Technologies K–10 · Years 9–10
A threat model for a school login: online and offline guessing
Computing Technology 7–10 (NSW, 2022); Digital Technologies: Processes and production skills, Privacy and security (ACARA v9)
This site has no interactive model of its own. Where a step or a material names a Concept Studio model, simulation or tool, it has not been built; an external simulation a step names (for example PhET) is not part of this site.
The idea
A threat model lists what an attacker could do and how long it would take, and the numbers show that guessing through the login page is slowed by lockouts while guessing against a stolen hash file is limited only by the password's size.
What you need
- Spreadsheet software
- Australian Cyber Security Centre guidance on passphrases and multi-factor authentication
- The hash timing measured in the password hashing activity (optional)
How to do it
- List the assets (accounts, marks, personal data), the likely attackers and the ways in (login page, stolen hash file, phishing, reused passwords).
- Work out the number of possibilities for 5 password rules: 8 lowercase letters, 8 letters and digits (62 symbols), 12 characters from all 95 printable symbols, 4 dice words, 5 dice words.
- Online attack: with a lockout of 5 tries per 15 minutes, work out the tries per day and the time to try every 8-lowercase password.
- Offline attack: with an assumed 10 billion guesses per second against a fast unsalted hash, work out the time for each rule.
- Rank the threats and choose controls for each: lockout, multi-factor authentication, salted slow hashing, unique passphrases.
- Present the threat model as a table with the numbers as evidence.
What you should see
A lockout of 5 tries per 15 minutes allows 480 tries a day, so trying every 8-lowercase password online takes about 1.19 million years. Offline at the assumed 10 billion guesses per second the same rule falls in 20.9 s; 8 letters and digits in 6.1 h; 4 dice words in 4.2 days; 5 dice words in about 90.1 years; 12 printable characters in about 1.71 million years. The main risks are therefore a stolen hash file, phishing and reused passwords, not guessing at the login page, which points to salted slow hashes, multi-factor authentication and unique passphrases as the controls. The learner knows it worked when their spreadsheet reproduces these times from the same assumptions.
What changes
This activity lists no variables to change, measure and keep the same.
Common misconceptions
Each of these ideas is wrong, and the activity is a chance to test it.
- Complex rules like one capital and one symbol make passwords strong (length adds far more possibilities).
- If the login page locks out guessers, weak passwords are safe (a stolen hash file is guessed offline).
- Attackers guess passwords one letter at a time (they try whole candidates, starting with common ones).
Safety card
Hazards
- Attempting attacks on real systems
Controls
- Calculations only; no tool is run against any real account or system
Note
No chemicals or heat.
Curriculum references
The NSW syllabus outcomes and Australian Curriculum v9 codes this activity supports. They are references, not a verified or complete curriculum alignment.
- Computing Technology 7–10 Syllabus (2022), NESA. Current elective syllabus. Code read from the outcomes page on 2026-09-22.CT5-SAF-01CT5-THI-01
- Australian Curriculum v9AC9TDI10P13
Sources
The pages the author read to write this activity.