Unit 7 · Cybersecurity · Lesson 7.6

Authentication and Multifactor

A password is a key, and 7.2 already told you what makes a key strong. Today: why length beats cleverness, why reusing a password is the real disaster, and the five minutes that protect an account better than anything else.

Big Idea 5 — Impact of ComputingCED 5.6 · today’s decision: turn on multifactor

Before this lesson

No reading — this page is the reading. Bring 7.2’s idea: strength comes from the number of possible keys.

Where We Are

People→ Bits→ Programs→ Internet→ Security→ Big Data→ Impact

Security, at the front door. Encryption protects data on the way. Authentication decides who gets in.

The Hook

123456. password. qwerty. Every year, lists of the most common passwords from leaked databases get published, and the top of the list barely changes. Laugh — then honestly ask yourself whether one of your passwords is a name, a birthday, or a word with a 1 at the end.

The Idea

Authentication is proving you are who you say you are. There are three kinds of proof, called factors:

Factor	Examples	Beaten by
something you know	password, PIN, security answer	guessing, a breach, phishing
something you have	your phone (a code or an app prompt), a security key	physically stealing it
something you are	fingerprint, face — biometrics	very hard to fake remotely

Multifactor authentication (MFA) requires factors from two different categories. A password plus a code from your phone is MFA. Two passwords is not — both are “something you know,” and the same attack gets both.

Password strength is key space. Each extra character multiplies the number of possible passwords, so length beats complexity: four random words beat eight characters of symbols.

Reuse is the actual catastrophe. When one site is breached, attackers try the same email and password on hundreds of other sites automatically. One leak unlocks every account that shares the password. A password manager — an app that generates and remembers a different strong password for every site — is the practical fix.

Try It — Key Space, Then Spot the MFA

Part 1. How long would it take a fast attacker to try every possible password? (We assume 10 billion guesses per second — a fast offline attack on a stolen database. Real speeds vary a lot, but the comparisons hold.)

characters from:

length:8

Part 2. Multifactor, or not?

Vocabulary

authentication Security: Verifying that a user is who they claim to be.
multifactor authentication (MFA) Security: Requiring two or more factors from different categories: something you know, have, or are.
biometric Security: A body measurement used for authentication — fingerprint, face, voice.
credential Security: The information used to authenticate, such as a username and password.

Check

Five questions. “Which of these is multifactor?” is a regular.

0 of 5 answered

Impact Check

Today’s decision: five minutes

Pick the account you’d least like to lose — usually your main email, because it can reset every other password. Turn on multifactor in its security settings. It’s the highest-value five minutes of this unit. (Don’t type real passwords into any class activity, including this page — the tool above asks for a length, not a password.)

Connections

Came from 7.2 — key space. A password is a key; more possibilities means longer to brute-force.

Came from 7.1 — security questions are a weak “something you know” — often public.

Next in 7.7 — attackers rarely guess. They just ask — with a convincing fake login page.

Returns in 7.9 — the security audit: reuse, MFA, and app permissions, checked privately.