EDCI 337 and 335

Theme by Anders Norén

Category: EDCI 335

How Passwords Are Stored: Hashing, Salting, and the Layers Behind Digital Security (EDCI 335)

By: Sneh, Trevor, Dilraj

Overview
Every time you create an account online, your password goes through a series of invisible protections, or at least, it should. This learning resource explores what actually happens to passwords after you hit submit, why poor implementation leads to massive data breaches, and what both developers and everyday users can do about it.

As Bonneau et al. (2012) highlight, most authentication systems carry serious problems that users never see, and further found that weak password storage remains one of the leading causes of large-scale data breaches globally. This resource makes those technical realities approachable for anyone.

Learning Context and Learners

Who this is for: 15–20 learners across Canada, ranging from high school students (16+) to working professionals (up to 35). No programming or cybersecurity background is assumed, just basic internet use.

Lifestyle considerations: Some learners may be working full-time or managing family responsibilities. The module is fully asynchronous and completable in flexible 1–2 hour sessions with no live attendance required.

Accessibility: Content is written in plain language throughout, uses accessible color palettes for color blindness, and is broken into short, focused chunks to support learners with ADHD or English as an additional language.

Learning Theory: Constructivism

This resource is grounded in constructivism, the idea that learners build understanding through active experience rather than passive reception. Rather than simply explaining what hashing is, learners generate their own hashes, attempt to crack passwords, and analyze real breach scenarios.

This fits the topic well because password security only becomes meaningful when you feel it. Seeing a weak password crack in two seconds on CrackStation is more impactful than reading about it. Each subtopic moves from concept to interactive activity, so learners construct real understanding they can apply.

Learning Design: Inquiry-Based Learning

We use an inquiry-based design structured around essential questions. Each subtopic opens with a question that doesn’t have an obvious answer, pushing learners to explore before they’re given explanations.

This works here because the topic has natural curiosity hooks; most people are genuinely surprised that websites can’t retrieve their passwords, or that two people using the same password get different hashes. Inquiry lets that surprise do the teaching.

Designing for Diverse Learners (UDL + CAST)

Following Universal Design for Learning principles:

Multiple means of representation: Concepts are presented through written explanations, embedded YouTube videos, and interactive tool exploration so learners can engage in the format that works for them.

Multiple means of engagement: Activities range from low-stakes exploration (MD5 generator) to reflective writing to applied checklist creation. Learners choose how deeply to engage with each tool.

Multiple means of expression: Assessments include short-answer quizzes, plain-language written explanations, and a personal security checklist, giving learners multiple ways to demonstrate understanding.

Technology Rationale

WordPress hosts the resource because it’s free, mobile-friendly, and requires no software installation, which removes access barriers for learners across Canada.

H5P enables interactive quizzes embedded directly in the page so learners get immediate feedback without leaving the resource.

WordPress quizzes handle written submissions easily and work on any device.

MD5HashGenerator.com, CrackStation.net, and HaveIBeenPwned.com are free, browser-based tools that make abstract concepts easy with zero setup required.

Learning Objectives

By the end of this resource, learners will be able to:

  1. Explain the concept of hashing, describe the step-by-step process of password storage, and identify why plain-text storage is dangerous.
  2. Describe what salting is, explain how it prevents rainbow table attacks, and demonstrate why two identical passwords produce different hashes when salted.
  3. Identify at least three common password attack methods, explain how each works, and connect attack success to poor storage practices.

Part 1: What Is Hashing and How Does It Work?

Essential Question: In what ways does the journey of a password from input to storage reveal the hidden complexity of everyday digital security?

Content

When you create an account, your password is run through a hash function, which is a one-way mathematical process that converts it into a fixed string of characters called a hash. “hello123” might become 482c811da5d5b4bc6d497ffa98491e38. The original password is never stored.

Key properties of hashing:

  • The same input always produces the same hash
  • Changing even one character completely changes the output
  • The process cannot be reversed because hashing is one-way
  • All hashes are the same fixed length regardless of input size

When you log in, your input is hashed and compared to the stored hash. If they match, you’re in. This is why secure websites force password resets rather than emailing you your password, because they genuinely cannot retrieve it.

