What your child will learn
Explain what a password manager is and why one master password + per-site generated credentials beats reuse — a single master phrase unlocks a vault that holds a unique ≥20-character random password for every site, so a breach at one site cannot cascade to others
Generate a strong master password and store a mock entry safely — passphrase style (≥4 random words + 1 number + 1 symbol, ≥16 chars total), with the recovery code written on paper in a sealed envelope at home
Enable TOTP authenticator on a mock account by scanning a QR code and confirming the 6-digit code entry — TOTP rotates every 30 seconds, never leaves the device, and is resistant to SMS-OTP-style SIM-swap and AiTM-proxy interception
Register a WebAuthn-style passkey in a mocked ceremony and explain how it replaces passwords — the passkey is bound to the originating origin and the device's secure element, so a phishing site on a different origin cannot replay a stolen passkey response
Breach response: run a quarterly haveibeenpwned-style lookup, rotate any exposed credential immediately, revoke all active sessions on the affected account, audit other accounts for credential reuse, then re-test monthly
Credential stuffing attack recognition and defense — credential stuffing reuses breached email/password pairs at scale across unrelated sites, so unique per-site generated credentials make the attack economically fail
Tradeoffs: passkey vs. SMS OTP — passkey is bound to origin + secure element (phishing-resistant by design), SMS OTP is phishable via SIM-swap and AiTM proxies; the residual risk in passkey is the recovery-code handoff, so store it offline in a sealed envelope
How this mission works
You are setting up authentication for a fictional personal digital life across four real-world tiers. Tier 1 — Password Manager: install a vault app, generate one strong master password (passphrase style, ≥16 chars), and store a mock entry for an email account. Tier 2 — TOTP Authenticator: install an authenticator app, scan a mock QR enroll code, then enter the 6-digit TOTP to confirm the account is enrolled. Tier 3 — WebAuthn Passkey: register a passkey for the same account in the mock ceremony, and learn why a passkey is bound to the originating site and the device's secure element so a phishing proxy cannot reuse it. Tier 4 — Breach Response: run a quarterly haveibeenpwned-style lookup, rotate any exposed credentials, revoke active sessions, audit for credential reuse, then re-test monthly. Across all four tiers, the layered rule is the same — manager + TOTP + passkey + a breach-scan habit beats any single control alone. Includes printable "My Auth Setup" one-pager you take home. Pass 5 of 6 to earn the 🔐 Password Vault Pro badge and 200 XP. Designed for Grades 9 through 12 — server-graded 6-question quiz, advanced reading level, no client-side scene rendering.
What students actually encounter
You use the same password on three different sites because it is easier to remember. Why is this a non-negotiable failure once one of those sites has a credential-stuffing breach? — Credential stuffing reuses breached email/password pairs at scale across unrelated sites.
A site offers both SMS OTP and an authenticator-app TOTP as the second factor. Why is SMS OTP considered a phishing-prone fallback compared to TOTP? — SMS OTP can be intercepted via SIM-swap, SS7 attacks, and AiTM proxies; TOTP codes never leave the device.
A site now offers WebAuthn passkeys. What does a passkey actually buy you that SMS OTP does NOT, and what is the residual risk? — Passkey is bound to origin + secure element (phishing-resistant); the residual risk is the recovery-code handoff, store it offline.
Cipher is with them the whole way
When a student gets stuck on Password Vault Pro: Managers, MFA & Passkeys, Cipher appears with a mission-specific nudge — no spoilers, just a hint toward the right thinking. Make a wrong choice, and Cipher explains the real-world consequence. Finish the mission, and Cipher generates a personalized performance debrief based on exactly how the student played it.
ISTE alignment
Advanced learners (Grades 9–12) build a four-pillar authentication stack: (1) a password manager with one strong passphrase-style master password and unique per-site generated credentials, (2) TOTP authenticator enrolled on the high-value accounts (email, bank, password manager, socials), (3) a WebAuthn passkey registered as a phishing-resistant alternative to SMS OTP, and (4) a quarterly breach-response habit that pairs the haveibeenpwned lookup pattern with credential rotation, session revocation, and credential-reuse audits. The curriculum also covers shared family-vault hygiene rules — what belongs in a shared vault (home Wi-Fi, streaming subscriptions, shared utilities) versus what stays personal (primary email, school accounts, friend-only chat accounts). Aligned to NIST NICE Cybersecurity Awareness (personal security hygiene practices: password management and MFA), CISA K-12 Digital Identity (MFA + credential stuffing / SIM-swap / account takeover tactics), and ISTE Digital Citizen (positive, safe, legal, and ethical digital behaviors; understand cyber threats, risks, and vulnerabilities to individuals).