S1 ICT | Digital Literacy and Online Safety: Tutor Lesson-Prep Guide (Password Maths, Domain Checks, 3-2-1 Backup)

2026-11-11

Tutor lesson-prep guides · Secondary ICT

Every student can say “use a strong password”, but ask how many four-digit PINs exist and most cannot answer. Without that number they cannot explain why length matters more than symbols. This lesson turns safety into arithmetic.

Objectives — Students can: (1) calculate that one digit gives ten possibilities, a four-digit PIN gives 10,000 combinations and eight lowercase letters give 26 to the power of 8 (about 2.09 x 10^11), and explain that length changes the scale far more than the character set; (2) pick out the registered domain in a URL and state that hkbank-secure.com and hkbank.com are two different domains; (3) describe a concrete backup plan using 3-2-1 (three copies, two media, one off-site) and name the risk of keeping a single copy.

01 Prerequisites (3-minute check)

If any of these fails, fix it before the lesson starts.

Skill	Quick check	Pass mark
Powers	What is 10 to the power of 4?	10,000, the number of four-digit PINs
Alphabet size	How many lowercase letters are there?	26
URL structure	In www.example.com, which part is the registered domain?	example.com; www is only a host name

02 Lesson flow (45 minutes)

Time	Stage	Tutor does	Student does
0-5 min	Estimate first	Ask how many four-digit PINs and how many eight-letter passwords exist; students write an estimate	Most badly underestimate letter passwords
5-14 min	Password space	Build 10, 10 squared, 10 to the 4th, then 26 to the 8th, and write both answers side by side	Compute 10,000 and about 2.09 x 10^11
14-24 min	Domains and phishing	Split three URLs, circle the registered domain, show that the padlock only means encryption	Circle the right domain and justify it
24-32 min	3-2-1 backup	Use the students own photos to write three copies, two media, one off-site	Write one concrete plan
32-40 min	Four question types	One each on combinations, URL checks, scenario judgement and backup planning	All four answered with steps
40-45 min	Exit check	Collect three answers and mark right, half-right or wrong on the spot	Hand in three answers

03 Teaching script (read it out)

Scene 1: Act 1: safety is a number you can divide

“A four-digit PIN: each digit has ten possibilities, so four digits give 10 times 10 times 10 times 10, which is 10,000. A machine trying a thousand guesses a second finishes in ten minutes. Eight lowercase letters give 26 to the power of 8, which is 208,827,064,576, about 2.09 times 10 to the 11th. The same machine would need billions of seconds, thousands of years. The real gap is not the special character, it is length: adding one character multiplies the count, and going from eight letters to nine multiplies it by 26.”

10^4 = 10,000; 26^8 is about 2.09 x 10^11; length sets the scale.

Scene 2: Act 2: the padlock proves encryption, not honesty

“A padlock means the traffic is encrypted in transit. It does not mean the person at the other end is honest, because criminals can buy certificates too. To judge a site, read the domain from the right: the name immediately before .com is the registered domain. In hkbank-secure.com the registered domain is hkbank-secure.com, not hkbank.com. Anyone can register the first one. Three checks: read the domain, notice whether it rushes you, and ask who sent the link.”

Read the last two labels; urgency plus a link is the warning sign.

Scene 3: Act 3: backup is not done until there are three copies

“3-2-1 means three copies, two different kinds of media, one copy somewhere else. Why three? One on the computer, one on an external drive, one in the cloud: any single failure still leaves two. Why two media? Drives from the same batch can fail together. Why off-site? Fire, flood or theft can take two copies from one room. In an exam answer name the objects: photos on the laptop, copied monthly to an external drive, synced to cloud storage. Saying only that you do backups scores nothing.”

Three copies, two media, one off-site; name the risk of each missing item.

