The answersDownload the PDF
Worksheet

F11.5 Passwords and authentication

Cyber security · GCSE · OCR J277 1.4.2, AQA 8525 3.6.3, Edexcel 1CP2 6.4.4 · about 15 min

BugBotLab
NameClassDate

What this lesson is about

Ways to authenticate, strong passwords, 2FA, CAPTCHA and hashing.

Questions 5 marks in all

  1. [1 mark]Which makes a password stronger?

    1. AMaking it longer and more varied
    2. BUsing a real word
    3. CUsing your birthday
    4. DReusing it everywhere

  2. [1 mark]What is two-factor authentication?

    1. AUsing two different kinds of proof, such as a password and a phone code
    2. BTwo passwords
    3. CA longer password
    4. DLogging in twice

  3. [1 mark]What is a CAPTCHA for?

    1. AProving you are a human, not an automated program
    2. BEncrypting your password
    3. CStoring your password safely
    4. DSpeeding up login

  4. [1 mark]Why should passwords be stored as a hash, not plain text?

    1. AIf the file leaks, the real passwords are not exposed
    2. BIt makes login faster
    3. CHashes are shorter
    4. DIt is required by law

  5. [1 mark]Why do systems lock you out after a few wrong tries?

    1. ATo defeat brute force guessing
    2. BTo save electricity
    3. CTo back up your data
    4. DTo speed up the server

The task: a password checker

Write strength(password) scoring one point for each rule met: at least 8 characters; a lower-case letter; an upper-case letter; a digit; a symbol (a character that is not a letter or digit). For each password in passwords, print <password>: <score>/5 <verdict>, where the verdict is weak for 0 to 2, ok for 3, and strong for 4 or 5. At the end print strong passwords: <n>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

passwords = ["robot", "Sunshine", "Bugbot42", "x9$Lq2!vT", "12345678"]

Plan your program here, then type it in and press Run.

QR code
Do it on the robot
www.bugbotlab.com/learn/f11-5-passwords-and-authentication/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

  1. Add a rule that a password must not contain the word "robot" or "password".
  2. How many guesses is a 6-character lower-case password? Use 26 ** 6.
  3. Why does two-factor authentication protect you even if your password leaks?