it was to remember random details about their partners.
Activity: What is a Weak Password?
The facilitator can use a whiteboard for this activity, or jot comments down on a piece of paper during this activity.
Narrow View: If Someone Knows You, What is a Weak Password?
The facilitator can callot between 2-4 minutes for each discussion item. We recommend giving a specific time limit to contain the discussion.
Facilitator: “In your pairs over the next [X] minutes, I’d like you to take turns answering the following questions:”
- “Have you been able to guess someone’s password before, based on things you knew about them, like when they were born, what their favorite animal is, what their favorite song is, or their interests?”
- “Has someone ever shared their password with you, and you were completely unsurprised about what their password was?”
- “Think about someone you know very well. Would you be able to answer their security questions on their behalf?”
After the pairs have discussed, the facilitator can check back in with the group. The facilitator can ask for volunteers to (without disclosing the password itself), share an anecdote of an “easy” or “unsurprising” password.
Facilitator: “Still in your pairs, I’d like you to discuss the following over the next [X] minutes: If someone was to do a Google search about your friend in that scenario, or to look at their social media accounts, or look around their desk for hints, would they be able to guess that friend’s interests? Would any of those interests lead them to hints for their passwords? Would any of those interests lead them to hints for their security questions?”
After the time allotted, the facilitator can check back in with the group.
The facilitator can ask participants to raise their hands in response to a question, or have them stomp their feet or clap.
Facilitator: “Show of hands: How many of you would be able to find out information about your friend’s passwords, based on the type of information that they are unaware they share about themselves?”
Wide View: If Looking at the Data, What is a Weak Password?
Facilitator: “What’s your guess: What are some of the most common passwords? In your pairs, over the next [X] minutes, I’d like for you to come up with at least five passwords that you feel the majority of people will pick. Which passwords do you think other people are likely to pick?”
Facilitator will check in with the group after the time is up. “What did you come up with in your pairs?”
Facilitator will write down the passwords on the board. The facilitator can occasionally ask: “Did anyone else have this password as one of their most common password guesses?” and highlight it. The facilitator can choose to a star next to the word each time someone raises their hand.
Learners will likely come up with variations on the spelling of “password”, common placements of keys on the keyboard (“qwerty”), sequential numbers “123456”, commonly used phrases in pop culture like “open sesame” or something less appropriate, maybe even words included on the webpage like “admin”, and “Facebook.”
The facilitator can prompt the learners. “What about favorite sports? Favorite colors? Popular names? Quotes from a movie or book? Song lyrics?”
Facilitator: “In your pairs, I’d like you to discuss over the next minute: How do you think people are able to determine what the most common passwords are?”
Facilitator will check back in after the allotted time and ask for volunteers. “What did you come up with?” Facilitator will wait for participants to come up with the idea of a leak, or the breach of a website’s databases.
If there is a major database breach in the news (e.g. Yahoo! In 2013, Adobe in 2013, and LinkedIn in 2012), the facilitator can use it as a discussion point for why strong passwords are important, and why it’s important to have unique passwords across accounts.
Activity: What Can You Do With Weak Passwords?
The facilitator can then show the live site for https://haveibeenpwned.com/, which has a huge database of passwords obtained from major breaches.
Facil