Guided path · 3 lessons · about 15–20 minutes
Everyday account security
Separate connection security, sign-in checks, and permission to act.
No setup needed. These are simplified teaching models; the full explanations describe their limits.
Lesson 1 of 3 · HTTPS
Does a padlock mean I can trust a site?
A protected connection and an honest destination are different questions.
A lookalike shop uses HTTPS. Does the protected connection establish that it is the shop you intended?
Make a prediction in your head, then use the experiment to test it.
Try the model
Keep HTTPS on, then swap the intended destination for a lookalike.
Learn by changing one thing
A protected connection to which website?
Choose a connection and a destination. The two answers tell you different things.
All names are fictional reserved examples. HTTPS protects transport; it does not certify business honesty. This does not test a real certificate or website. Inputs stay on this page; no account, file, or network is changed.
Check your understanding
A lookalike shop uses HTTPS. Does the protected connection establish that it is the shop you intended?
Loading the understanding check… If it does not appear, read the full explanation below.
The idea to keep: Protecting transport does not prove a business is trustworthy.
Go deeper & discuss this idea
Lesson 2 of 3 · MFA
What if somebody knows my password?
An independent second check can block a password-only attempt.
A visitor knows the correct password but has no valid independent second factor. Your pretend account requires both. What happens?
Make a prediction in your head, then use the experiment to test it.
Try the model
Give a pretend visitor a password, with and without the second factor.
Learn by changing one thing
Would a stolen password be enough?
Pretend somebody knows the password. Can they also satisfy the extra check?
This models two checks, not a login service. Real MFA can be attacked, and recovery or stolen sessions can bypass the picture. No codes or credentials are requested. Inputs stay on this page; no account, file, or network is changed.
Check your understanding
A visitor knows the correct password but has no valid independent second factor. Your pretend account requires both. What happens?
Loading the understanding check… If it does not appear, read the full explanation below.
The idea to keep: An extra check helps, but recovery, phishing, and stolen sessions still matter.
Go deeper & discuss this idea
Lesson 3 of 3 · Permissions
Why can I read this but not edit it?
Signing in identifies you; permission decides which action you can take.
Someone needs to fix a note but must not manage access. Which role fits the notebook model?
Make a prediction in your head, then use the experiment to test it.
Try the model
Try the same notebook action as a reader, editor, and administrator.
Learn by changing one thing
Same notebook. Different permissions.
A fictional team shares a notebook. Choose a role and ask the system to do one action.
An invented permission scheme: reader = read; editor = read and edit; administrator = all three. Real products use different roles and must enforce permissions on their servers. Inputs stay on this page; no account, file, or network is changed.
Check your understanding
Someone needs to fix a note but must not manage access. Which role fits the notebook model?
Loading the understanding check… If it does not appear, read the full explanation below.
The idea to keep: Choose the smallest role that actually permits the task.
Go deeper & discuss this idea
A good place to pause
You have explored everyday account security.
You answered all three understanding checks. Now explain one idea to someone else, or revisit the experiments with a different prediction.
A personal learning record, not a certification or independent assessment.