Watch

Learning Activity 1: Hash It Yourself (Explore)

Go to

https://www.md5hashgenerator.com

Try the following:

  1. Type in a short word like “hello” and generate its hash
  2. Type in the same word with one character changed. Notice anything?
  3. Try a very long sentence, and what do you notice about the hash length?
  4. Try to reverse a hash back to the original text

Reflection questions to answer before moving on:

  • What stays consistent about hashes regardless of input?
  • Why does even a tiny change produce a completely different hash?
  • What does this tell you about why hashing is used for security?

Assessment 1: Short-Answer Quiz (H5P)

Four questions testing definitions and key properties of hashing.



Part 2: What Is Salting and Why Is It Necessary?

Essential Question: How does adding randomness to the hashing process fundamentally change the effectiveness of password protection?

Content

Hashing alone has a serious weakness. Attackers use rainbow tables, which are massive precomputed databases of common passwords and their hashes. If your password is “password123” and the hash is always the same, matching it takes seconds.

Salting fixes this. Before hashing, the system adds a unique random string (the salt) to your password. So even if you and a friend both use “password123,” your stored hashes look completely different. Rainbow tables become useless because the salt is unique per user.

Key points:

  • Salts are randomly generated and stored alongside the hash
  • The same password produces a different hash for every user
  • Modern algorithms like bcrypt handle salting automatically
  • MD5 and SHA-1 are outdated and should never be used for passwords

Watch:

Learning Activity 2: Crack the Hash Challenge (Experiment)

Go to

https://crackstation.net

and paste in these pre-hashed passwords one at a time:

5f4dcc3b5aa765d61d8327deb882cf99
e10adc3949ba59abbe56e057f20f883e
d8578edf8458ce06fbc5bb76a58c5ca4

Record: Did it crack? How fast? Then try hashing your own weak password on MD5HashGenerator and pasting that hash into CrackStation.

Reflection: Why did some crack instantly? What does this tell you about the limits of hashing without salting?

Assessment 2: Plain-Language Explanation (Google Form)

Write 100–150 words explaining salting as if you’re teaching a friend with zero technical background. Focus on: what salting is, why it matters, and what happens during a rainbow table attack.

Part 3: Common Password Attacks and Best Practices

Essential Question: What do data breaches reveal about the shared responsibility between developers and everyday users, and how can we apply best practices?

Content

Even with hashing and salting, poor implementation leaves users exposed. The three most common attack types:

Brute force — automated tools try every possible character combination until one works. Short or simple passwords fall fast.

Dictionary attacks — attackers run through lists of common words and passwords. “iloveyou” or “qwerty” are cracked almost instantly.

Rainbow table attacks — precomputed hash databases matched against stolen data. Defeated by proper salting, but still dangerous when developers skip it.

The root problem, as Bonneau et al. (2012) argue, is that many systems continue to use outdated algorithms such as MD5 without salting, leaving users exposed even when a breach occurs. NIST (2017) guidelines specifically recommend modern adaptive algorithms like bcrypt or Argon2.

What good looks like vs. bad:

Company A (Secure)Company B (Insecure)
Uses bcrypt with unique saltsUses MD5 with no salting
Breach exposes uncrackable hashesBreach exposes millions of passwords within hours
Forces password reset after breachEmails users their actual passwords

Learning Activity 3: Good Company vs. Bad Company (Analyze and Apply)

Read the two case studies above. Then:

  1. Go to HaveIBeenPwned.com and check your email address
  2. If you show up in a breach, look at which company was responsible and when

Use what you’ve learned to build your Personal Password Security Checklist.

Assessment 3: Personal Security Checklist (WordPress Form)

Create a checklist of at least 3 concrete security habits covering both your own behavior and what to look for in services you trust. Examples to get you started, but write your own:

  • Enable two-factor authentication on all major accounts
  • Use a password manager rather than reusing passwords
  • Only trust services that force resets instead of emailing passwords
  • Check HaveIBeenPwned regularly

Submitted via WordPress form. Graded on a proficiency scale: Developing / Proficient / Extending based on depth and specificity of items.

