D. Topics in Computer Science · Topics in Computer Science: Sustainability, Ethics, Emerging Technologies and Careers

Ethical Computing in Practice: Phishing, Passwords and Cyberbullying

D2.3 D2.1About 70 minutes

Learning goals

I can outline strategies that encourage ethical computing practices at home, at school and at work.
I can recognize phishing messages and read a web address to find its registered domain, in my head and in Python.
I can calculate the strength of random passwords and passphrases in bits and choose strong account practices.
I can respond to cyberbullying as a target, a bystander and a designer.

Words to know

phishing
A deceptive message pretending to be from a trusted source to steal information, money or access.

spear phishing
Phishing aimed at a specific person using details about them.

registered domain
The part of a host name (read from the right) that an organization registers and controls.

multi-factor authentication (MFA)
Signing in with two or more kinds of proof, such as a password plus a code or a device.

passphrase
A password made of several words, ideally chosen at random.

acceptable use policy
An organization's written rules for using its computers, networks and accounts.

cyberbullying
Bullying carried out through technology such as messages, posts or images.

From knowing to doing

You can now analyse ethical issues, explain privacy and intellectual property, and describe professional codes. Expectation D2.3 asks you to outline and apply strategies that encourage ethical computing practices at home, at school and at work. Strategies work best when they are specific, easy to follow and built into routines, the same lesson as the hierarchy of controls in Healthy Computing: good defaults beat good intentions.

This lesson focuses on three issues named in D2.1 that need practical defences: phishing, password practices and cyberbullying.

Ethical practice needs strategies at every level. Individual habits matter, but policies and defaults make good behaviour the easy choice for everyone.

Phishing

Phishing is a message (email, text, social media or phone call) that pretends to come from a trusted source to trick you into revealing information, paying money or installing malware. Messages aimed at a specific person, using details about them, are called spear phishing. Warning signs:

urgency or threats ("your account will be closed in 24 hours");
a request for passwords, codes, banking details or gift cards;
a sender address or link that doesn't match the organization;
unexpected attachments;
an offer that is too good to be true.

The key skill is reading where a link really goes. In a web address, the host name is between https:// and the next /. Read it from the right: the last two parts (or the last three for addresses like something.gc.ca) are the registered domain, which tells you who controls the site. Everything to the left of it can be chosen by the owner of that domain.

A deceptive link. The words "canada.ca" appear, but they are only part of a subdomain chosen by whoever owns login-verify.xyz.

def host_of(url):

rest = url.split("://", 1)[-1]

return rest.split("/", 1)[0].lower()

def registered(host):

parts = host.split(".")

return ".".join(parts[-2:])

def red_flags(url, expected):

host = host_of(url)

flags = []

if registered(host) != expected:

flags.append("domain is " + registered(host))

if not url.startswith("https://"):

flags.append("not https")

if host.count("-") >= 2:

flags.append("many hyphens")

return flags

links = ["https://www.canada.ca/en/services.html",

"https://canada.ca.login-verify.xyz/benefits?id=88",

"http://canada-ca-secure-login.com/"]

for link in links:

print(red_flags(link, "canada.ca") or "no flags", "<-", host_of(link))

split("://", 1)[-1] removes the scheme; split("/", 1)[0] keeps only the host. or prints "no flags" when the list is empty.

no flags <- www.canada.ca

['domain is login-verify.xyz'] <- canada.ca.login-verify.xyz

['domain is canada-ca-secure-login.com', 'not https', 'many hyphens'] <- canada-ca-secure-login.com

Output of the program above (what Python prints).

This checker is a teaching model

Real phishing filters use much more: lists of known bad sites, reputation scores and machine learning. A link with no flags can still be dangerous, and some domains have three-part endings (such as .gc.ca or .co.uk) that this simple version handles wrongly. When in doubt, don't click: type the organization's address yourself or use its official app. In Canada, report fraud to the Canadian Anti-Fraud Centre, and forward spam texts to 7726 (it spells SPAM on a phone keypad).

Just for fun

Why is it called phishing? It's widely said to be a play on "fishing", with the "ph" borrowed from early phone-hacking slang ("phreaking").

Either way, the advice is the same: don't take the bait.

Passwords and accounts

Good password practice is an ethical issue too: a reused or shared password can expose other people's data, not just yours.

Use a unique password for every account; a password manager remembers them.
Prefer long passphrases of random words. For a password chosen completely at random, its strength in bits is length × log₂(number of possible symbols). Four words chosen at random from a list of 7776 words give 4 × log₂ 7776 ≈ 51.7 bits; each extra bit doubles the guesses needed. (Passwords people invent themselves are much weaker than this formula suggests, because people choose predictable patterns.)
Turn on multi-factor authentication (MFA) or passkeys where available, so a stolen password alone isn't enough.
Don't share passwords; use the service's official sharing features instead.

Worked example

Example 1: Comparing password strengths

Compare the strength in bits of (a) 8 random characters from upper-case letters, lower-case letters and digits (62 symbols); (b) 4 random words from a 7776-word list; (c) 16 random characters from 94 printable keyboard symbols.

