Illustrated with AICybersecurity for Juniors · Book 1 · Chapter 1
The Password That Guarded Nothing
Part 1 · GateMitra, for everyone's convenience
Silverline Heights had a new app. It was called GateMitra. Mitra means “friend,” and it promised to make everyone's life easier: book a visitor's entry, reserve a parking slot, report a leaking pipe, all from one phone screen.
Ranjan uncle, the society secretary, had set it up himself over a long weekend. He read the instructions twice and still got stuck at “create a strong password for each flat.” A hundred and fifty flats, a hundred and fifty passwords to explain over the phone? Ranjan uncle had a better idea. A practical idea.
Every flat's password would simply be the flat number, followed by 123.
Flat 2001? Password: 2001123. Flat 1507? Password: 1507123. Simple. Memorable. Nobody would need to call him.
And so that nobody would forget, Ranjan uncle printed the whole list, all hundred and fifty flats and all hundred and fifty passwords, and pinned it to the notice board outside the lift, under a cheerful hand-lettered sign: “GateMitra Logins, For Your Convenience!”
Part 2 · Happy's golden bat
Illustrated with AIFour floors up, Happy had his own password problem. His cricket game, Super Six, needed a 4-digit PIN to protect his coins, coins he had saved for sixty-two days to buy a golden bat. His PIN was 1234.
“It's easy to remember,” he told Bunny, very pleased with himself.
“Easy for who?” said Bunny.
Happy hadn't thought about that part.
That evening, Mitthu, who had spent the whole afternoon on the ground-floor balcony railing listening to people come and go, said something strange, completely out of nowhere. “Two! Zero! Zero! One! One-two-three!” Mrs. Iyer from flat 2001 nearly dropped her tea. Nobody thought much of it. Mitthu repeated all sorts of things he overheard. It was just one of his habits.
Part 3 · Forty pizzas for flat 1104
Illustrated with AIOn Thursday morning, chaos arrived at flat 1104, home of the famously no-nonsense Mrs. Kavita Rao. Forty pizza deliveries, all approved through GateMitra, all arriving at once, none of them ordered by her.
By the time Bunny and Riya got downstairs, half of Block A's parking slots had also been swapped overnight, and three families had mysteriously cancelled deliveries they definitely wanted.
“Someone's hacked the app,” said a neighbour darkly.
Bunny wasn't so sure. “Hacked how, though?” he said to Riya. “GateMitra doesn't even let you try a password more than a few times before it locks you out.”
They found their answer at the lift, where Ranjan uncle's cheerful notice was still pinned to the board, now with a corner torn off. A Class 10 boy from Block B, Rohit, was standing right in front of it, looking extremely pleased with himself and not even slightly sorry.
“I didn't hack anything,” Rohit said, grinning. “I read it. It's right here on the board. Flat number plus one-two-three. I just tried a few for fun.”
Part 4 · Two red flags, not one
Riya stared at the printed list, then at the nameplates on the doors nearby, each one proudly showing its flat number for any visitor to see. “Rohit didn't even need to guess,” she said slowly. “The password is the flat number. And the flat number is painted right there, next to every door.”
“And then uncle printed the answer key and pinned it up for anyone walking past,” said Bunny. “It's not one mistake. It's two.”
Mitthu, listening from the railing, suddenly looked a little uncomfortable. “Two! Zero! Zero! One!” he said again, quieter this time, as if only just realising what he'd been doing all week.
“Mitthu!” said Bunny. “You've been repeating Mrs. Iyer's password all week too? That's three mistakes.”
Part 5 · Nilu chachu's visit
Illustrated with AIThat evening, Ranjan uncle called in reinforcements: Nilu chachu, who lived two blocks away, built automation and security tools for a living, and had spent more hours than he could count testing exactly this kind of weakness for a living.
“Nobody broke in, in the way people imagine,” Nilu chachu said, opening his laptop. “There was no clever code, no secret trick. The password was never really a secret. It was built entirely from public information, your flat number, and then the whole list was written down somewhere public too. That's not a lock. That's a lock-shaped decoration.”
“But what if he'd had to actually guess?” asked Riya.
Nilu chachu smiled. “Then we'd be talking about something computers are extremely good at: trying thousands, even millions, of guesses a second. A short password made only of digits doesn't hold out for long against that. And if the same password is reused everywhere, your gate app, your email, your game, then one leak anywhere becomes a leak everywhere. That's called credential reuse, and it's one of the most common ways accounts actually get taken over.”
