# Facilitator guide: Is my account safe?

40 minutes · Anyone who signs in to work, school or personal accounts.

**Goal:** Learners tell apart three different questions: Is this the right site? Is it really you? What are you allowed to do?

## Lessons used

- What does HTTPS protect? A padlock is not a trust guarantee: https://noobquestions.com/https-explained-a-padlock-is-not-a-trust-guarantee/
- Why does MFA help when a password is stolen?: https://noobquestions.com/why-mfa-helps-when-a-password-is-stolen/
- Read, edit, or admin? Permissions explained with a shared notebook: https://noobquestions.com/read-edit-admin-permissions-explained/

## Before you start

- Open the MFA and permissions lessons. Both run in the browser with pretend accounts.
- Remind the group: never type a real password, code or account name during the session.
- Print one worksheet per learner, or share the download.

## Run of show

- **0–5 min · Warm-up:** Ask: “If someone learned your password today, what could stop them?” Learners write a guess (question 1).
- **5–12 min · Right site?:** Recap the lookalike example from the HTTPS lesson in two minutes: check the address before you sign in.
- **12–24 min · Give away the password:** In the MFA lesson, give the pretend visitor the correct password. Predict whether they get in, then try it. Discuss independent factors and account recovery.
- **24–35 min · Pick a role:** In the permissions lesson, choose a role and try actions on the pretend notebook. Ask: which is the smallest role that still lets this person do their job?
- **35–40 min · Explain it back:** Learners write the difference between signing in and being allowed to act (question 7).

## Answer guidance

1. **Before the lesson: if someone learned your password, what could stop them?**
   Any answer is fine. Come back to it after question 2.

2. **In the MFA model, the visitor has the correct password. Can they sign in with the password alone? Why?**
   No, not while the account rule requires a second check. The password is one piece of evidence, and the visitor lacks the independent second factor. (Switch the rule to password-only and the same password becomes enough. The rule changed, not the password.)

3. **A service asks for a password and then a memorised PIN. Is that necessarily multi-factor authentication? Explain.**
   Not necessarily. A password and a PIN are both something you know, so one kind of theft or phishing can capture both. MFA relies on independent kinds of evidence.

4. **Name two kinds of factor that are not something you know.**
   Something you have (for example a phone app or a security key) and something you are (for example a fingerprint). Accept any accurate example.

5. **Why should you set up account recovery before you need it?**
   If you lose a phone or key, recovery is how you get back in. A weak recovery path can also become the easiest way in for someone else, so set it up deliberately.

6. **Jamie only needs to read the notes. Which role fits, and why not a bigger one?**
   Reader. Least privilege means giving only the access a task needs. Editor or Administrator rights would let a mistake or a misuse do more damage.

7. **Exit question: what is the difference between signing in and being allowed to do something?**
   Signing in (authentication) checks who you are. Permission (authorisation) decides what you may do, and it should be checked on every action. Hiding a button is not enough.

## Common misconceptions

- “MFA makes an account unhackable.” It raises the bar. Phishing and weak recovery still matter.
- “Two passwords is two-factor.” Both are something you know.
- “Signed in means allowed.” Authentication and authorisation are separate checks.

## Sources to check

- OWASP Multifactor Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html
- OWASP Authorization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html
- Mozilla: What HTTPS does and does not protect: https://blog.mozilla.org/en/firefox/https-protect/

## Notes

- The lessons are simplified teaching models. Check the sources before changing a real system.
- Don’t collect learner data you don’t need. Never ask anyone to enter a real password, code or workplace detail.
- These plans haven’t been evaluated in a classroom.
- No reuse licence has been set. Please ask before republishing or redistributing.