(a) 8 × log₂ 62 ≈ 8 × 5.954 ≈ 47.6 bits.
(b) 4 × log₂ 7776 ≈ 4 × 12.925 ≈ 51.7 bits.
(c) 16 × log₂ 94 ≈ 16 × 6.555 ≈ 104.9 bits.
Each extra bit doubles the number of guesses, so (c) needs about 2^(104.9 − 51.7) = 2^53.2 times as many guesses as (b).

(a) about 47.6 bits (b) about 51.7 bits (c) about 104.9 bits. The passphrase beats the short random password and is much easier to remember; a long random password from a manager is strongest.

import math

def bits(length, symbols):

return length * math.log2(symbols)

for label, length, symbols in [("8 chars, 62 symbols", 8, 62),

("4 words, 7776-word list", 4, 7776),

("16 chars, 94 symbols", 16, 94)]:

print(f"{label:25}{bits(length, symbols):6.1f} bits")

math.log2 gives the base-2 logarithm, which counts how many doublings (bits) each symbol adds.

8 chars, 62 symbols 47.6 bits

4 words, 7776-word list 51.7 bits

16 chars, 94 symbols 104.9 bits

Output of the program above (what Python prints).

Cyberbullying

Cyberbullying is bullying through technology: repeated hurtful messages, spreading rumours, posting embarrassing images, impersonating someone, or deliberately excluding them online. Ontario's Education Act includes bullying by electronic means in its definition of bullying, and school boards must have policies to prevent it and respond to it. Some behaviours, such as threats, harassment, or sharing intimate images of someone without consent, can be crimes in Canada.

Strategies:

If it's happening to you: don't respond in anger; save evidence (screenshots with dates); block and report the account to the platform; tell a trusted adult, teacher or guidance counsellor. If you feel unsafe, contact the police. Kids Help Phone is available any time at 1-800-668-6868 or by texting CONNECT to 686868.
If you see it (bystander): don't share or "like" it; support the person privately; report it.
As a designer: build easy reporting and blocking tools, default privacy settings for young users, and moderation, so the safe choice is the easy one.

Hands-on activity

Write a family technology agreement

You need: paper or a shared document, and your family.

Hold a 20-minute family meeting. Agree on 6 to 10 practical rules covering: passwords and MFA, what to do with suspicious messages, posting photos or information about family members, shared devices and accounts, screen-free times, and what to do if someone is upset by something online.
For each rule, write why it matters (connect it to an ethical lens or a risk from this unit).
Test the agreement on two scenarios: a text says a parcel is waiting and asks for a payment link; a cousin posts an embarrassing photo of a younger sibling.
Sign it and set a date to review it in six months.

What to look for: specific, practical rules (not "be good online"), reasons tied to real risks, agreed steps for reporting and support, and adults following the rules too.

Your turn

List four warning signs of a phishing message.

What is the registered domain in https://mail.google.com.account-check.net/login?

What does red_flags("http://canada-ca-secure-login.com/", "canada.ca") return?

How many bits of strength does a random 10-character password from 26 lower-case letters have?

Give two strategies a workplace can use to encourage ethical computing.

What should you do first if you are being cyberbullied?

Why is sharing your password an ethical issue and not just a personal risk?

More practice: warm-up

What is spear phishing?

What does MFA stand for?

Where can Canadians report fraud?

To which number can you forward spam text messages in Canada?

What does host_of("https://www.canada.ca/en") return?

More practice: on your own

How many times as many guesses does a 60-bit password need compared with a 50-bit one?

The checker flags https://www.canada.ca/en as fine, but would flag https://www.cra-arc.gc.ca/ as "domain is gc.ca". Explain the bug and a better approach.

Write two rules for a school acceptable use policy that encourage ethical practice, each with a reason.

A bystander sees a cruel meme about a classmate in a group chat. List three helpful actions.

Why are defaults (such as MFA turned on automatically) often more effective than training alone?

Challenge

Add a check to red_flags that flags a host containing the expected name anywhere except as the registered domain (for example canada.ca.login-verify.xyz). Show the code and the new output for that link.

A company wants every employee to change their password every 30 days. Security guidance has moved away from frequent forced changes. Explain why, and propose a better policy.

Design three features for a school messaging app that reduce cyberbullying, and evaluate one possible drawback of each.

Check your understanding

Quiz

Where does https://paypal.com.secure-check.info/login actually lead?

How strong, in bits, is a password of 5 words chosen at random from a 7776-word list?

Which workplace strategy is a default rather than a rule people must remember?

What is the best first step if you are being cyberbullied?

Which message is most likely phishing?

Why does registered("www.cra-arc.gc.ca") give a misleading answer in the lesson's checker?

For parents and teachers

Big idea: D2.3 asks students to outline and apply strategies that encourage ethical computing at home, school and work. The family technology agreement is the "apply" part, so please take part.

How to help: Hold the family meeting and follow the rules yourself. Show your teen a real suspicious message you received (if any) and practise reading the link together. Make sure your teen knows they can come to you about anything upsetting online without losing their phone.

Common difficulties:

Reading a link from the left and trusting the first familiar name. Read the host from the right.
Believing the bit-strength formula applies to passwords people invent; it applies to randomly chosen ones.
Treating the Python link checker as a real security tool; it is a simplified model.

Sensitive topic: cyberbullying can be distressing. If your teen is involved as a target, bystander or participant, contact the school. Kids Help Phone: 1-800-668-6868 or text CONNECT to 686868. Call 911 if anyone is in immediate danger.