“So what should a password look like?” asked Bunny.
“Long, and nowhere near as predictable as it feels,” said chachu. “My favourite trick: pick three random, unrelated words and a number. Something like mango-train-47. It's long enough to be very hard to guess, and strange enough that nobody could look at your door number and figure it out, but it's still something you can remember. And for everything else, there's a password manager: a locked app that remembers a different, long, random password for every single thing you use, so you only ever have to remember one.”
Part 6 · Taking down the list
Illustrated with AIIt took one evening to undo a weekend's worth of convenience. Every flat got its own password, built with Nilu chachu's three-word trick, set individually rather than guessed from a pattern. GateMitra's settings turned out to have an option nobody had switched on: a one-time code sent by SMS for anything serious, like approving a visitor or changing a parking slot. Nilu chachu called it two-factor authentication, or 2FA: a second lock, of a completely different kind, on top of the password.
And the printed list came down. Ranjan uncle looked almost sad to see it go. “It really was for everyone's convenience,” he said.
“It was,” said Nilu chachu kindly. “For Rohit's, mostly.”
Part 7 · A new PIN, and a new house rule
Happy changed his PIN too, eventually, after some grumbling. His new one wasn't his birthday, or 1234, or anything else he'd shout out loud in excitement. Nilu chachu had gently pointed out that birthdays are exactly the kind of thing written on a school ID card for anyone to see.
And Silverline Heights got one new, informal house rule, mostly aimed at a certain parrot: if you wouldn't shout it across the lobby, maybe don't say it near Mitthu either.
Mitthu, perched back on his favourite railing, sulked about this for exactly one afternoon before deciding he preferred guarding secrets to repeating them. “Can't tell you,” he informed a curious pigeon. “Private information.”
Moral of the story
A password is a lock, not a decoration. Keep it strange, keep it secret, and never use the same key on every door.
A lock that's the same on every door
is hardly a lock at all, be sure.
Keep each key strange, keep it unseen,
and guard what stands between.
Spot the red flags
Ranjan Uncle's Noticeboard
“GateMitra Logins, For Your Convenience!” 1
2001123215071231104123Pinned outside the lift, Block A ground floor, where anyone walking past can read it. 3
A sign announcing where every login lives is an invitation, not a convenience. It tells a stranger exactly where to look.
Every password follows the exact same guessable pattern. Learn the trick once, and you know every password in the building.
The password is built entirely from public information. The flat number is painted on the door right next to it. It was never really secret to begin with.
Mitthu's notebook
What really happened?
| In the story | The real idea |
|---|---|
| Flat number + “123” for every password | Predictable password: built from a pattern or public information, so it's guessable without any real “hacking” |
| The printed list pinned to the notice board | Exposed credentials: a password written somewhere others can see defeats the whole point of having one |
| Rohit reading the list and logging in | Credential compromise: an account taken over, often with no special skill needed at all |
| Happy's PIN, 1234 | One of the most common PINs in the world, exactly the first thing anyone (or any program) would try |
| Mitthu repeating Mrs. Iyer's password out loud | Shoulder surfing: a password overheard or seen, rather than guessed |
| “It's easy to remember” (and used everywhere) | Credential reuse: one password on many accounts, so one leak can unlock them all |
| Nilu chachu's three-word trick | A passphrase: long, memorable to you, and hard for anyone else to predict |
| The SMS code added to GateMitra | Two-factor authentication (2FA): a second, different kind of lock on top of the password |
| “A locked app that remembers passwords for you” | A password manager: generates and stores a different strong password for every account |
Try it yourself
How strong is a password, really?
Type a made-up password below. Never type a real one you actually use. Nothing you type is saved or sent anywhere; it only lives on your screen while you're looking at it.
Type something above…
“Crack time” here is a simplified classroom estimate. It assumes a fast automated guesser trying combinations, not any one real attack. The point isn't the exact number; it's how fast the number changes.
Maths corner
Counting all the possible passwords
If a password is 4 characters long, and each character can only be a digit (0–9, so 10 choices), the number of possible passwords is 10 × 10 × 10 × 10 = 10⁴ = 10,000. A computer can try all 10,000 in well under a second.
Now keep the length at 4, but allow lowercase letters too (26 choices instead of 10): 26⁴ = 456,976, already over 45 times more. Allow uppercase letters, digits and symbols (about 70 choices) and stretch the length to 8 characters: 70⁸ is more than 576 trillion. Every extra character multiplies the possibilities; it doesn't just add to them.
