# Accounts and secrets Passwords, two factor, phishing and the keys in your code. The minimum needed to not lose your work and your internship. Multimedia & Creative Technology · 0.0 General · Self-study · version 1.0.1 · 2026-09-30 Tags: security Slides: Speaker notes: ## Agenda 1. What is at stake: Four years of work on one key 2. Passwords: Length, vault, reuse 3. Second step: 2FA and passkeys 4. Phishing: Spotting it and what comes after 5. Secrets in code: env, git and API keys 6. The rest: Device, wifi, updates ## Self-study: How to work through this *30 minutes, On your own* Count on half an hour. At the end there is a job you do the same evening, otherwise it never happens. 1. The password lab and the phishing drill sit in the middle 2. Keep your phone at hand for the part about 2FA 3. Finish with a vault, 2FA on three accounts and a checked repo ## 1. What is at stake *Not your bank account, but your work, your internship and your name.* **One key on four years of work.** Your school account is attached to your mail, your Drive, your submissions and soon to the systems of the company you intern at. One password keeps all of that shut. ### How it usually goes wrong - A site where you made an account in 2019 leaks its database - Your mail address and password sit in a list that circulates freely - Somebody tries that combination on a hundred other services - On the three where you reused the password, it works - You only notice when mail starts going out in your name > **Credential stuffing** > > Nobody tries to guess your password. They try a password already known to be yours, somewhere else. ### Is your address in there already *Have I Been Pwned collects the leaks that circulate publicly and tells you which ones hold your address.* - **[haveibeenpwned.com](https://haveibeenpwned.com)**: Type your mail address and see which leaks it showed up in. Most people find three to ten. - **What you do then**: Change the password of that service, and of every other one where you used the same. That last part is usually the real work. > [!NOTE] > The site does not keep your address and shows no passwords. If you want certainty, use the same feature inside your password manager. ## 2. Passwords *Length beats weirdness, and reuse always loses.* ### How cracking really works *Nobody types guesses into a login screen. A leak hands over a list of hashed passwords, and that goes through a machine.* 1. **The lists first**: Every password that ever appeared in a leak, plus every word in a dictionary. Billions of tries, and they take seconds. 2. **Then the variants**: Capital in front, digit at the end, an a that became an @. Exactly the tricks everybody uses sit at the top of the list. 3. **Only then guessing**: Walking every combination. Here length counts, and only length. > [!WARNING] > `P@ssw0rd!` feels strong and sits in every list. `yellow-bike-table-tap` looks simple and holds for centuries. ### Password lab *Four words in a row hold longer than eight characters with an exclamation mark.* - `Kdg2026!`: Guessing takes no time - `password`: Guessing takes no time - `P@ssw0rd!`: Guessing takes no time - `Fluffy2024`: Guessing takes 1 years - `yellow-bike-table-tap`: Guessing takes longer than the earth exists - `x7Qz$4mK9pLw`: Guessing takes longer than the earth exists ### What helps and what does not *The rules from ten years ago mainly produced awkward passwords.* #### Works - Length: every extra character multiplies the work - Four or five random words in a row - A generator that picks completely at random - Something different for every service #### Does not work - A capital in front and a digit at the end - Replacing a with @ and o with 0 - The same password every three months with another number - Your birth year, your pet, your football club ### A vault is the only workable approach *Nobody remembers fifty unique passwords. Everybody can remember one strong one.* - **[Bitwarden](https://bitwarden.com)**: Free, open source, works on all your devices and in every browser. The default choice when you have nothing yet. - **[1Password](https://1password.com)**: Paid, very polished, with shared vaults for group work and later for your team. - **Your browser or iCloud**: Better than nothing, and decent these days. Less handy once you jump between systems. - **Your head**: For exactly two passwords: your vault and your laptop. You do not know the rest by heart, and that is the point. ### Setting up a vault - Pick one and install the app plus the browser extension - Make one long master password of four or five words and learn it by heart - Turn on 2FA for the vault itself and keep the recovery codes on paper - Let it import the passwords already in your browser - Replace the reused passwords over the coming weeks, most important first > [!WARNING] > **The master password** > > That one password cannot be reset for you. Forget it and your vault is gone. Write it down and keep it somewhere safe at home. ### Which of the four is the biggest mistake? - A. The same password on several services - B. A password of ten characters - C. Keeping your password in your vault - D. A password you do not know by heart **Answer:** A. The same password on several services Reuse turns one leak at a random webshop into a problem on your mail, your GitHub and your school. The other three are fine, or exactly the intention. ## 3. Second step *A leaked password stays worthless to the thief as long as a second step is in the way.