Technologies K–10 · Years 7–8

Why a second factor helps: guessing a six-digit code

Digital and Communication Technologies focus area (NSW Technology 7–8, 2023); Digital Technologies: Processes and production skills, Privacy and security (ACARA v9)

Practical, model not builtLow risk

This site has no interactive model of its own. Where a step or a material names a Concept Studio model, simulation or tool, it has not been built; an external simulation a step names (for example PhET) is not part of this site.

The idea

Multi-factor authentication asks for something you have as well as something you know, so a leaked password alone does not open the account: an attacker also needs a six-digit code that changes every 30 seconds.

What you need

Teacher demonstration account with a school-approved authenticator app, shown on a projector
5 printed example emails, some of them phishing, prepared from the Australian Cyber Security Centre guidance
Calculator

How to do it

Watch the authenticator code change every 30 seconds on the projector.
Work out how many six-digit codes there are and the chance of guessing one code in one try.
Work out the chance with 5 tries before the account locks.
Discuss: the password is leaked in a data breach. What stops the attacker now?
Examine the 5 emails and mark signs of phishing: urgency, a sender address that does not match, links to a lookalike address, requests for codes or passwords.
Explain how a phishing page could trick someone into typing both the password and the code, and how checking the web address prevents it.

What you should see

There are 1,000,000 six-digit codes (000000 to 999999), so one guess succeeds with probability 1 in 1,000,000; 5 guesses give 5 in 1,000,000 (0.0005%), and a new code replaces it every 30 seconds. With MFA on, a leaked password alone does not open the account. Authenticator apps use time-based one-time passwords (RFC 6238, which recommends a 30-second time step), and the Australian Cyber Security Centre lists authenticator apps among its multi-factor options. The learner knows it worked when they compute these odds and correctly identify the phishing emails with at least two signs each.

What changes

This activity lists no variables to change, measure and keep the same.

Common misconceptions

Each of these ideas is wrong, and the activity is a chance to test it.

MFA makes a weak password safe (it adds a layer; a strong password still matters).
Phishing only steals passwords (it can also steal one-time codes typed into a fake page).
Six digits are easy to guess by trying (there are a million possibilities and only seconds to try them).

Safety card

Low riskLearners carry it out

Hazards

Exposure of real account details

Controls

Only the teacher's demonstration account is used; no learner signs in to real accounts

Note

No chemicals or heat.

Curriculum references

The NSW syllabus outcomes and Australian Curriculum v9 codes this activity supports. They are references, not a verified or complete curriculum alignment.

Technology 7–8 Syllabus (2023), NESA. Current: taught from 2026. Code read from the outcomes page on 2026-09-22.TE4-DIG-01
Australian Curriculum v9AC9TDI8P13

Sources

The pages the author read to write this activity.

All Concept Studio activities