Cybersecurity and Economics: Goldi and the Three Passwords

In this lesson, students learn about how to create good passwords and the risks of not doing so. Through an original video called Goldi and the Three Passwords, they learn what goes into making up a “just-right” password. As a final activity, they use the information gathered to create a public service announcement to teach about “just-right’” passwords.

ESSENTIAL QUESTION: Why is it important to choose a good password and what does a good password look like?

TIME REQUIRED: Two sessions. One session of 45 minutes and a second, optional hour-long session. Most of the lesson will be completed in the first session. During the second session, students use the evidence gathered in the first session to write, act out, edit record, and present their public service announcements.

ADDITIONAL CYBERSECURITY CONCEPTS: Consequences, Crack, Identity Theft, Hacker Mnemonic Password, Password, Protecting

A strong password is your first defense against online predators and imposters. A weak password can lead to identity theft and monetary theft. Recently, there have been many news stories about password leaks and hacking, even with big brand stores that have sophisticated security systems. It is important to tell students that a password is like a key to a lock on private information. They should create passwords that are easy to remember and hard for predators to crack.

Experts say that the best passwords are at least eight characters long and combine upper and lower case letters with numbers and symbols. The more symbols, numbers, and upper case characters added to a password, the longer it would take for someone to crack it. This website estimates how long it would take to crack a password. Passwords that are sentences may be impossible to guess within your lifetime! However, it’s also important to make sure you can remember your passwords.

It’s very important to take the time to create a strong password. What are the costs and benefits of creating a strong password? The costs of time and thought are low when you consider the benefits of defending yourself against identity theft. In addition, the possible financial consequences of not having a strong password are great. Finally, remember even the best passwords have a shelf life––even really great passwords need to be changed at regular intervals.

To ensure you have a “just-right” password, follow the strategies presented in the lesson. Safe Kids provides tips for strong passwords. In addition, visit cfodailynews.com the perfect passwords checklist . One type of password is a mnemonic password, which is created by selecting the first letter of each word of a secret sentence. For example, My Friend Jane Eats 2 Apples Every Day to Stay Very Healthy would become MFJE2AEDTSVH (see Extension activity).  You can also use a password validator to check the strength of your password.

• Define costs, benefits, and risks.
• Explain what makes a good password.
• Apply knowledge learned to create a good password.
• Discuss the results of identity theft.
• Create a public service announcement to teach parents and friends about good passwords.

• If your students aren’t familiar with the story of Goldilocks and the Three Bears, visit this website
• Goldi and the Three Passwords Video
• Lesson PPT Slides (PPT or PDF)
• Handout 1: Password Graphic Organizer
• Handout 2: Baby Bear’s Advice for Good Passwords
• Handout 3: Instructions for a Public Service Announcement (PSA)
• Evaluation Rubric
• Visual 1: Lock
• Visual 2: Email Log In
• Visual 3: Mnemonic Passwords
• Parent Letter
• Estimating Password Cracking Times
• Perfect Password Checklist
• Password Validator

Please note: We recommend sending the Parent Letter home prior to teaching this lesson.

1.     Show students Visual 1 or Lesson PPT 2, which shows an image of a lock.

a.     Ask students: What is this? How do locks work? [Locks open by keys, combinations, or cards]. Ask: Why do we use locks? [We want to protect things.]. Tell students that sometimes we do things to help protect against risks. A risk is the chance of loss or harm. Ask students: What are the risks if you leave a bicycle outside a building and don’t put a lock on it? [It might get stolen.]  Explain to students that if you know the risk, you can make choices about lessening the risk. When you make an informed choice, you consider the costs and benefits of your decision. A benefit makes the situation better. A cost is is the effort, loss or sacrifice necessary to achieve or obtain something. Ask: What is the benefit of putting the lock on the bicycle? [It won’t get stolen. You protect against the risk of the bike getting stolen.]  What is the cost of putting the lock on the bicycle? [It costs money to buy the lock. It takes time to unlock the lock and lock up the bike.]

b.     Tell students that a password is like a key or combination to a lock to keep other people from seeing your information on the Internet. Ask them to share what they know about passwords by asking the following questions: Has anyone used a password? Why do you use passwords? When do you use passwords?

c.     Project Visual 2 –  Email Log in or Lesson PPT 3. Discuss how you sign in to an email account with a user name and password. Ask: What might happen if you didn’t have a password for your email? [Someone could read your email. Someone could pretend to be you and send email from your account. Someone could get the private information that is in your emails and use it for their own advantage.]

2.     Tell students they will learn about how to make the good passwords through an adaptation of an old story, Goldilocks and the Three Bears. Ask who remembers the story and retell with students or read the story online using this website. In the story, Goldilocks first chooses between three bowls of porridge. Ask students: Why didn’t she choose Mama or Papa Bears’s bowls? [Papa Bear’s is too hot, Mama Bear’s is too cold.] Why did she choose Baby Bear’s? [His was just right.] You can continue asking similar questions about Baby Bear’s choices for the chairs and beds.