* ### The kinds, from weak to strong *Anything beats nothing, but there is a lot of difference in between.* | Kind | How | Weak spot | | --- | --- | --- | | Sms code | A code per message | Getting a sim card transferred is easier than you think | | Authenticator app | Six digits that change every 30 seconds | You can still type it into a fake site | | Push notification | Confirm on your phone | You tap yes while thinking about something else | | Passkey or security key | Fingerprint or usb key | Almost nothing, but you need your device | > [!TIP] > A passkey is tied to the domain, so it only works on the real site. That is why it stops phishing where a code does not. ### Recovery codes *The little list you get while setting it up, and that everybody clicks away.* - Ten codes that each work once instead of your second step - You need them when your phone breaks, gets stolen or gets wiped - Keep them in your vault, or print them and put them with your papers at home - Not in a screenshot on that same phone, that is not a backup > [!WARNING] > Without recovery codes and without your device, some services have no road back to your account at all. Not even through support. ### Where you switch it on for sure *Five accounts the rest hangs off.* - **Your mail**: Whoever holds your mailbox resets every other account you have. - **Your school account**: Your submissions, your Drive, your mail to lecturers. - **GitHub**: Your code, your history, and soon the repos of your internship. - **Your vault**: The keyring itself. Here 2FA is not a luxury. - **Payments and cloud**: Anything with a card or a subscription attached. - **Discord and socials**: A stolen account sends scams to your whole class, in your name. ## 4. Phishing *The attack that does not crack your system, it just makes you hesitate.* ### What you look at *Four things, in this order, and it takes you ten seconds.* 1. **The domain**: Not the sender name, but what sits before the first slash and after the last dot. kdg.be.login-portal.com is not kdg.be. 2. **The urgency**: Within 24 hours or your account gets blocked. Real services do not do time pressure. 3. **The ask**: Sign in, pay, hand over a code, open an attachment. Always something you have to do. 4. **The context**: Were you expecting this? An invoice from a service you do not use is not an invoice. ### Phishing drill *Six messages the way they arrive. One question each: go along or not.* **1. A mail from "KdG ICT" asking you to confirm your password, linking to kdg-be-login.net.** - Sign in through the link - **Delete it and report it** ✓ - Reply first and ask whether it is real The domain is not kdg.be but kdg-be-login.net. A school never asks you to confirm your password by mail. Report it and bin it. **2. A text message: "Your parcel could not be delivered, pay 1.95 euro in shipping."** - Pay, it is only two euro - **Ignore and delete** ✓ - Open the link to have a look This is the most sent scam in the country. Those two euros are not the goal, your card details are. Expecting a parcel? Check the app of the carrier. **3. A Discord dm from a classmate: "can you vote for my project? link here"** - Click, it is your classmate - **Check with them through another channel first** ✓ - Enter your Discord login on the page This is how Discord accounts infect each other. The page asks for your login or your QR code. Check in person first, or in the channel. **4. A mail from GitHub about a new sign in, with a button to secure your account.** - Use the button - **Go to github.com yourself and look there** ✓ - Ignore the mail The mail may be real, but you cannot tell. Always go to the site yourself instead of pressing the button. If something is wrong, you will see it there too. **5. A phone call from "the help desk" reading out your code and asking you to confirm it.** - Give the code - **Hang up** ✓ - Call back the number that called A second step code is never shared, with anybody. No real help desk asks for one. Calling back the same number gets you the same scammer. **6. A mail from an internship company, with an attachment called assignment.pdf.exe.** - Open it, you are expecting the assignment - **Do not open it and check first** ✓ - Rename it to .pdf first A double extension is almost always malware. Renaming changes nothing about what is inside. Call or mail the company on an address you look up yourself. ### Clicked anyway *It happens to everybody once. What you do in the first quarter of an hour decides the damage.