Digital Safety and Secrets

What you'll learn

• How to build a passphrase that would take centuries to crack
• How two-factor authentication stops someone who already has your password
• How to spot phishing even when the grammar is perfect and the sender looks real
• What a secret is in programming, and why it never goes in your code
• How a .env file keeps a key out of the file you share

What you need

• A computer with a web browser
• No phone in class. Two parts of this lesson work best with your own phone and accounts, so you do them at home. Each one also has an in-class option, so nobody is stuck.
• For the home parts: one account you actually control and can change settings on. A personal account is fine and is usually easier than a school one.
• Only for the optional Day 2 bonus: VS Code. It is on the lab machines. No VS Code at home? Skip the bonus. Nothing else in this lesson needs it.

Day 1

Lock down your accounts

Goal: by the end of today you have three passphrases you can actually remember, a plan for where to keep the rest, two-factor authentication switched on somewhere real (at home, or the in-class version), and the ability to look at a message and say why it is fake.

Step 1: Watch a bad password die

Every year, security researchers publish the most common passwords found in leaked databases. Every year, it is basically this list. People are wonderfully predictable.

Nobody is sitting at a keyboard typing guesses at your account. They run software against a stolen list at millions of tries per second. Anything on that table fell over before you finished reading this sentence.

Test one yourself

Try password1, then your pet's name and a year, then a whole sentence. Then mash your keyboard for forty characters. It holds up, and you will never remember it. Keep that thought. There is a well known public version of this at security.org, worth bookmarking for the day you set up something that matters. Same warning applies there.

Step 2: Build a passphrase

Length beats cleverness. Every character you add multiplies the work, and multiplying gets out of hand fast, which is the one time that works in your favor.

Six random words does it. Attackers who know you used words guess whole words, not letters, so each word counts as one guess from a big list. Four words falls in hours. Five takes years. Six takes centuries. Random is the load-bearing word here, because saint-croix-high-school is four words and still weak. Anyone who knows you would guess it.

Do this: generate three, test each in the meter above, and write down the crack time. Those three go in your submission.

Why length beats symbols

Schools and websites spent twenty years demanding a capital, a number, and a symbol. What they got was Password1!, roughly two hundred million times. Everyone follows the rule the same lazy way, so attackers just try the lazy way first.

Picture a combination lock. Symbols give you more numbers on each dial. Length gives you more dials. Adding a dial multiplies everything that came before it, which is why length wins and it is not close.

Six random words give you enough dials that no computer on Earth gets through in your lifetime, or your grandchildren's. A long phrase you can actually remember beats a short scramble you end up writing on a sticky note under your keyboard, which is where roughly half of all strong passwords go to die.

Where do you keep all of these?

Three strong passphrases is easy. Forty accounts is not. Nobody can memorize forty, so people reuse one password everywhere. Then one leaked website opens every account at once, because attackers try each stolen password on every other site. That has a name, credential stuffing, and it is why reuse is the worst habit on this table.

What a password manager actually does

• It makes the passwords. Long, random, different on every site. You never see most of them and you never need to.
• It only fills the real site. A fake site with a number one in the name does not match anything saved, so nothing fills in. That is your phishing alarm, for free.
• One passphrase to guard. The master passphrase is the one you must never forget, and never reuse. Turn on two-factor for the manager itself.

Step 3: Make a stolen password useless

Two-factor means logging in takes two things: something you know (your passphrase) and something you have (your phone, or an app, or a key). Someone who steals your password still cannot get in.

Text codes are the weakest of the four because of SIM swapping, which you will read about in a moment. They are still far better than nothing.

Turn it on somewhere that matters. Email first if you can, because password resets for everything else land there.

Step 3b: Turn it on, at home

Step 3c: The in-class version

No phone needed. If you did the home version, you can skip this and keep going. Tap an answer to see why.

Step 3c: Question 2

Step 4: Spot the phish

Phishing is someone pretending to be a company or a person you trust so that you hand something over. This is how people actually get hacked. Nobody is in a dark room breaking your encryption with a progress bar. They just asked, politely, while wearing a costume.

Terrible spelling used to give these away for free. AI ended that overnight. So stop judging the writing and start checking the structure.

• Read the sender address itself. The display name is free to type. The name says Apple Support and the address says support@apple-security-update-2026.com.
• Urgency and threats. "Your account will be DELETED in 24 hours." Real companies spend a fortune trying to keep you. They are not deleting you on a Tuesday over an unclicked link.
• A generic greeting. "Dear Customer" from a company that knows your name.
• The link does not match. Hover first. paypa1.com uses a number one. paypal.security-update.com belongs to security-update.com. The real domain is the part right before the first single slash.
• An attachment you did not ask for. Especially .exe, .zip, and .scr.
• Too good to be true. Reader, it is not true.

Now work the inbox

Eight messages. Open each one and decide.

Before you leave today

A progress check, not the hand-in. The full submission list is in the Turn in tab.

• Three passphrases, with the crack time the meter gave each one
• Two-factor: a screenshot from home with private details blurred, or both in-class questions answered
• All eight inbox messages judged, and your score screenshotted

Day 2

Protect your data and your code

Goal: by the end of today you know what you are giving away without meaning to, and you know where a password belongs in a project you are going to share.

Step 1: What your photos tell strangers

Here is what someone builds from pieces that each feel harmless.

Check the background of a photo for a house number, a street sign, a school logo, a license plate, a package label, or a screen with a name on it. You can practice two ways. In class, use the photo on the next slide. At home, look through the last five photos you posted or sent, without opening anything private.

