← Years 5–6 Digital Systems

Risks of password re-use

Using one password on many accounts. If a data breach leaks it, attackers try it on other sites and can unlock every account that shares it.

Part of: 5-6 Digital Technologies Vic Curric - Digital Systems & Security — Module 43, 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 53, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 60, ACARA Digital Technologies Years 5–6 — Staying Safe Online — Module 14, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 67

Understanding Risks of password re-use in Years 5–6 Digital Systems

What it does: The same password is stored for three accounts, so a leak from the shop site exposes the email and bank accounts too. When a password is re-used, one breach can put every account that shares it at risk. Attackers know people re-use passwords, so they test leaked passwords on other popular sites. Password re-use means one password is shared across accounts, which is the risk this module is about. Re-using Sunny2024 on all accounts creates a domino effect after a single breach, so the fix is a different password for each.

Common mistakes: The check should use == to test whether both accounts share the same password. With !=, the warning only appears when the passwords are different, which hides the re-use risk. A comma is missing between the two print arguments. It should be print("Try on", site) so the attacker tries the stolen password on every site.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Risks of password re-use to a class →

This module's key terms are also in a printable crossword (Modules 41–52) and word search (Modules 21–52).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Mia uses the same password for her email, her game account and her school login. One site is hacked. What is the risk?
Attackers can try that password on her other accounts and unlock them tooOnly the hacked site is at risk because her other accounts are separate
Matches
game.password = "Sunny2024"; email.password = "Sunny2024"; school.password = "Sunny2024"
↓
The same password is used on every account, so one data breach lets attackers unlock the game, email and school accounts like a row of dominoes falling. Each account needs its own unique password.
Applying
Meanings
Term
password re-use
Meaning
Using one password on many accounts. If a data breach leaks it, attackers try it on other sites and can unlock every account that shares it.
Practice
password = "Sunny123"
Testing
Gaps
bankPass =
Check Answer
Spots
3breached = True
4if breached and a_pw != b_pw:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Jellyfish' badge — Flow Controller, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Mia uses the same password for her email, her game account and her school login. One site is hacked. What is the risk?
A. Attackers can try that password on her other accounts and unlock them too ✓
B. Only the hacked site is at risk because her other accounts are separate
When a password is re-used, one breach can put every account that shares it at risk.
2. Which statement about a data breach is correct?
A. Stolen passwords from a breach can only ever be used on the hacked site
B. Stolen passwords from a breach may be tried on other websites ✓
Attackers know people re-use passwords, so they test leaked passwords on other popular sites.
3. Which choice is the safer way to set up passwords?
A. A different password for every account ✓
B. One easy-to-remember password for every account
Using a different password for each account stops one breach from unlocking the others.
4. Ravi's password leaks from a small gaming site. He used the same password for his email. What is likely to happen next?
A. Attackers try the leaked password on his email and other sites ✓
B. Nothing, because email accounts can't be reached with a leaked password
Attackers try stolen passwords on other sites, and an email account is a common target.
5. Why is password re-use compared to a domino effect?
A. Each account is protected by the one before it in a line
B. One account falling can make the other accounts fall one after another ✓
Like dominoes, one broken account can knock over every other account that shares the password.

Match the Pairs

password re-use → Using the same password on many accounts, so one leaked password can unlock all of them
credential stuffing → Attackers trying passwords stolen in a data breach on other websites to see where else they work
A data breach on one site leaks a password that is also used on email and banking accounts, so all of them are at risk → shop_site.password = "cat123"; email.password = "cat123"; bank.password = "cat123"
Using a different password for each account stops one breach from unlocking the others → shop_site.password = "Blue!Tiger7"; email.password = "Quiet-Moon-Bike-42"; bank.password = "Red$Kite9Sun"
game.password = "Sunny2024"; email.password = "Sunny2024"; school.password = "Sunny2024" → The same password is used on every account, so one data breach lets attackers unlock the game, email and school accounts like a row of dominoes falling. Each account needs its own unique password.
if breach("gameSite"): change_password("gameSite") → Only the breached site's password is changed. If that password was re-used, attackers can still unlock other accounts, so every account sharing it must be changed too.

Key Term

password re-use
Using one password on many accounts. If a data breach leaks it, attackers try it on other sites and can unlock every account that shares it.

Fill in the Blanks

1. shopPass = "cat123" bankPass = shopPass
Hint: Type the variable name that copies the shop account's password, showing it being re-used on the bank account.
2. for site in otherSites: login(site, stolenPass)
Hint: Type the keyword that repeats the attacker's stolen-password attempt on every other site.
3. samePass = True if samePass: print("Every account is at risk")
Hint: Type the variable the condition checks to see whether one password is shared across accounts.
4. accounts = 5 reused = True unlocked = accounts if reused else 1
Hint: Type the variable holding how many accounts a breach unlocks when the password is re-used.
5. if shopPass == bankPass: print("Re-use risk!")
Hint: Type the comparison operator that checks whether two passwords are equal.

Spot the Error

Question 1
A a_pw = "dog2020"
B b_pw = a_pw
C breached = True
D if breached and a_pw != b_pw:
E print("b is at risk")
Line D — The check should use == to test whether both accounts share the same password. With !=, the warning only appears when the passwords are different, which hides the re-use risk.
Question 2
A sites = ["mail", "shop"]
B for site in sites:
C print("Try on" site)
Line C — A comma is missing between the two print arguments. It should be print("Try on", site) so the attacker tries the stolen password on every site.
Question 3
A accounts = "5"
B passwords = 1
C if passwords < accounts:
D print("Password re-used")
Line A — accounts should be the number 5, not the string "5". Comparing a number with a string causes an error. It should be accounts = 5.
Question 4
A leaked = "sun123"
B my_pw == "sun123"
C if leaked == my_pw:
D print("Change it now")
Line B — A single = is needed to store a value in the variable my_pw. Using == compares instead, so my_pw is never created. It should be my_pw = "sun123".
Question 5
A stolen_pw = "sun123"
B sites = ["mail", "shop"]
C for s of sites:
D print(s, "unlocked")
Line C — Python loops use the word in, not of. It should be for s in sites: so the stolen password is tried on each site in the list.

Student with a class code? Join your class →