04 Question types and worked steps

Type	Example	Steps	Answer
Combination count	How many combinations does a four-digit PIN have and how many does an eight-letter lowercase password have? Compare the orders of magnitude.	(1) Count possibilities per position (2) raise to the number of positions (3) write the actual numbers (4) state the power of ten	10,000 and 208,827,064,576; about 2.09 x 10^7 times more, more than seven orders of magnitude
URL check	A link reads https://hkbank.com.login-secure.top/verify. Identify the registered domain and judge the risk.	(1) Read from the right (2) take the last two labels (3) compare with the official domain (4) conclude with a reason	The registered domain is login-secure.top; hkbank.com is only a subdomain prefix, so it is phishing; HTTPS is irrelevant to trust
Scenario judgement	A student logs into the school system on public Wi-Fi and reuses the same password on a forum. Name two risks.	(1) Interception on an open network (2) the chain risk of password reuse (3) one fix for each	Open networks can be intercepted; a forum breach opens the school account; use unique passwords and two-factor authentication
Backup plan	Write a 3-2-1 plan for graduation photos and state the consequence of keeping only the phone copy.	(1) List three copies (2) label two media (3) label the off-site one (4) describe the single-copy failure	Phone, external drive, cloud; one copy means a lost or broken phone destroys everything

Sanity check (teach this): Sanity check: four digits give 10,000, not 1,000; 26 to the 8th is about 2.09 x 10^11, so 26 times 8 (208) means multiplication instead of powers; a thousand guesses a second on 10,000 PINs takes ten minutes, not one second; in 3-2-1 the three numbers are conditions, not a total. Any combination count must exceed the size of the character set, otherwise the power is wrong.

05 Independent practice (3 questions)

Question	Answer	What to watch
How many six-digit PINs exist, and how long does a thousand guesses a second take?	1,000,000; about 1,000 seconds worst case, roughly 16.7 minutes	Use powers of ten rather than brute multiplication
What is the registered domain of https://www.hk01.com.secure-login.xyz/?	secure-login.xyz, a suspicious domain	Read the last two labels, not the beginning
Write your own 3-2-1 plan and mark the off-site copy.	Laptop, external drive and cloud, with the cloud copy off-site	All three conditions present and the off-site one named

06 Common mistakes and what to say

Mistake	Student writes	Say this
Believing symbols beat length	“Adding an exclamation mark makes the password much safer.”	“One extra symbol moves the character set from 26 to 33, roughly 1.27 times more. One extra character multiplies by 26. Length first, symbols second.”
Reading a URL from the left	“It starts with hkbank, so it is the bank.”	“Read the last two labels. Anything before them is a subdomain that anyone can create.”
Treating HTTPS as trust	“It has a padlock so it cannot be fake.”	“A padlock only means encryption, and criminals can get certificates. Judge by domain, source and pressure tactics.”
Saying backup is done	“I have a backup.”	“A backup answer needs count, media and location: three copies, two media, one off-site. If one is missing, name the risk.”

07 Homework (paper, section and question numbers)

Chapter practice: compute four-digit and six-digit PIN counts and convert them into cracking time — Digital literacy chapter, practice question 1
Chapter practice: circle the registered domain in five URLs and mark the phishing one — Digital literacy chapter, practice question 2
Extension: write a 3-2-1 backup list for your own accounts and mark the off-site copy — Digital literacy chapter, practice question 3 table

08 Exit check (last 5 minutes)

Question	Answer	Decision
How many combinations do eight lowercase letters give, in order of magnitude?	About 2.09 x 10^11 (26 to the 8th)	Wrong means reteach Act 1 next lesson
What does the HTTPS padlock mean and what does it not mean?	Traffic is encrypted; the site is not necessarily trustworthy	Wrong means reteach Act 2
What do the three numbers in 3-2-1 stand for?	Three copies, two media, one off-site	Wrong means reteach Act 3

09 Tutor FAQ

Is powers too advanced for S1?

Only 10 to a power and 26 to a power, derived by repeated multiplication; no index laws are needed.

Should password managers be taught?

One sentence is enough: one master password plus a tool that remembers the rest. The exam focus stays on length and reuse.

Should phishing and viruses be taught together?

Separate them: phishing persuades you to hand over data, malware damages or hides. Cover phishing here and leave malware to the systems unit.

Find a tutor — free Tutor Registration →

A TutorZone lesson-prep guide. Written by the TutorZone team; questions and lesson flow are original and are not taken from any school or publisher material.