Risks of password re-use

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Mia uses the same password for her email, her game account and her school login. One site is hacked. What is the risk?

A Attackers can try that password on her other accounts and unlock them too

B Only the hacked site is at risk because her other accounts are separate

2. Which statement about a data breach is correct?

A Stolen passwords from a breach can only ever be used on the hacked site

B Stolen passwords from a breach may be tried on other websites

3. Which choice is the safer way to set up passwords?

A A different password for every account

B One easy-to-remember password for every account

4. Ravi's password leaks from a small gaming site. He used the same password for his email. What is likely to happen next?

A Attackers try the leaked password on his email and other sites

B Nothing, because email accounts can't be reached with a leaked password

5. Why is password re-use compared to a domino effect?

A Each account is protected by the one before it in a line

B One account falling can make the other accounts fall one after another

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1password re-use		AThe same password is used on every account, so one data breach lets attackers unlock the game, email and school accounts like a row of dominoes falling. Each account needs its own unique password.
2credential stuffing		Bshop_site.password = "Blue!Tiger7"; email.password = "Quiet-Moon-Bike-42"; bank.password = "Red$Kite9Sun"
3A data breach on one site leaks a password that is also used on email and banking accounts, so all of them are at risk		CUsing the same password on many accounts, so one leaked password can unlock all of them
4Using a different password for each account stops one breach from unlocking the others		Dshop_site.password = "cat123"; email.password = "cat123"; bank.password = "cat123"
5game.password = "Sunny2024"; email.password = "Sunny2024"; school.password = "Sunny2024"		EAttackers trying passwords stolen in a data breach on other websites to see where else they work
6if breach("gameSite"): change_password("gameSite")		FOnly the breached site's password is changed. If that password was re-used, attackers can still unlock other accounts, so every account sharing it must be changed too.

Definitions

password re-use

Fill in the Blanks

Complete each line of code by filling in the missing parts.

shopPass = "cat123" bankPass = ________

___ site in otherSites: login(site, stolenPass)

samePass = True if ________: print("Every account is at risk")

accounts = 5 reused = True unlocked = ________ if reused else 1

if shopPass __ bankPass: print("Re-use risk!")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A a_pw = "dog2020"

B b_pw = a_pw

C breached = True

D if breached and a_pw != b_pw:

E print("b is at risk")

Question 2

A sites = ["mail", "shop"]

B for site in sites:

C print("Try on" site)

Question 3

A accounts = "5"

B passwords = 1

C if passwords < accounts:

D print("Password re-used")

Question 4

A leaked = "sun123"

B my_pw == "sun123"

C if leaked == my_pw:

D print("Change it now")

Question 5

A stolen_pw = "sun123"

B sites = ["mail", "shop"]

C for s of sites:

D print(s, "unlocked")

Answer Key

Risks of password re-use

Section A: Quick Questions

A — Attackers can try that password on her other accounts and unlock them too

B — Stolen passwords from a breach may be tried on other websites

A — A different password for every account

A — Attackers try the leaked password on his email and other sites

B — One account falling can make the other accounts fall one after another

Section B: Match the Pairs

password re-use → Using the same password on many accounts, so one leaked password can unlock all of them

credential stuffing → Attackers trying passwords stolen in a data breach on other websites to see where else they work

A data breach on one site leaks a password that is also used on email and banking accounts, so all of them are at risk → shop_site.password = "cat123"; email.password = "cat123"; bank.password = "cat123"

Using a different password for each account stops one breach from unlocking the others → shop_site.password = "Blue!Tiger7"; email.password = "Quiet-Moon-Bike-42"; bank.password = "Red$Kite9Sun"

game.password = "Sunny2024"; email.password = "Sunny2024"; school.password = "Sunny2024" → The same password is used on every account, so one data breach lets attackers unlock the game, email and school accounts like a row of dominoes falling. Each account needs its own unique password.

if breach("gameSite"): change_password("gameSite") → Only the breached site's password is changed. If that password was re-used, attackers can still unlock other accounts, so every account sharing it must be changed too.

Section C: Definitions

password re-use — Using one password on many accounts. If a data breach leaks it, attackers try it on other sites and can unlock every account that shares it.

Section D: Fill in the Blanks

shopPass = "cat123"
bankPass = shopPass

for site in otherSites:
    login(site, stolenPass)

samePass = True
if samePass:
    print("Every account is at risk")

accounts = 5
reused = True
unlocked = accounts if reused else 1

if shopPass == bankPass:
    print("Re-use risk!")

Section E: Spot the Error

D — The check should use == to test whether both accounts share the same password. With !=, the warning only appears when the passwords are different, which hides the re-use risk.

C — A comma is missing between the two print arguments. It should be print("Try on", site) so the attacker tries the stolen password on every site.

A — accounts should be the number 5, not the string "5". Comparing a number with a string causes an error. It should be accounts = 5.

B — A single = is needed to store a value in the variable my_pw. Using == compares instead, so my_pw is never created. It should be my_pw = "sun123".

C — Python loops use the word in, not of. It should be for s in sites: so the stolen password is tried on each site in the list.