* 1. **Change the password**: Of that service, and of every other one where you used the same. Start with your mail. 2. **Kick out the sessions**: In the settings of the service: sign out all devices. Otherwise the intruder simply stays logged in. 3. **Say it**: To the help desk of your school, to your internship supervisor, to your class if messages went out in your name. > [!NOTE] > Staying quiet out of embarrassment only makes it worse. Everybody who has been through it knows how fast it goes. ## 5. Secrets in code *The keys to an API belong nowhere near your repo.* **A key in git is a key in the street.** A public repo gets scanned within minutes by bots looking for exactly those keys. Bills of thousands of euros start this way. ### What a secret is *Anything that lets somebody else act as your application.* | Kind | Example | What somebody can do with it | | --- | --- | --- | | API key | `sk_live_51H...` | Run up costs on your account | | Database password | `DB_PASSWORD=...` | Read or wipe your entire database | | Token | `ghp_xxxxxxxx` | Push to your repos in your name | | Certificate or key file | `id_rsa` | Log in to your server | ### Where they do belong *In a file that git leaves alone, and in the settings of your hosting on the server.* ```bash # .env (stays on your machine) WEATHER_API_KEY=abc123secret DB_PASSWORD=also-secret # .env.example (does go along, without values) WEATHER_API_KEY= DB_PASSWORD= # .gitignore .env .env.local ``` > [!TIP] > The example file is not a formality. Without it your teammate has no idea which keys to request. ### Pushed by accident *Removing it in a new commit is not enough. Your key still sits in the history.* ```console $ git rm --cached .env takes the file out of git, leaves it on your disk $ echo ".env" >> .gitignore so it does not go along again $ git commit -m "Remove .env from version control" the key still sits in every older commit $ # revoke the key at the service and create a new one this is the step that actually counts ``` > [!WARNING] > Always assume the key has been seen. Revoking and replacing takes two minutes, rewriting history fixes nothing once somebody copied it. ### What GitHub does itself *There is a safety net, but do not count on it.* - GitHub recognises the key formats of big services and blocks such a push - After a leak it warns the service, which often revokes the key right away - That only works for formats they know, not for your own tokens - And not for a database password sitting there as plain text > [!NOTE] > Switch the net on in your own repos, but treat it as a net. The rule stays: secrets do not go in git. ## 6. The rest *Three habits worth as much as everything above together.* ### Your device *The laptop on your lap is the weakest spot in your whole setup.* - **Locking**: Automatically after five minutes, and by hand when you walk away. In a classroom, a café or the library, unattended lasts long enough. - **Disk encryption**: FileVault on macOS, BitLocker on Windows. Without it a stolen laptop is an open book, password on your account or not. - **Updates**: Most attacks use holes that were patched months ago. Updating is boring and it works. - **Backups**: A stolen or encrypted laptop costs you nothing the moment your work also sits somewhere else. ### Public wifi *Far less dangerous than ten years ago, and still not a place for everything.* #### What you can forget - Almost everything goes over https, so reading along does not work - A vpn is no protection against phishing or a weak password - The free vpn from an advert reads along itself #### What still counts - Never wave away a certificate warning - Treat a network that wants a login through a page with suspicion - Do not share your screen in a room with your mail open ### What you hand over yourself *Most information does not leak, it gets posted.* - A screenshot of your screen with your mail address, your tokens or a client name on it - Your full timetable and address in a public profile - A photo of your student card in a group chat - Staying signed in on a computer at school or at a friend > [!TIP] > Before you share a screenshot: look at the edges. Tabs, notifications and folder names give away more than the bug you wanted to show. ### You accidentally push a `.env` with an API key to a public repo. What do you do first? - A. Revoke the key at the service and create a new one - B. Delete the commit and push again - C. Set the repo to private - D. Rename the file **Answer:** A. Revoke the key at the service and create a new one Bots find such a key within minutes. Once it was online, it is burned. Revoke first, then clean up: take .env out of git and put it in .gitignore. ### Cheat sheet *Six things, and the first three you do tonight.* - **Vault**: One long master password, the rest generated and unique per service. - **2FA**: On your mail, your school account, GitHub and your vault. Keep the recovery codes. - **Reuse**: Zero services with the same password. Start with the important ones. - **Phishing**: Look at the domain, not the sender. Go to the site yourself. - **Secrets**: In `.env`, never in git. Leaked means revoked. - **Device**: Lock, encrypt, update, back up. ### Task: Half an hour, tonight *30 minutes, On your own* This is the job in this deck with the biggest return per minute. 