The worksheetDownload the PDF
Answers

F11.5 Passwords and authentication

Cyber security · GCSE · OCR J277 1.4.2, AQA 8525 3.6.3, Edexcel 1CP2 6.4.4 · about 15 min

BugBotLab

What this lesson is about

Ways to authenticate, strong passwords, 2FA, CAPTCHA and hashing.

Questions 5 marks in all

  1. [1 mark]Which makes a password stronger?

    1. AMaking it longer and more varied
    2. BUsing a real word
    3. CUsing your birthday
    4. DReusing it everywhere
    Answer: A. Length and variety multiply the guesses needed.

  2. [1 mark]What is two-factor authentication?

    1. AUsing two different kinds of proof, such as a password and a phone code
    2. BTwo passwords
    3. CA longer password
    4. DLogging in twice
    Answer: A. A stolen password alone is then not enough.

  3. [1 mark]What is a CAPTCHA for?

    1. AProving you are a human, not an automated program
    2. BEncrypting your password
    3. CStoring your password safely
    4. DSpeeding up login
    Answer: A. It helps stop automated attacks such as brute force.

  4. [1 mark]Why should passwords be stored as a hash, not plain text?

    1. AIf the file leaks, the real passwords are not exposed
    2. BIt makes login faster
    3. CHashes are shorter
    4. DIt is required by law
    Answer: A. A hash cannot easily be turned back into the password.

  5. [1 mark]Why do systems lock you out after a few wrong tries?

    1. ATo defeat brute force guessing
    2. BTo save electricity
    3. CTo back up your data
    4. DTo speed up the server
    Answer: A. It stops a program trying thousands of guesses.

The task: a password checker

Write strength(password) scoring one point for each rule met: at least 8 characters; a lower-case letter; an upper-case letter; a digit; a symbol (a character that is not a letter or digit). For each password in passwords, print <password>: <score>/5 <verdict>, where the verdict is weak for 0 to 2, ok for 3, and strong for 4 or 5. At the end print strong passwords: <n>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

passwords = ["robot", "Sunshine", "Bugbot42", "x9$Lq2!vT", "12345678"]

The hint students can ask for: Score one point for each rule the password meets: long enough, a lower-case letter, an upper-case letter, a digit, and a character that is neither a letter nor a digit. The verdict comes from bands on that score.

A solution

from bugbot import *
connect()
passwords = ["robot", "Sunshine", "Bugbot42", "x9$Lq2!vT", "12345678"]

def strength(password):
    score = 0
    if len(password) >= 8: score = score + 1
    if any(c.islower() for c in password): score = score + 1
    if any(c.isupper() for c in password): score = score + 1
    if any(c.isdigit() for c in password): score = score + 1
    if any(not c.isalnum() for c in password): score = score + 1
    return score

strong = 0
for password in passwords:
    s = strength(password)
    verdict = "strong" if s >= 4 else "ok" if s == 3 else "weak"
    if s >= 4:
        strong = strong + 1
    print(f"{password}: {s}/5 {verdict}")
print("strong passwords:", strong)

Any program that meets the task's checks is marked correct in the simulator; this is one way, not the only way.