Passwords and security

A password is a key. A bad password is a key lying under the doormat.

What makes a password strong:

The rule	Why
Long — at least four words	length matters more than strange characters
Not guessable	not your name, your pet or your date of birth
Different in different places	if one leaks, not everything leaks

A good trick: four random words.

correct-horse-battery-staple

That is easy to remember and very hard to guess. Much better than Hello123!, which looks complicated but is short and common.

Two more things that help more than a good password:

1. Two-factor — a code to your phone on top of the password. Even if somebody gets your password they do not get in.
2. A password manager — a program that remembers all your passwords for you. Then they can all be different and long.

Trickery on the internet (phishing) is when somebody pretends to be somebody else to get your details.

Five warning signs:

The sign	Example
Urgency	«your account will be closed in 24 hours!»
Too good to be true	«you have won a gift card»
Asks for your password	no serious service ever does that
A strange address	micr0soft-login.xyz instead of microsoft.com
Strange language	translation errors, the wrong name, a strange tone

Rule number one: no real service asks for your password — not in an email, not in a chat, not on the phone. None. Ever.

What you never share:

Never	Why
Your password	obviously
Codes sent to your phone	they are the whole point of two-factor
Your personal identity number	it can be used for fraud
Where you live and go to school	especially not to somebody you only know online
Pictures you do not want everybody to see	they cannot be taken back

If something feels strange: do not click. Ask an adult. It is never embarrassing to ask, and it is always worse not to.

And if something has already happened — you clicked, you shared something, somebody tricked you: tell an adult straight away. The sooner the easier it is to fix. Nobody is going to be angry.

Part 1 — make a good password.

Look four random words up. You can open a book at random, use a die, or just point blindly in a word list.

My four words: ______ - ______ - ______ - ______

How long did the string become? If it is over 20 characters you have a genuinely strong password. And you can remember it by making a picture in your head of the four words together — the stranger the picture, the easier it is to remember.

Part 2 — find the fakes. Which of these are trickery?

#	The message	Genuine or fake?
1	«Hello! Your parcel could not be delivered. Click here: postnord-delivery.info»
2	«We have updated our terms. Log in the usual way when you want to read more.»
3	«CONGRATULATIONS! You are our 1000th visitor! Click for your present!»
4	«Your teacher has shared a document with you in the school system.»
5	«This is support. We need your password to fix your account.»

The key: 1 fake (a strange address + urgency) · 2 genuine-ish (no link, no urgency) · 3 fake (too good to be true) · 4 probably genuine, but log in yourself instead of clicking the link · 5 always fake — no support ever asks for your password.

The best habit: never click the link in the message. Go to the site yourself, the way you usually do. If the message is genuine it will be there too.