Improper credential management

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is an example of improper credential management?

A Saving all your passwords in a plain text file called passwords.txt

B Saving your passwords in an encrypted password manager

2. A website stores user passwords in plain text. What happens if attackers breach its database?

A They can read every password straight away and log in as those users

B They still cannot use the passwords because the database was breached

3. Which choice is the safer way to handle credentials?

A Share one team login so everyone remembers it easily

B Give each person their own account with their own password

4. You use the same password for your email, gaming and school accounts. What is the main risk?

A The password gets stronger each time you reuse it

B One stolen password could unlock all of your accounts

5. A developer pastes an API key into code and uploads it to a public repository. Is this safe?

A No, anyone can find the key and use it to gain access

B Yes, nobody looks at code on public repositories

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1password = "Summer2024!" saved in a notes.txt file		Agmail_pw = "Pass123" game_pw = "Pass123" bank_pw = "Pass123"
2shared_login = "class_admin" used by 5 people		BSharing a login over chat spreads the password to many people and devices, and it could be forwarded or stolen. Use separate accounts or a family plan instead.
3Reusing one password on many sites means a single stolen password unlocks every account.		Capi_key = "sk_live_8f3a91c2" # saved in public code
4A secret key or token written into code or a file can be stolen by anyone who can see that file.		DA shared account: no one can tell who did what, and one leak exposes the account for everyone.
5Sticky note on the monitor: Wi-Fi admin password = Rocket99		EThe password is written down in plain sight, so anyone who walks past can read and steal it. Store it in a password manager instead.
6Message to a friend: "Here is my streaming login, use it for the whole group!"		FPlain text storage: anyone who opens the file can read the password and use it to get in.

Definitions

Improper credential management

Fill in the Blanks

Complete each line of code by filling in the missing parts.

name = "ava" password = "sunshine1" users[name] = ________ # plain text

name = "ava" password = "sunshine1" users[name] = ____(password)

users = ["ava", "liam", "mia"] ___ person in users: login("admin", "Pass1")

pass1 = "Fluffy99" pass2 = _____ pass3 = pass1

password = "sunshine1" with ____("passwords.txt", "w") as f: f.write(password)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A from hashlib import sha256

B pw = input("Password: ")

C saved = pw

D db.save(user, saved)

Question 2

A key = "sk-81f3a9c2"

B h = {"Authorization": key}

C r = get(url, headers=h)

Question 3

A sites = ["bank", "email", "shop"]

B for s in sites:

C pw = make_password()

D set_password(s, "Maple24")

Question 4

A user = input("User: ")

B pw = input("Password: ")

C log.write(user + " " + pw)

D login(user, pw)

Question 5

A for student in class_list:

B name = student.name

C create_login("classroom")

D send_setup_link(name)

Answer Key

Improper credential management

Section A: Quick Questions

A — Saving all your passwords in a plain text file called passwords.txt

A — They can read every password straight away and log in as those users

B — Give each person their own account with their own password

B — One stolen password could unlock all of your accounts

A — No, anyone can find the key and use it to gain access

Section B: Match the Pairs

password = "Summer2024!" saved in a notes.txt file → Plain text storage: anyone who opens the file can read the password and use it to get in.

shared_login = "class_admin" used by 5 people → A shared account: no one can tell who did what, and one leak exposes the account for everyone.

Reusing one password on many sites means a single stolen password unlocks every account. → gmail_pw = "Pass123" game_pw = "Pass123" bank_pw = "Pass123"

A secret key or token written into code or a file can be stolen by anyone who can see that file. → api_key = "sk_live_8f3a91c2" # saved in public code

Sticky note on the monitor: Wi-Fi admin password = Rocket99 → The password is written down in plain sight, so anyone who walks past can read and steal it. Store it in a password manager instead.

Message to a friend: "Here is my streaming login, use it for the whole group!" → Sharing a login over chat spreads the password to many people and devices, and it could be forwarded or stolen. Use separate accounts or a family plan instead.

Section C: Definitions

Improper credential management — Storing, sharing or reusing passwords, keys or tokens insecurely (in plain text, on shared accounts, or on many sites) so attackers can steal them and gain unauthorised access.

Section D: Fill in the Blanks

name = "ava"
password = "sunshine1"
users[name] = password  # plain text

name = "ava"
password = "sunshine1"
users[name] = hash(password)

users = ["ava", "liam", "mia"]
for person in users:
    login("admin", "Pass1")

pass1 = "Fluffy99"
pass2 = pass1
pass3 = pass1

password = "sunshine1"
with open("passwords.txt", "w") as f:
    f.write(password)

Section E: Spot the Error

C — The password is saved as plain text, so anyone who steals the database can read it. It should be hashed first: saved = sha256(pw.encode()).

A — The API key is hard-coded in the source code, so anyone who sees the code can steal it. It should be read from a protected setting: key = os.getenv("API_KEY").

D — The same fixed password is reused on every site, so one stolen password unlocks all accounts. Each site should get its own generated password: set_password(s, pw).

C — The password is written into a log file in plain text, where attackers or staff could read it. Only the username should be logged: log.write("Login by " + user).

C — One shared login for everyone means nobody can be traced and one leak exposes the whole class. Each student needs their own account: create_login(name).