Bibliography

Bonneau, J., Herley, C., Van Oorschot, P. C., & Stajano, F. (2012). The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. 2012 IEEE Symposium on Security and Privacy.

National Institute of Standards and Technology. (2017). Digital identity guidelines: Authentication and lifecycle management (NIST Special Publication 800-63B). https://pages.nist.gov/800-63-3/

EDCI 335 Blog Post 4 – Interaction

For this post, I explored how video can be used as a tool for interaction in a learning environment. My group’s Interactive Learning Resource is focused on password hashing and security, so I searched YouTube for something that would work well for learners who are new to the topic. I wanted something visual, beginner-friendly, and engaging enough to spark some thinking beyond just watching.

What kind of interaction does the video require from learners?

The video does not force a response from learners in the way a quiz would. It is more of what Bates describes as a medium that depends on designed or learner-generated interaction rather than anything inherently built in. A learner could easily watch it passively without engaging at all, which is a real limitation worth keeping in mind.

How might learners respond on their own?

The video opens by talking about real data breaches, which makes the content feel personal and urgent. Most learners would naturally pause and reflect on their own password habits while watching. They might mentally check whether they reuse passwords or jot down questions they want to look up.

What follow-up activity would you suggest, and what technology would learners use?

I would have learners write a short blog post explaining in their own words what would happen to users if a company stored passwords in plain text instead of hashing them. This moves learners from watching to actually applying and analyzing what they learned, which is the kind of higher-order thinking Bates says often needs more than a video alone.

How would learners get feedback?

Peer commenting works well here. Learners read each other’s explanations and flag anything that seems off or incomplete. This is manageable and scales fine in a larger class.

How could the video be redesigned for better interaction?

I would add a few pause points with reflection questions built in, something like “what do you think happens to your password when you log in?” before the answer is revealed. That would push the interaction from learner-generated to more of a designed level and keep people actively thinking rather than just watching.

References

Bates, A. W. (2022). Teaching in a digital age (3rd ed.). BCcampus. https://teachonline.ca/teaching-in-a-digital-age

Simply Explained. (2018, April 3). Passwords & hash functions (Simply Explained) [Video]. YouTube. https://www.youtube.com/watch?v=cczlpiiu42M

EDCI 335 Blog Post 3 – Prompt 6: Where Do You See the Idea of the Average Learner Shaping Educational Design?

If you’ve ever sat through a course that felt like it wasn’t designed with you in mind, you’re not imagining it. Most educational design quietly assumes there’s a “typical” student on the other end. Someone who absorbs information from a lecture, meets every deadline without issue, and does well on a written exam. That assumption shows up everywhere, and most of the time, nobody questions it.

You see it in how courses are assessed. One exam at the end, one submission format, one way to show what you know. That doesn’t work for everyone. Some people freeze up on timed tests. Some express what they know way better through doing something than writing about it. Some are dealing with things outside of school that affect how and when they can engage. Designing around one type of learner means everyone else is just expected to adapt.

The more interesting shift is to ask what happens when we treat variability as the norm rather than the exception. That’s the core idea behind UDL. Rather than adding accommodations as an afterthought, you build flexibility in from the start. For the learning resource my group is working on about password security and hashing, we can’t just drop a block of technical text and call it a lesson. Some people will want a visual, some will want to actually try something a little more different, and others will need the foundational concepts explained before the technical stuff even makes sense.

What I found most useful from the readings this week is that designing for a wider range of learners doesn’t make things easier in a bad way. It just makes things work better overall. Captions help people who aren’t native English speakers. A clear structure helps anyone tired or distracted. Flexible pacing helps people who have a lot going on. Once you stop designing for a stereotypical average student and start designing for real people, the whole thing gets better for everyone.

Reference

CAST. (2018). Universal Design for Learning guidelines version 2.2. http://udlguidelines.cast.org

Comments

Comments

Open Pedagogies: Why Your Assignments Should Matter Beyond the Grade – Blog post 2

What Is Open Pedagogy?

Most assignments follow the same pattern: write it, submit it, never see it again. Open pedagogy challenges that. Instead of creating work that disappears into a dropbox, learners produce things that live in the real world and actually mean something to someone outside the classroom.

