← ACARA Digital Technologies Years 9–10

Improper credential management

Storing, sharing or reusing passwords, keys or tokens insecurely (in plain text, on shared accounts, or on many sites) so attackers can steal them and gain unauthorised access.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 63, WA Computer Science ATAR Year 11 — Cyber Security — Module 57

Understanding Improper credential management in ACARA Digital Technologies Years 9–10

What it does: The same password is used for three accounts, so if one site is breached the attacker can try it on all the others. The key is stored as readable text in code that others can view, so an attacker can copy it and gain access. A plain text file can be read by anyone or any malware that finds it. A password manager encrypts the passwords it stores. Shared accounts make it hard to control access or know who did what. If one person leaks the password, everyone is at risk. Reuse lets attackers try a leaked password on many sites (credential stuffing). Using a unique password for each account limits the damage.

Common mistakes: The password is saved as plain text, so anyone who steals the database can read it. It should be hashed first: saved = sha256(pw.encode()). The API key is hard-coded in the source code, so anyone who sees the code can steal it. It should be read from a protected setting: key = os.getenv("API_KEY").

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Improper credential management to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which is an example of improper credential management?
Saving your passwords in an encrypted password managerSaving all your passwords in a plain text file called passwords.txt
Matches
Sticky note on the monitor: Wi-Fi admin password = Rocket99
↓
The password is written down in plain sight, so anyone who walks past can read and steal it. Store it in a password manager instead.
Applying
Meanings
Term
Improper credential management
Meaning
Storing, sharing or reusing passwords, keys or tokens insecurely (in plain text, on shared accounts, or on many sites) so attackers can steal them and gain unauthorised access.
Practice
username = "admin"
Testing
Gaps
users[name] = # plain text
Check Answer
Spots
2pw = input("Password: ")
3saved = pw

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Silverback Gorilla' badge — Savannah Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is an example of improper credential management?
A. Saving all your passwords in a plain text file called passwords.txt ✓
B. Saving your passwords in an encrypted password manager
A plain text file can be read by anyone or any malware that finds it. A password manager encrypts the passwords it stores.
2. A website stores user passwords in plain text. What happens if attackers breach its database?
A. They can read every password straight away and log in as those users ✓
B. They still cannot use the passwords because the database was breached
Plain text means no scrambling. Once the data is stolen, the passwords are ready to use. Hashed passwords are much harder to use.
3. Which choice is the safer way to handle credentials?
A. Share one team login so everyone remembers it easily
B. Give each person their own account with their own password ✓
Shared accounts make it hard to control access or know who did what. If one person leaks the password, everyone is at risk.
4. You use the same password for your email, gaming and school accounts. What is the main risk?
A. The password gets stronger each time you reuse it
B. One stolen password could unlock all of your accounts ✓
Reuse lets attackers try a leaked password on many sites (credential stuffing). Using a unique password for each account limits the damage.
5. A developer pastes an API key into code and uploads it to a public repository. Is this safe?
A. No, anyone can find the key and use it to gain access ✓
B. Yes, nobody looks at code on public repositories
Keys and tokens are credentials too. Attackers scan public code for them. Keep them out of the code, in a secrets store or environment settings.

Match the Pairs

password = "Summer2024!" saved in a notes.txt file → Plain text storage: anyone who opens the file can read the password and use it to get in.
shared_login = "class_admin" used by 5 people → A shared account: no one can tell who did what, and one leak exposes the account for everyone.
Reusing one password on many sites means a single stolen password unlocks every account. → gmail_pw = "Pass123" game_pw = "Pass123" bank_pw = "Pass123"
A secret key or token written into code or a file can be stolen by anyone who can see that file. → api_key = "sk_live_8f3a91c2" # saved in public code
Sticky note on the monitor: Wi-Fi admin password = Rocket99 → The password is written down in plain sight, so anyone who walks past can read and steal it. Store it in a password manager instead.
Message to a friend: "Here is my streaming login, use it for the whole group!" → Sharing a login over chat spreads the password to many people and devices, and it could be forwarded or stolen. Use separate accounts or a family plan instead.

Key Term

Improper credential management
Storing, sharing or reusing passwords, keys or tokens insecurely (in plain text, on shared accounts, or on many sites) so attackers can steal them and gain unauthorised access.

Fill in the Blanks

1. name = "ava" password = "sunshine1" users[name] = password # plain text
Hint: Type the variable that holds the raw secret being saved without any protection.
2. name = "ava" password = "sunshine1" users[name] = hash(password)
Hint: Type the function name that turns the password into a scrambled value, so the plain text is not stored.
3. users = ["ava", "liam", "mia"] for person in users: login("admin", "Pass1")
Hint: Type the keyword that repeats the code for each person. Here everyone signs in to one shared account.
4. pass1 = "Fluffy99" pass2 = pass1 pass3 = pass1
Hint: Type the variable name whose value is copied to the second site, which is the reuse mistake.
5. password = "sunshine1" with open("passwords.txt", "w") as f: f.write(password)
Hint: Type the built-in function that opens a file, here used to save a password in a plain text file.

Spot the Error

Question 1
A from hashlib import sha256
B pw = input("Password: ")
C saved = pw
D db.save(user, saved)
Line C — The password is saved as plain text, so anyone who steals the database can read it. It should be hashed first: saved = sha256(pw.encode()).
Question 2
A key = "sk-81f3a9c2"
B h = {"Authorization": key}
C r = get(url, headers=h)
Line A — The API key is hard-coded in the source code, so anyone who sees the code can steal it. It should be read from a protected setting: key = os.getenv("API_KEY").
Question 3
A sites = ["bank", "email", "shop"]
B for s in sites:
C pw = make_password()
D set_password(s, "Maple24")
Line D — The same fixed password is reused on every site, so one stolen password unlocks all accounts. Each site should get its own generated password: set_password(s, pw).
Question 4
A user = input("User: ")
B pw = input("Password: ")
C log.write(user + " " + pw)
D login(user, pw)
Line C — The password is written into a log file in plain text, where attackers or staff could read it. Only the username should be logged: log.write("Login by " + user).
Question 5
A for student in class_list:
B name = student.name
C create_login("classroom")
D send_setup_link(name)
Line C — One shared login for everyone means nobody can be traced and one leak exposes the whole class. Each student needs their own account: create_login(name).

Student with a class code? Join your class →