← Years 5–6 Digital Systems

Multi-factor authentication

A login step that asks for a second proof of identity, like a phone code or app prompt, as well as your password. A stolen password alone is not enough.

Part of: 5-6 Digital Technologies Vic Curric - Digital Systems & Security — Module 46, 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 58, VCE Applied Computing - U1O1 - Data analysis — Module 45, VCE Software Development - U3O2 - Analysis and Design — Module 107, VCE Data Analytics - U4O1 - Development and Evaluation — Module 44, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 48

Understanding Multi-factor authentication in Years 5–6 Digital Systems

What it does: The code shows two proofs being combined, a password and a phone code, before access is allowed. Even with the right password, a thief without the second proof is blocked from the account. A code sent to your phone proves you have your phone. Typing your username again proves nothing new. MFA uses two separate proofs. Someone who steals only one of them still cannot log in. An unexpected code can mean someone has your password. Never share the code, and change your password. The same password twice is still one factor. MFA needs a different kind of proof, like an app code.

Common mistakes: Multi-factor authentication asks for a second proof as well as the password, so a stolen password alone is not enough. The line should say a second proof is needed, for example print("Need a 2nd proof"). The closing bracket is missing, so the print call is not complete. It should be print("Hacker gets in").

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Multi-factor authentication to a class →

This module's key terms are also in a printable crossword (Modules 41–52) and word search (Modules 21–52).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does multi-factor authentication (MFA) ask for?
A second proof of identity as well as your passwordA longer password and nothing else
Matches
Multi-factor login = password + same password again
↓
Typing the same password twice is not a second factor. The second proof must be different, such as a phone code or an authenticator app approval.
Applying
Meanings
Term
multi-factor authentication
Meaning
A login step that asks for a second proof of identity, like a phone code or app prompt, as well as your password. A stolen password alone is not enough.
Practice
enter password
Testing
Gaps
if passwordOk codeOk:
Check Answer
Spots
3print("Steps:", needed)
4print("One proof is enough")

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Silverback Gorilla' badge — Savannah Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does multi-factor authentication (MFA) ask for?
A. A second proof of identity as well as your password ✓
B. A longer password and nothing else
MFA adds a second proof of identity on top of your password, so a password alone is not enough to log in.
2. Which one is an example of a second factor?
A. Typing your username again
B. A code sent to your phone ✓
A code sent to your phone proves you have your phone. Typing your username again proves nothing new.
3. A thief steals your password. You have MFA turned on. What happens when they try to log in?
A. They are stopped because they cannot give the second proof ✓
B. They get in because the password is correct
A stolen password is not enough with MFA. The thief also needs your phone or app to pass the second step.
4. Which statement about an authenticator app is true?
A. It replaces your password so you never need one
B. It gives you a code or prompt to confirm it is really you ✓
An authenticator app is a second factor. It works together with your password and does not replace it.
5. Why is a password plus a phone code safer than a password alone?
A. An attacker needs both things to get in ✓
B. The phone code makes the password longer
MFA uses two separate proofs. Someone who steals only one of them still cannot log in.

Match the Pairs

SMS code: 482913 → A one-time code sent to your phone that you enter after your password as a second proof of identity
Authenticator app prompt: Approve sign-in? → An app on your device that asks you to approve a login or shows a changing code as a second proof of identity
Multi-factor authentication asks for a second proof of identity in addition to a password → password + phone code = logged in
A stolen password is not enough to get into an account that uses multi-factor authentication → password OK, phone code missing = access denied
Multi-factor login = password + same password again → Typing the same password twice is not a second factor. The second proof must be different, such as a phone code or an authenticator app approval.
Share my phone code with a caller to prove it is me → The second proof must stay private. Sharing a code lets a scammer get in, so never tell anyone your phone code.

Key Term

multi-factor authentication
A login step that asks for a second proof of identity, like a phone code or app prompt, as well as your password. A stolen password alone is not enough.

Fill in the Blanks

1. if passwordOk and codeOk:
Hint: Type the logical operator that requires both the password check and the second proof to pass before login.
2. if codeEntered == codeSent:
Hint: Type the comparison operator that checks the code the user typed matches the code sent to their phone.
3. if appApproved == True:
Hint: Type the Boolean value that means the authenticator app approved the login.
4. passwordOk = True codeOk = False access = passwordOk and codeOk
Hint: A thief has a stolen password but not the phone. Type the Boolean value for the code check, so a stolen password is not enough.
5. if len(proofs) >= 2:
Hint: Type the minimum number of proofs of identity that multi-factor authentication needs.

Spot the Error

Question 1
A steps = ["password", "code"]
B needed = len(steps)
C print("Steps:", needed)
D print("One proof is enough")
Line D — Multi-factor authentication asks for a second proof as well as the password, so a stolen password alone is not enough. The line should say a second proof is needed, for example print("Need a 2nd proof").
Question 2
A has_pw = True
B has_code = False
C if has_pw and has_code:
D print("Hacker gets in"
E else:
F print("Hacker is blocked")
Line D — The closing bracket is missing, so the print call is not complete. It should be print("Hacker gets in").
Question 3
A code = get_app_code()
B typed = code
C if typed == code:
D print("Verified")
Line B — The student must type the code from the authenticator app. Setting typed = code copies the right answer, so the check would always pass. It should be typed = input("Enter code: ").
Question 4
A sms_code = "482915"
B entered = input("SMS code: ")
C if entered = sms_code:
D print("Logged in")
E else:
F print("Try again")
Line C — A single = assigns a value. To compare the typed code with the code sent to the phone, use ==: if entered == sms_code:
Question 5
A password_ok = check_password()
B if not password_ok:
C send_code_to_phone()
D print("Code sent")
Line B — The phone code is the second step, sent only after the password is correct. With 'not' it would be sent when the password is wrong. It should be if password_ok:

Student with a class code? Join your class →