David Wiley describes this through the idea of renewable assignments, work that has value beyond the course. The opposite is a “disposable assignment,” something only your professor ever reads. Open pedagogy shifts learning from private consumption to public contribution. Content is freely shared under Creative Commons licensing, learners have real agency over what they create, and work is published for a real audience rather than just graded.

In technology-mediated environments, specifically, this matters a lot. The tools and platforms we choose are not neutral; hosting something on a public WordPress site versus submitting a PDF to Brightspace sends a completely different message about who the work is for.

How It Aligns With Our Topic

Our group is teaching how passwords are stored, hashing, salting, and digital security. Open pedagogy fits naturally here because digital security literacy benefits everyone, not just students enrolled in a course.

We plan to host resources publicly on WordPress so that anyone can find and learn from them. That is open pedagogy in practice. The way we designed, like the Crack the Hash Challenge using CrackStation.net, also reflects these value, learners experiment with real tools and draw their own conclusions rather than passively absorbing definitions. Choosing free public tools like HaveIBeenPwned instead of paywalled software reinforces openness at every level of the design.

Comments

Comments

Reference

Wiley, D. (2013). What is open pedagogy? Iterating toward openness.

https://opencontent.org/blog/archives/2975

Why I Quit a Machine Learning Course (And What I Learned From It)

The summer before my third year, I signed up for a deep learning course on Coursera. I was genuinely excited — I had a research co-op coming up and wanted to actually understand what I’d be working on. The first few weeks felt great. The videos were clear, the pace felt manageable, and I was picking things up.

Then week four hit, and everything changed.

The assignments got harder fast, with barely any explanation of what was expected. The only feedback I got was pass or fail — no hints, no guidance, just a score. I’d spend an hour on something, get a fail, and have no idea where I went wrong. The discussion forums were basically empty, so there was no one to even ask. I slowly just… stopped logging in.

Looking back, it makes a lot of sense why I lost motivation. Ertmer and Newby (2013) talk about how learners need to feel competence — like they’re actually growing. When your only feedback is a binary score, that feeling never comes. Self-Determination Theory adds two more pieces: relatedness (feeling connected to people around you) and autonomy (having some say in how you learn). Both were completely missing for me.

Weller (2020) describes connectivism — the idea that real learning happens through networks of people and resources, not just one course in isolation. Funnily enough, I actually did end up learning the material — just not from that course. I switched to fast.ai, read papers, and talked through concepts with grad students at my lab. Messier, but way more effective.

If that Coursera course had included even simple things — peer discussion, flexible projects, links to active communities — I think I would have finished it. Motivation isn’t just willpower. It’s built into the design.

References

Ertmer, P. A., & Newby, T. J. (2013). Behaviorism, cognitivism, constructivism. Performance Improvement Quarterly, 26(2), 43–71. https://pressbooks.pub/lidtfoundations/chapter/behaviorism-cognitivism-constructivism/

Weller, M. (2020). 25 years of ed tech. AU Press. https://aulasvirtuales.wordpress.com/wp-content/uploads/2014/02/25-years-of-ed-tech-by-martin-weller.pdf

Sneh Duggal – Self Introduction ( EDCI 335)

Hi everyone!

My name is Sneh and I’m a 4th year Computer Science student at UVic, expected to graduate in May 2027.

My degree has pulled me towards AI and machine learning — I recently finished a co-op at the National Research Council of Canada doing AI research, which was one of the best experiences I’ve had so far. Getting to work on real research problems outside of the classroom really solidified my interest in the field.

I grew up in Seattle and moved to Victoria for university. I’ve come to really love it here — great city, great people.

Outside of school I stay pretty active. I play badminton, train jiu jitsu, and spend a lot of time with friends and family. Something most people don’t expect — I’ve been playing piano for years and performed at every high school talent show, and even played at Victoria’s Got Talent at UVic!

I don’t have much background in educational technology or open learning, so EDCI 335 will be a new experience for me. I’m genuinely curious to learn how technology shapes the way people teach and learn, and I’m looking forward to connecting with everyone in the course!