Stretch tasks Protecting yourself

Round 1: Quiz Blitz

1. copper-badger-lantern-otter Length beats tricks. Four random words is long and unpredictable; swapping letters for symbols is the first thing cracking tools try.
2. False The second factor is something other than a password: a code sent to your phone, an app on a device you own, or your fingerprint.
3. Do not reply → Screenshot the messages → Block and report the account → Tell a trusted adult Not replying denies the reaction. Screenshots come before blocking, because blocking can hide the messages you need as evidence.
4. A code sent by text to your phone; Your fingerprint A second factor is something you have, like your phone, or something you are, like a fingerprint. More things you know is not a second factor.
5. He has committed an offence under the Computer Misuse Act Unauthorised access is an offence on its own. Looking without permission is enough, whether or not anything is changed.
6. The Copyright, Designs and Patents Act 1988 Copying or sharing films, music, games or images without permission infringes copyright.
7. The Data Protection Act 2018 The Data Protection Act gives you the right to see the personal data an organisation holds about you, and to have mistakes corrected.
8. Every account gets a different strong password, and you remember just one If one site is breached, only that one password leaks. Reusing one password lets an attacker try it everywhere.
9. True Every extra character multiplies the guesses needed. Four random words is long; a short password is quick to crack whatever symbols it uses.
10. 1990 The Computer Misuse Act 1990 makes unauthorised access to computers and accounts a crime.
11. Blocking can hide the messages you need as evidence Platforms and schools need evidence to act. Capture it first, then block.
12. The next user could use your account and act as you Anything done while you are logged in looks like you did it.

Round 2: Quick Fire

1. • The attacker also needs the second factor, such as a code sent to your phone
   • They do not have it, because only the owner has the device
   Model answer

   To log in, the attacker would also need the second factor, such as the code sent to the owner's phone. They do not have it, because only the owner has that phone, so the stolen password alone is not enough.

2. • A reply gives them the reaction they want, or makes things worse
   Model answer

   Replying gives the bully the reaction they want and usually makes the situation worse.

3. • (a) The Copyright, Designs and Patents Act 1988
   • (b) The Computer Misuse Act 1990
   Model answer

   (a) Copying and sharing the game breaks the Copyright, Designs and Patents Act 1988. (b) Logging in with a guessed password is unauthorised access, which breaks the Computer Misuse Act 1990.

4. • It is built from guessable personal information: a team and a year
   • It follows a predictable pattern that cracking tools try early, a word then numbers then a symbol
   Model answer

   It is built from guessable personal information: a football team and a year, which might be a birth year, both of which could be found on social media. It also follows the most predictable pattern there is, a word then numbers then a symbol at the end, which cracking tools try very early.

Round 3: Big Think

1. • Change the password to a new, strong one
   • Turn on two factor authentication
   • Screenshot the post as evidence, then delete or report it
   • Tell a trusted adult
   • The Computer Misuse Act 1990, because it was unauthorised access
   Model answer

   Ali should take a screenshot of the post as evidence and then delete it or report it. He should change his password straight away to a new, strong one that his friend cannot guess, and turn on two factor authentication so a password alone is never enough again. He should tell a trusted adult such as a parent or teacher. His friend has broken the Computer Misuse Act 1990, because logging into someone else's account without permission is unauthorised access, even as a joke.

2. • It stops attackers who have stolen or guessed a password
   • It protects people who fall for phishing or reuse passwords
   • Fewer hacked accounts means fewer scams sent to friends
   • It is less convenient: an extra step at every login
   • People who lose their phone, or do not have one, could be locked out
   • Some people may find it confusing or hard to use
   • It means giving the company a phone number: more personal data
   • A reasoned conclusion
   Model answer

   Making two factor authentication compulsory would stop attackers who have stolen or guessed a password, because they would still need the code from the owner's phone. It would protect people who fall for phishing or reuse the same password on many sites, and fewer hacked accounts would mean fewer scams being sent to friends and followers. However, it is less convenient, adding an extra step every time you log in, and people who lose their phone or do not have one could be locked out of their own accounts. Some people, such as older users, may find it confusing, and it often means giving the company a phone number, which is more personal data. Overall, I think it should be switched on by default for everyone, with a careful way back in for people who lose their phone, because the protection is worth the small extra effort.

This or That

1. A different password for each important account If one site is breached, a reused password unlocks every other account that shares it.
2. They still need your second factor With two factor authentication, a stolen password on its own is not enough.
3. Keep it to yourself Never share a password, not even with your closest friend. Friendships change and phones get lost.
4. Screenshot the messages as evidence A reply is what the bully wants. Screenshot everything, then block, report and tell an adult you trust.
5. The person doing the bullying You are never in trouble for reporting it. The person doing it is the one with the problem.
6. A criminal offence Using someone's account without permission breaks the Computer Misuse Act 1990, even as a joke.
7. Copyright, Designs and Patents Act 1988 Copying or sharing music, films, games or images without permission breaks copyright law.
8. Data Protection Act 2018 The Data Protection Act controls how organisations use personal data and lets you see what they hold.

Memory Match

• A 3 Two factor authentication: A second check as well as your password
• B 6 Password manager: Stores a different strong password for each account
• C 2 Cyberbullying: Using messages or social media to hurt someone
• D 1 Computer Misuse Act: Makes it a crime to access accounts without permission
• E 4 Data Protection Act: Controls how organisations use your personal data
• F 5 Copyright law: Stops people copying music, films and games without permission