Year 9 · Autumn 2

Cybersecurity · Lesson 3 of 5

Brute force: a Python password-strength checker

PracticalTopic 17 Cybersecurity

Year 9 · Cybersecurity · Lesson 3 of 5

You will learn to

  • Calculate how many passwords are possible with the password formula: C to the power L.
  • Explain why making a password longer beats adding symbols.
  • Use the lock-out formula to show why three tries, then a wait, defeats brute force.
  • Write a Python password checker that scores length, digits and symbols.

Year 9 · Cybersecurity · Lesson 3 of 5

Success criteria

You have got it when you can say:

  • I can work out 26⁸ with a calculator and say what it means.
  • I can compare the time to crack a password with and without a lock-out.
  • I can run my checker on three passwords and explain each score.

Year 9 · Cybersecurity · Lesson 3 of 5

Retrieval starter

Questions from before. Write your answers, then show them.

  1. Last lesson

    Which spreads across a network without anyone opening a file?

    A VirusB WormC Trojan

    B. Worm

  2. Last unit

    word = "Python". What is word[1:4]?

    A "yth"B "Pyth"C "ytho"

    A. "yth"

  3. Earlier this unit

    A fake bank email asking you to log in is…

    A PhishingB A wormC Brute force

    A. Phishing

Year 9 · Cybersecurity · Lesson 3 of 5

Key words (1 of 2)

Malware
Malicious software: viruses, worms, trojans, ransomware, spyware.
Phishing
Fake messages that trick people into giving details.
Brute force
Trying every possible password until one works.
Encryption
Scrambling data so only someone with the key can read it.

Year 9 · Cybersecurity · Lesson 3 of 5

Key words (2 of 2)

Firewall
Checks network traffic and blocks what isn't allowed.

The explanation · step 1 of 1

Why password length matters

PasswordCalculationPossibilities
4-digit PIN10⁴10,000
8 lower-case letters26⁸about 209 billion
8 of any keyboard symbol94⁸about 6 quadrillion
12 lower-case letters26¹²about 95 quadrillion
e.g.Example

A long passphrase like purple-violin-tuesday-rain beats a short messy one.

The explanation · step 1 of 1

The maths: How long to crack a password?

Year 9 · Cybersecurity · Lesson 3 of 5

Try it: How long to crack it?

Year 9 · Cybersecurity · Lesson 3 of 5

The maths: Why a lock-out beats brute force

Symbols first, then the words, then the equation. Change the numbers.

Year 9 · Cybersecurity · Lesson 3 of 5

Quick quiz · 1 of 3

In def area(w, h): … and a = area(4, 3), which are the arguments?

  1. A 4 and 3
  2. B w and h
  3. C area and a

A. 4 and 3

Arguments are the actual values passed in the call. w and h are parameters.

Year 9 · Cybersecurity · Lesson 3 of 5

Quick quiz · 2 of 3

A variable made inside a function is…

  1. A Global: usable anywhere
  2. B Saved to a file
  3. C Local: only exists inside it while it runs

C. Local: only exists inside it while it runs

Local variables are wiped when the function returns.

Year 9 · Cybersecurity · Lesson 3 of 5

Quick quiz · 3 of 3

Testing a 0–50 range with 50 is…

  1. A Boundary data
  2. B Erroneous data
  3. C Normal data

A. Boundary data

It's right at the edge of what's allowed.

Year 9 · Cybersecurity · Lesson 3 of 5

Exit ticket

Answer on paper before you go. Then check.

  1. Typing your new password twice so they can be compared is…

    A VerificationB ValidationC Authentication

    A. Verification Verification checks data was entered correctly. Double entry is one method.

  2. open("log.txt", "w") on a file that already holds 100 lines…

    A Adds to the endB Gives an errorC Wipes it first

    C. Wipes it first "w" empties the file before writing. Use "a" to append.