Data Protection
Senior 2 · ICT
Data Protection
Lesson 3 of 5
16 min
Let's begin
A password is the key to your email, your school account and your family's mobile money. Attackers use computers that can try thousands of guesses every second. A strong password can make guessing it take longer than a lifetime.
A password is a secret string of characters that proves you are the owner of an account. Checking that a user is really who they claim to be is called authentication. A PIN (Personal Identification Number) is a password made only of digits.
Count the possible passwords. Each position can hold any character from the set allowed, so you multiply.
| Password type | Working | Possible passwords |
|---|---|---|
| 4-digit PIN | 10 × 10 × 10 × 10 = 10^4 | 10,000 |
| 6-digit PIN | 10^6 | 1,000,000 |
| 8 lowercase letters | 26^8 | about 209 billion |
| 8 characters from a–z, A–Z and 0–9 (62 symbols) | 62^8 | about 218 trillion |
A program trying 1,000 guesses per second finds a 4-digit PIN in at most 10,000 ÷ 1,000 = 10 seconds. That is why mobile money and bank cards lock after a few wrong PINs. Every extra character multiplies the number of possibilities by the size of the character set, so length is the most important strength. Current guidance from NIST, the United States standards body, is at least 15 characters when a password is the only protection on an account.
| Password | Verdict | Why |
|---|---|---|
| Mugisha2011 | Weak | A name plus a year: the first thing an attacker tries. |
| p@ssw0rd | Weak | A common word with predictable swaps (@ for a, 0 for o). Dictionary programs try these. |
| avoka-moto-inanasi-Kivu-7 | Strong | A long passphrase: several unrelated words, easy to remember, very slow to guess. |
Tip
Long beats clever. Four random words make a stronger and more memorable password than one short word full of symbols.
How many different 3-digit PINs can be made from the digits 0 to 9?
Solution: 10 × 10 × 10 = 1,000.
Which is stronger: a 6-digit PIN or a 4-letter lowercase password? Show your working.
Solution: 6-digit PIN: 10^6 = 1,000,000. Four lowercase letters: 26^4 = 456,976. The 6-digit PIN has more possibilities, so it is stronger.
Ishimwe uses the password "Kigali123" for her email, her school portal and a gaming site. Give two weaknesses.
Solution: (1) It is a place name plus a simple number sequence, which a dictionary attack tries early. (2) She reuses it, so if the gaming site is hacked, her email and school accounts are exposed too.
Someone calls Keza, says they are from her mobile money provider and asks for her PIN "to fix her account". What should she do?
Solution: Refuse and hang up. Real providers never ask for your PIN. This is a trick to steal it.
Remember
Sources and credits
This lesson adapts CC BY-SA material and is shared under CC BY-SA 4.0.