1. Install a password manager and make your master password four words long 2. Turn on 2FA for your mail, your school account and GitHub, and keep the recovery codes 3. Check your mail address on haveibeenpwned.com and replace the passwords that show up 4. Walk through your repos: is there a `.env`, a token or a password in there? 5. Switch on disk encryption if it is not on yet ### Further *Four places to look it up.* - **[haveibeenpwned.com](https://haveibeenpwned.com)**: See which leaks hold your address. - **[bitwarden.com](https://bitwarden.com)**: Free vault, works on everything. - **[Safeonweb.be](https://safeonweb.be/en)**: The Belgian government site with current warnings about scams. - **[GitHub on secrets](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning)**: What GitHub does when a key lands in a repo. ## Glossary - **Credential stuffing**: Trying an email address and password from a leak on a hundred other services. It works everywhere you reused the same password. (slide 6) - **Have I Been Pwned**: A site that collects the leaks circulating in public and tells you which ones your email address shows up in. If it is in there, change that password everywhere you used it. (slide 7) - **Password cracking**: Running a leaked list of encrypted passwords through a machine. Known passwords and their usual variants go first, only then every combination, and only there does length count. (slide 9) - **Password manager**: An app, also called a vault, that stores all your passwords and makes a unique, random one per service. Bitwarden is the free default choice. (slide 12) - **Master password**: The one long password that opens your vault, preferably four or five words. Nobody can reset it for you: forget it and your vault is gone. (slide 13) - **2FA**: Two-factor authentication. A second proof next to your password, like a code or your fingerprint, so a leaked password alone is not enough. An sms code is the weakest kind. (slide 16) - **Authenticator app**: An app that makes a new six digit code every 30 seconds as a second step. Stronger than sms, but you can still type the code into a fake site. (slide 16) - **Passkey**: Signing in with your fingerprint or a usb key. It is tied to the domain and only works on the real site, which is why it stops phishing. (slide 16) - **Recovery codes**: Codes that each work once instead of your second step, for when your phone is broken or gone. Keep them in your vault or on paper, not in a screenshot on that same phone. (slide 17) - **Phishing**: A fake message that gets you to sign in, pay, hand over a code or open an attachment. Look at the domain, not at the name of the sender, and when in doubt go to the site yourself. (slide 20) - **Double extension**: A file name like assignment.pdf.exe that pretends to be a document. Almost always malware, and renaming changes nothing about what is inside. (slide 21) - **Session**: A device that stays signed in to a service. After a hack you sign out all devices in the settings, or the intruder simply stays logged in, new password or not. (slide 22) - **Secret**: Anything that lets someone pretend to be your application: an API key, a database password, a token or a key file. It never goes in git. (slide 25) - **API key**: The key your code uses to sign in to a service. Whoever has it runs up costs on your account. (slide 25) - **Token**: A string that grants rights, like a GitHub token (ghp\_...). Whoever has it pushes to your repos in your name. (slide 25) - **.env**: The file with your secrets that stays on your machine and sits in .gitignore. On the server you put the same values in the settings of your hosting. (slide 26) - **.env.example**: The example file that does go into git: the same names as in .env, without values. That way your teammate knows which keys to request. (slide 26) - **Revoking a key**: Making a leaked key invalid at the service and creating a new one. The first thing you do after a leak, because a new commit does not take it out of your history. (slide 27) - **Secret scanning**: GitHub recognises the key formats of big services, blocks such a push and warns the service after a leak. A safety net: it does not see your own tokens or a password in plain text. (slide 28) - **Disk encryption**: FileVault on macOS, BitLocker on Windows. Without it a stolen laptop is an open book, password on your account or not. (slide 30) ## Links and sources ### In the deck - [haveibeenpwned.com](https://haveibeenpwned.com) (slide 7, slide 36) - [Bitwarden](https://bitwarden.com) (slide 12, slide 36) - [1Password](https://1password.com) (slide 12) - [Safeonweb.be](https://safeonweb.be/en) (slide 36) - [GitHub on secrets](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning) (slide 36)