3.     Tell students that they are going to watch a video called Goldi and the Three Passwords. Handout copies of Handout 1 – Password Graphic Organizer or Lesson PPT 4.

a.     Before Viewing: Show PPT 4 or Handout 1 – Password Graphic Organizer. Tell students: While we watch the video of Goldi and the Three Passwords, we are going to learn about Too-Hard, Too-Easy, and Just-Right Passwords. We are also going to learn why it’s important to have strong passwords. Tell students: While you watch, use the graphic organizer to jot down some information from the video about too-easy, too-hard and just-right passwords.

b.     During Viewing: The video is 4 minutes, 40 seconds long. You may decide to watch the video in segments, pausing after each one to give students time to complete their notes. The following topics are covered in the video:

• Why are passwords important and what is identity theft? (0:00-1:37)
• What is a too-hard password? (1:38-2:07)
• What is a too-easy password? (2:08-2:49)
• What are the do’s and don’ts for creating just-right passwords? (2:50-3:44)
• How long does it take to crack various passwords? (3:45-4:40)

c.     After Viewing: Ask students to share what they discovered about just-right passwords. Project your copy of Handout 1 or write their findings on the board. Instruct students to fill in their own sheets with facts they missed.  If you think they didn’t get enough information, watch the video again and repeat the process.

d.     Then ask students to compare the information they wrote down on Handout 1 to Handout 2 – Baby Bear’s Suggestions for Just Right Passwords.  Show Lesson PPT 4.  Ask: What are the risks of having a too-easy password? [Someone can get into your online applications or steal your identity.] Tell students: Passwords are important because they can protect you from Internet hackers who can crack the code if a password is too easy. These hackers can then steal your personal information, which sometimes leads to Identity Theft. Ask: Think about the phrase Identity Theft. What do you think it means? [Stealing somebody’s identity.]  How does identity theft happen?  [Person A steals Person B’s personal information and uses the information to obtain money or credit.]  How do you think people discover they are victims of identity theft?  [Victims of identity theft discover that someone has used a credit card or made charges in their name. Identity thieves may also do other things, like send emails or post things, using the victim’s name. These things can harm the victim’s reputation.]

How can you protect against these risks? [Create good passwords. Change passwords often.] What are the benefits of creating a strong password? [Your information will be safe.] What are the costs? [It takes time and effort to create a good password and change it often; Sometimes it’s hard to remember a more complicated password.]

Review the risks of having too easy passwords. Ask students to explain what makes a good password.

Students practice creating good passwords and checking the strength of their passwords.

1.     Mnemonic passwords: Project Visual 3 – Mnemonic Passwords / Lesson PPT 8: Introduce students to mnemonic passwords. Explain that mnemonics (pronounce mnemonic mne·mon·ic , nÄ­-mŏn’Ä­k) are patterns of letters or ideas that help people remember things. A password is created when you create a sentence and use the first letter of every word and include number words as characters. For example: My Friend Jane Eats 2 Apples Every Day To Stay Very Healthy! = MFJE2AEDTSVH!

2.     Students create passwords for a favorite character. Remind them that the password shouldn’t be too complicated or too easy.  The password should relate to something the character knows or does that will be easy for them to remember.

3.     Now that students know how to make good passwords, they can use what they have learned to create passwords and check them with a password validator  or https://password.kaspersky.com/

Students create a Public Service Announcement (PSA) that teaches why it’s important to create good passwords and tips for creating them.  If you don’t want to videotape students’ PSA’s, students can hand in the written scripts and/or act out their PSA’s for the class.

• Students refer to Handout 2 / Lesson PPT 5 with Baby Bear’s suggestions for good passwords. Then they create a PSA about the importance of good passwords and tips for creating good passwords.
• Students can use Handout 3 for a simple script for video PSA’s.

o   Show Handout 2 / Lesson PPT 7.  Review with students. Tell students that they are going to create a script for a public service announcement about creating good passwords. Tell them that a public service announcement is like an advertisement so they are trying to persuade people to create good just right passwords. Tell students they are going to use evidence they read or discussed during the lesson to make a persuasive argument by discussing the risks of weak passwords and considering the benefits and costs ofcreating strong passwords. The PSA will also provide tips for how to create good passwords.

o   Students write their scripts. When they are finished, they practice their PSA.

o   During the second session, students can either record their PSA’s by setting up a computer or tablet, or the teacher can record them using a cellphone or other device. Here are some hints for making successful videos: Provide students with a time limit of less than two minutes. A PSA is generally from 30 seconds to a minute and a half. Students can present their first try in front of the class and edit before they make their final video version. For ease of recording, you can record each group individually. For a more authentic experience, share these videos with other classes and parents.

• If you would like students to use additional sources, direct them to one of the following websites to gather more information about good passwords:

o   Safe Kids.com

o   Digizen.org (download the perfect passwords checklist document)

• Assess the videos/scripts/performances using the rubric.