edubun
English
English한국어EspañolPortuguêsFrançaisDeutschItalianoРусскийBahasa Indonesia日本語
Home›Computer basics and typing

Online safety

Six units on the habits that stop most account takeovers and data losses: long passwords and passkeys, two-step sign-in, spotting phishing, updates, personal information and backups. The advice follows NIST SP 800-63B-4, CISA and KISA. Every unit has a small code exercise, flashcards and 9 or 10 practice questions with explanations. No product is recommended.

Progress
  1. 1Passwords and passkeysSince July 2025 the US standard NIST SP 800-63B-4 has said a password used on its own must be at least 15 characters, and that services must not force you to change it on a schedule.
  2. 2Two-step sign-inA six-digit code has exactly 1,000,000 possible values, so a thief with your password who gets five guesses has a 1 in 200,000 chance.
  3. 3Spotting phishingIn the address example.com.account-check.example, the site that actually owns the page is account-check.example; the example.com at the front is only a label its owner chose.
  4. 4Software updatesCompared as text, version "2.9.1" sorts after "2.10.0", because the character 9 comes after 1; compared as numbers, 2.9.1 is the older one.
  5. 5Protecting personal informationThe answer to "What was the name of your first pet?" is often a public photo caption away, which is why NIST now forbids services from prompting for security questions when you set a password.
  6. 6BackupsCISA's 3-2-1 rule asks for three copies of every important file, on two kinds of storage, with one copy kept somewhere other than your home or office.
Sources for this course (13)
  • (checked 2026-10-17; reordered 2026-10-19: standards and law first, then official agency guidance, then technical documentation, history last)
  • Standard: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (pages.nist.gov/800-63-4/sp800-63b.html, final 31 July 2025 per the csrc.nist.gov document history (Date Published: July 2025), checked 2026-10-17: sec. 3.1.1.2 password rules, 3.1.3.3 PSTN restricted, 3.2.5 phishing resistance, Appendix B syncable authenticators)
  • Law: 개인정보 보호법 제2조 (국가법령정보센터, law.go.kr)
  • Official agency guidance: CISA Secure Our World: Use Strong Passwords, Turn on MFA, Recognize and Report Phishing, Update Software, and tip sheets (cisa.gov/secure-our-world, checked 2026-10-17)
  • CISA, More than a Password (cisa.gov/MFA) and fact sheet Implementing Phishing-Resistant MFA (2022)
  • checked 2026-10-17
  • CISA #StopRansomware Guide (checked 2026-10-17)
  • CISA, Back Up Business Data and Data Backup Options (Ruggiero and Heckathorn, 2012, Carnegie Mellon University, produced for US-CERT, which CISA retired into CISA.gov on 24 February 2023; 3-2-1 rule) (checked 2026-10-17)
  • KISA, 118 상담 서비스 (kisa.or.kr/118, checked 2026-10-17)
  • KISA 보호나라 스미싱 확인서비스 (boho.or.kr, checked 2026-10-17)
  • KISA 개인정보침해 신고센터 (privacy.kisa.or.kr, checked 2026-10-17)
  • Technical documentation: MDN Web Docs, Passkeys (developer.mozilla.org/en-US/docs/Web/Security/Authentication/Passkeys, checked 2026-10-17) and autocomplete attribute (checked 2026-10-17)
  • No product is recommended. Every code exercise was checked with a Playwright probe against a reference solution.

Checked: 2026-10-17