Passwords and authentication best practices in Intro to Computing - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use a salt in password hashing?

Imagine you have a list of passwords hashed without any extra data. What is the main reason to add a salt to each password before hashing?

A To speed up the hashing process for faster login

B To make each hash unique even if two users have the same password

C To store the password in plain text for easy retrieval

D To reduce the size of the stored password hashes

💡 Hint

Think about what happens if two users choose the same password.

Adding a salt ensures that even if two users have the same password, their hashes look different. This prevents attackers from using precomputed tables to crack passwords.

❓ trace

intermediate

Trace the authentication flow with multi-factor authentication

Follow the steps in this flowchart for a login process using password and a one-time code sent to a phone. What is the output if the password is correct but the code is wrong?

Intro to Computing

Start -> Enter username and password -> Check password -> If correct, send code -> Enter code -> Check code -> If correct, login success; else, login fail

A Login success

B Password reset required

C Login fail

D Account locked immediately

💡 Hint

Both password and code must be correct to succeed.

Multi-factor authentication requires all factors to be correct. If the code is wrong, login fails even if the password is right.

❓ identification

advanced

Identify the weakest password policy

Which of the following password policies is the weakest in protecting user accounts?

A Allow passwords as short as 6 characters with only letters

B Enforce password expiration every 90 days

C Require passwords to be at least 12 characters with letters, numbers, and symbols

D Use a password blacklist to block common passwords

💡 Hint

Think about length and complexity requirements.

Short passwords with only letters are easier to guess or crack. Longer and complex passwords improve security.

❓ Comparison

advanced

Compare authentication methods for security

Which authentication method provides the strongest protection against stolen passwords?

A Two-factor authentication using password and hardware token

B Two-factor authentication using password and SMS code

C Single-factor authentication with a strong password

D Password-only authentication with frequent resets

💡 Hint

Consider the security of the second factor.

Hardware tokens are harder to intercept or steal compared to SMS codes, which can be intercepted or SIM-swapped.

🚀 Application

expert

Determine the output of a password hash verification process

Given this simplified Python code for verifying a password, what will be the output if the user enters 'password123' but the stored hash was created with 'Password123' (note the capital P)?

Intro to Computing

import hashlib

def hash_password(pw):
    return hashlib.sha256(pw.encode()).hexdigest()

stored_hash = hash_password('Password123')
user_input = 'password123'

if hash_password(user_input) == stored_hash:
    print('Access granted')
else:
    print('Access denied')

A Access granted

B Access granted only if password length matches

C Error: case mismatch in password

D Access denied

💡 Hint

Hashing is case sensitive. Check if 'Password123' and 'password123' produce the same hash.

The hash of 'Password123' is different from 'password123' because hashing is case sensitive. So the comparison fails and access is denied.

Practice

1. Which of the following is the best practice for creating a strong password?

easy

A. Use your username as the password

B. Use only your birthdate

C. Use a simple word like 'password'

D. Use a mix of letters, numbers, and symbols

Solution

1. Step 1: Understand password strength factors

   A strong password includes a mix of letters, numbers, and symbols to make it hard to guess.

2. Step 2: Evaluate each option

   The other options use easily guessable information like birthdates, simple words, or usernames, making them weak passwords.

3. Final Answer:

   Use a mix of letters, numbers, and symbols -> Option D

4. Quick Check:

   Strong password = mix of characters [OK]

Hint: Strong passwords mix letters, numbers, and symbols [OK]

Common Mistakes:

• Using only simple words or personal info
• Ignoring symbols and numbers
• Reusing the same password everywhere

2. Which of the following is the correct way to enable two-factor authentication (2FA)?

easy

A. Use only a password without any extra step

B. Enter a password and then a code sent to your phone

C. Use your password twice in a row

D. Share your password with a friend for backup

Solution

1. Step 1: Understand two-factor authentication

   2FA requires two steps: something you know (password) and something you have (code from phone).

2. Step 2: Check each option

   Only Enter a password and then a code sent to your phone describes entering a password plus a code sent to your phone, which is correct 2FA.

3. Final Answer:

   Enter a password and then a code sent to your phone -> Option B

4. Quick Check:

   2FA = password + code [OK]

Hint: 2FA means password plus a code from your device [OK]

Common Mistakes:

• Thinking 2FA is just repeating the password
• Sharing passwords with others
• Skipping the second authentication step

3. Consider this scenario: You create a password 'P@ssw0rd123' and enable 2FA. What is the main benefit of enabling 2FA?

medium

A. It adds an extra layer of security beyond the password

B. It allows password sharing safely

C. It makes the password shorter

D. It removes the need to remember the password

Solution

1. Step 1: Analyze the role of 2FA

   2FA adds a second step to verify identity, making unauthorized access harder.

2. Step 2: Evaluate options

   Only It adds an extra layer of security beyond the password correctly states that 2FA adds extra security beyond just the password.

3. Final Answer:

   It adds an extra layer of security beyond the password -> Option A

4. Quick Check:

   2FA = extra security layer [OK]

Hint: 2FA adds security beyond just the password [OK]

Common Mistakes:

• Thinking 2FA shortens passwords
• Believing 2FA allows safe password sharing
• Assuming 2FA removes password need

4. You wrote a password policy that requires users to create passwords with at least 8 characters, but you forgot to include numbers or symbols. What is the main issue with this policy?

medium

A. Users will be forced to use 2FA

B. Passwords will be too complex to remember

C. Passwords may be weak because they lack variety

D. Passwords will always be secure

Solution

1. Step 1: Understand password complexity

   Passwords need variety (letters, numbers, symbols) to be strong, not just length.

2. Step 2: Analyze the policy

   The policy only requires length, missing variety, so passwords may be weak.

3. Final Answer:

   Passwords may be weak because they lack variety -> Option C

4. Quick Check:

   Password strength = length + variety [OK]

Hint: Length alone doesn't ensure strong passwords [OK]

Common Mistakes:

• Assuming length alone makes passwords strong
• Forgetting to require symbols or numbers
• Confusing 2FA with password complexity

5. You manage a website login system. To improve security, you want to implement a policy that forces users to update their passwords every 90 days and use 2FA. Which of the following best explains why this combination is effective?

hard

A. Regular password changes reduce risk if passwords are stolen; 2FA adds a second verification step

B. Frequent password changes make users forget passwords; 2FA removes the need for passwords

C. Password updates and 2FA both replace the need for strong passwords

D. This policy allows users to share passwords safely with 2FA

Solution

1. Step 1: Understand password update benefits

   Changing passwords regularly limits the time stolen passwords can be used.

2. Step 2: Understand 2FA benefits

   2FA adds a second verification step, making unauthorized access harder even if password is known.

3. Step 3: Combine both concepts

   Together, they reduce risk from stolen passwords and add extra security layers.

4. Final Answer:

   Regular password changes reduce risk if passwords are stolen; 2FA adds a second verification step -> Option A

5. Quick Check:

   Password updates + 2FA = stronger security [OK]

Hint: Update passwords often and use 2FA for best security [OK]

Common Mistakes:

• Thinking 2FA removes need for passwords
• Believing frequent changes cause security issues
• Assuming password sharing is safe with 2FA