The rules that follow are short. Keep profiles private. Post the vacation photos after you get home. Check the background before you post. Ask whether you would be fine with a stranger, a teacher, and an employer all seeing it.

Step 1b: Spot the details

Jordan posted this photo today with the caption “new hoodie!” Click everything in it that tells a stranger something about Jordan. Not everything counts.

Step 2: Assume the voice can be faked

A few seconds of audio is enough to clone a voice. Video of a real person saying things they never said is cheap now. A profile photo of a person who has never existed takes one click.

You cannot win this by squinting harder. The fakes improve every year and your eyes have not had an upgrade since you were born. So the defense has to be a habit rather than a skill.

This one habit covers voice cloning, deepfake video, hacked accounts, and every scam that has not been invented yet, because it never depends on you detecting the fake.

Step 3: What actually counts as a secret

A secret is any value that proves who you are to a computer. A password. An API key. A Wi-Fi password. A database login. A token an app uses to talk to a service.

Here is the problem, and it is the reason this sits in a Computer Science class instead of a health class.

# BAD. Never do this.
api_key = "sk-a83ff20c9d4e1b77c5"

response = ask_the_ai(api_key, "explain recursion")

That key now lives inside your code, and it travels everywhere the code travels. Post the project to GitHub and the key is public. Share the folder with a partner and they have your key. Submit a screenshot and the key is in the picture. Bots scan public code for keys around the clock, and people have woken up to four figure bills from a key they published before dinner.

Putting a key in your code is like taping your house key to your front door, then posting a photo of your door, then being surprised.

Step 4: Put the secret somewhere safe

A .env file holds the secrets. It sits next to your code and it never leaves your machine.

import os
from dotenv import load_dotenv

load_dotenv()
api_key = os.getenv("API_KEY")

API_KEY=sk-a83ff20c9d4e1b77c5

Optional bonus: build it yourself

If you have never opened a terminal before, that is fine. This is written for exactly that.

We do all of this inside VS Code, which is already on the lab machines, because VS Code lets you make files whose names start with a dot. Finder and File Explorer both fight you on that, and it is the single most annoying part of this for beginners.

Step A: Make a folder and open it

1. Open VS Code
2. Go to File → Open Folder
3. Navigate to your Desktop, make a New Folder called secret-test, and open it

The left sidebar should now say SECRET-TEST and be empty underneath.

Step B: Make three files

For each one, hover the sidebar and click the New File icon, then type the name exactly, including the dot at the front where there is one. Then click Copy on the box below, click inside the file, and paste.

.env   (the secret. Note the dot.)

API_KEY=not-a-real-key-12345

.gitignore   (the part everyone forgets. Also a dot.)

.env

read_secret.py   (the code. No dot at the front.)

import os
from dotenv import load_dotenv

load_dotenv()
print("Loaded key:", os.getenv("API_KEY"))

Step C: Open the terminal

In VS Code, go to Terminal → New Terminal. A panel opens at the bottom.

It already starts inside your secret-test folder, which is the reason we are doing it this way. You never have to learn how to navigate folders from a command line today.

Check Python is there. Click Copy, click inside the terminal, paste (Ctrl+V, or Cmd+V on a Mac), then tap the Enter key:

python3 --version

You want something like Python 3.12.1. Any 3 is fine.

Step D: Install the one library you need

Your code says from dotenv import load_dotenv, which is you borrowing somebody else's code. It has to be on this machine first.

pip3 install python-dotenv

You will see several lines scroll past. The one you want at the end is:

Successfully installed python-dotenv-1.x.x

Step E: Run it

python3 read_secret.py

What you are looking for:

Loaded key: not-a-real-key-12345

Now look back at read_secret.py. The key is printed on your screen, and the key is nowhere in that file. That is the entire point, and you just built it.

If it did not work

Every one of these is normal and every one of them has a two second fix.

Watch one line save you $400

Same project, pushed twice. The only difference is whether .gitignore exists.

Why .gitignore is the part people forget

load_dotenv() reads the .env file and hands the values to your program at the moment it runs. Your code asks for API_KEY by name and never contains the value.

.gitignore is the second half, and skipping it is the single most common way keys leak. It is a list of files Git refuses to include when you save or upload your work. Without that one line, the moment you push your project the .env goes with it, and everything you just did was for nothing.

Real companies leak real keys this exact way, constantly, with entire security teams on payroll. This is not a beginner mistake. It is the mistake.

Before you leave today

A progress check, not the hand-in. The full submission list is in the Turn in tab.

• You found an identifying detail in the background of a photo
• You answered which of the two files is safe to post, and why
• Optional bonus, if you did it: your .gitignore and a terminal screenshot printing the key

Base and optional bonus

What you turn in

The whole list. Every item comes out of an activity you already did. Optional bonus, HS and MS: your terminal screenshot and .gitignore from the Day 2 VS Code part. Skipping it costs you nothing.

• Three passphrases with the crack time the meter gave each one. From Step 2. Never submit a password you actually use.
• Two-factor proof: a screenshot of it turned on, private details blurred, from home. If you cannot do that, your answers to the two in-class questions instead. From Step 3b or 3c.
• Screenshot of your inbox score, plus one sentence on each message you got wrong and what gave it away. From Step 4.
• The secrets answer: which file is safe to post and why. From Day 2 Step 4.
• Reflection, 3 to 5 sentences: what is the biggest security mistake you have been making, and what are you changing?

Handing it in

Two things to hand in, not one

Vocabulary

When it goes wrong