Your turn. A PIN is 4 digits. How many possible PINs are there? What if the bank made PINs 6 digits long instead? How many now, and how many times more is that?
Answer: 10⁴ = 10,000 four-digit PINs. 10⁶ = 1,000,000 six-digit PINs, one hundred times more, just from two extra digits.
Try it on a computer · optional
A tiny password checker in Python
# a very simple strength check, real checkers do much more pwd = input("Enter a made-up password: ") long_enough = len(pwd) >= 8 has_upper = any(c.isupper() for c in pwd) has_digit = any(c.isdigit() for c in pwd) if long_enough and has_upper and has_digit: print("Looks reasonably strong.") else: print("Too weak, make it longer and mix it up.")
Enter a made-up password: Tiger2024
Looks reasonably strong.
Run this in any free online Python editor. Try “tiger”, then “Tiger2024”, then “mango-train-47” and watch how the checks change. A real checker would also compare your password against lists of commonly guessed ones. That's exactly what Ranjan uncle's list would have failed instantly.
Security tip
Five rules that would have saved Silverline Heights
Never build a password from information anyone can see or guess: a flat number, a birthday, a pet's name. Never use the same password on more than one app. Turn on two-factor authentication (2FA) wherever it's offered. It's a second lock of a completely different kind. Never write a password somewhere public, including a sticky note on a screen or a shared notice board. And never say a password out loud where anyone, or any parrot, might be listening.
Did you know?
Fun facts
Myth or fact?
“Turning ‘password’ into ‘P@ssw0rd1’ makes it unbreakable.”
MythSwapping a letter for a similar-looking symbol or number is one of the very first tricks any guesser already expects: “@” for “a”, “0” for “o”, “1” for “i”. It barely slows things down. Length and genuine unpredictability matter far more than one clever substitution.
Try this · no computer needed
The human password cracker
You need: index cards or small paper slips, and a pen for everyone.
- Everyone writes three true, easy-to-find-out facts about themselves on one side of a card: a birth month, a favourite team, a pet's name.
- On the other side, everyone writes a “password” built from one of those facts, like a classmate might honestly choose, e.g.
RCB2012. - Shuffle the cards and give each person someone else's card, facts-side up.
- Everyone gets sixty seconds to guess the password using only the facts shown. Count how many succeed.
- Now everyone rewrites their password as three unrelated words plus a number, nothing to do with the facts on the card, and tries guessing again. Discuss why the second round went so differently.
Careers corner
Penetration tester (ethical hacker)
A penetration tester is paid, with permission, to try to break into an app or a company's systems, exactly the way Rohit tried GateMitra, but on purpose, reported honestly, and fixed before anyone real gets hurt. It's one of the best-known jobs in cybersecurity, and also one with a strict rule: breaking in is only a career if you have permission first. Without it, it's simply a crime.
Useful to learn: curiosity about how things work (and how they break), patience, basic programming, and a strong, genuine sense of ethics.
Quiz time
How well did you learn?
Think and discuss
No wrong answers here
- Is it ever okay to share your password with a friend? What about with a parent?
- Ranjan uncle's plan was meant to be kind. It would have saved him a hundred and fifty phone calls. How can something well-intentioned still turn out to be a security risk?
- If a password absolutely had to be written down somewhere physical, where would be safer than a public notice board, and why?
- Mitthu leaked a password without meaning to, just by repeating what he overheard. Can you think of other ways information “leaks” even when nobody means to share it?
Be curious
Ask a teacher, parent or engineer
Word bank
New words from this chapter
Coming up in Chapter 2
Silverline Heights finally has strong passwords and a second lock on GateMitra. So when a message arrives on Ranjan uncle's phone from someone claiming to be “Bank Manager Uncle”, very politely asking for just one little OTP, what could possibly go wrong?
For teachers and parents: this chapter fits two 40-minute periods. Period 1: read Parts 1 to 7 aloud (15 min), explore the password strength meter together (10 min), then the Maths corner (10 min). Period 2: “Spot the red flags” discussion, the human password cracker activity, and the quiz. The key ideas: a strong password is long and unpredictable, not built from public information like a name, flat number or birthday; the same password should never be reused across accounts; writing a password down somewhere others can see it defeats its purpose entirely; and two-factor authentication adds a second, different kind of protection on top of any password. The Python corner is optional. All chapter illustrations are AI-generated scene art; the notice board, password meter and diagrams were built by hand.