# Methods in practice: Studying children and youth online; Documentation of the Website https://core-evidence.eu/methods-toolkit/handbook, retrieved 10 Nov 2022

Kotilainen, Sirkku (Ed.)

Erstveröffentlichung / Primary Publication

Sammelwerk / collection

**Empfohlene Zitierung / Suggested Citation:**

Kotilainen, S. (Ed.). (2022). Methods in practice: Studying children and youth online; Documentation of the Website https://core-evidence.eu/methods-toolkit/handbook, retrieved 10 Nov 2022. Hamburg: Leibniz-Institut für Medienforschung | Hans-Bredow-Institut (HBI); CO:RE - Children Online: Research and Evidence. https://doi.org/10.21241/ssoar.83031

**Nutzungsbedingungen:**

Dieser Text wird unter einer CC BY Lizenz (Namensnennung) zur Verfügung gestellt. Nähere Auskünfte zu den CC-Lizenzen finden Sie hier:
https://creativecommons.org/licenses/by/4.0/deed.de

**Terms of use:**

This document is made available under a CC BY Licence (Attribution). For more Information see:
https://creativecommons.org/licenses/by/4.0
METHODS IN PRACTICE

Studying children
and youth online

Editor | Sirkku Kotilainen

<figure><img src="image_1.png" /></figure>

Children Online:
Research and Evidence

<figure><img src="image_2.png" /></figure>

Tampere University

<figure><img src="image_3.png" /></figure>
The CO:RE Project is a Coordination and Support Action within the Horizon 2020 framework, which aims to build an international knowledge base on the impact of technological transformations on children and youth. Part of the knowledge base is a methods toolkit and accompanying online handbook, both of which are coordinated and produced by Sirkku Kotilainen, Jussi Okkonen and liris Tuvi at the University of Tampere (TUNI).

For all resources in the methods toolkit as well as this handbook fully accessible on the CO:RE Knowledge Base visit core-evidence.eu/methods-toolkit.

This project has received funding from the European Union's Horizon 2020 EU.3.6.1.1 – The mechanisms to promote smart, sustainable, and inclusive growth DT-TRANSFORMATIONS-07-2019 – The impact of technological transformations on children and youth. Grant Agreement ID 871018.

Please cite this edited volume as:

Kotilainen, S. (Ed.) (2022). Methods in Practice: Studying Children and Youth Online. Documentation of the Website https://core-evidence.eu/methods-toolkit/handbook, retrieved 10 Nov 2022.

DOI: https://doi.org/10.21241/ssoar.83031.
Chapter 4

Hard-to-guess but easy-to-remember: understanding children's
password security issues<fnref n="3" />

Lamprini Chartofylaka, Pinelopi Troullinou and Antoine Delcroix

In recent years, children experience new educational settings through digital devices from a very young age. They also encounter an increased reliance on such devices to stay in touch and play with peers. This new reality brought afresh into public debate children's data and online privacy (Livingston et al., 2019). There is a growing body of research on children's knowledge and understanding of authentication practices and privacy issues (Ratakonda et al., 2019). Regarding password generator practices, children tend to include personal information (Maqsood et al., 2018). Yet, they show difficulties memorizing their passwords (Choong et al., 2019).

This paper presents key methodological steps employed at the TiNum project which focuses on password security issues for primary school students aged 10-11 years old. The research took place in 6 classes (114 pupils in total, 19 in average per class) in the archipelago of Guadeloupe (French West Indies) between November 2020 and May 2021. Storytelling was adopted as a pedagogical approach on teaching children strong password techniques. The ultimate goal was to develop a toolkit for teachers and parents devoted to raising awareness on data protection online and cultivating digital literacy skills.

The research activities were conducted in a real-world school setting for two subsequent days for the same class. Each activity was divided into two phases (first day: phase A, second day: phase B) lasting for an average duration of two hours. Prior to the implementation of the project, written consents were obtained from both parents and local school districts. The study was carried out by a researcher (first author) in the presence of the teacher of the respective class.

During phase A, children's prior knowledge on the concept of "password" was assessed. They were invited to write down or draw their ideas on a sticky note responding to the question "What is the first word that comes to your mind when I tell you 'password'?". Based on their responses, several topics were discussed such as the purpose of a password, the different forms of unlocking digital devices (unlock

<footnote n="3">³Watch the chapter summary clip here: http://youtu.be/7mDzdOUJCm8</footnote>
patterns, voice recognition, etc.), the utility of unique and different passwords for
every use. Following, their privacy, online identity and security were discussed,
especially when using social media. Examples from the list of the most common
French passwords<fnref n="4" /> (123456, password, AZERTY, soleil<fnref n="5" />...) were then used to explore
password generator patterns. This activity introduced the discussion on the use of
personal information (e.g., date of birth), dictionary or common words when creating
passwords. Here, the idea of "password cracking" either by people close to us who
can predict our behaviour or by brute force attacks was explained and discussed. The
final task entailed the development of a strong password construction strategy using
a given random name (written in lowercase) and date of birth (number). Children gave
different ideas: mixing letters and numbers, using uppercase and lowercase, omitting
some numbers. This hands-on activity allowed researchers to teach them official
"best practices" on password principles (ANSSI, 2012) using their propositions.

The activity of phase B was based on the technique of storytelling, inviting children
to generate their own imaginative stories. A storyboard template, including six empty
boxes, was given to them. Following the researcher's instructions, they filled in step
by step their story elements: hero(s), goal(s), friend(s), enemy(ies), triggering event,
end of story. Children could write or/and draw according to their preferences. Once
they had filled their template, they were asked to pick two distinct words from their
story and create a strong password applying the rules they had learned in the
previous phase (Figure). Stories produced in this context assist them in creating a
unique and memorable password, serving as a "mnemonic device" (Chartofylaka &
Delcroix, 2018).

This approach allows the teacher/educator to explore and identify students’
knowledge and beliefs on a wide range of online security topics (phase A).
Storytelling technique also fosters children’s knowledge and digital media skills in a
playful and engaging way: Phase B allows children to implement new knowledge
acquired while encouraging their creativity.

<footnote n="4">⁴ See the Richelieu project on www.github.com/tarraschk/richelieu</footnote>

<footnote n="5">⁵ “azerty” refers to the French-language keyboards, which follow an azerty layout; “soleil” means “sun” in French.</footnote>
## Lessons learned

* The study showed that introducing playful techniques to raise awareness and cultivate skills in rather complicated issues such as online security and behaviour can be very effective.

* During research activities children, parents, and educators expressed ethical concerns over internet use such as anonymity. Therefore, dedicated sessions to discuss ethical issues related to cybersecurity could be planned accordingly.

* Wrap up sessions during which participants can discuss their own examples with their peers and their teacher could be useful. A password strength checker<fnref n="6" /> could be used for verification.

**Acknowledgments:** This project is funded by the Scientific Interest Group (GIS) "Jeu et Sociétés" (AAP 2019-2020).

<footnote n="6">⁶ An example of a password strength checker can be found here: www.scratch.mit.edu/projects/530311216/.</footnote>
References

Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), France (2012). Recommandations de sécurité relatives aux mots de passe. Technical report.

Chartofylaka, L., & Delcroix, A. (2018). StoryPass – Password Rules Hidden in a Storytelling Game Activity. Steps towards Its Implementation. www.hal-univ-paris13.archives-ouvertes.fr/hal-02151140.

Choong, Y., Theofanos, M. F., Renaud, K., & Prior, S. (2019). “Passwords protect my stuff”—a study of children’s password practices. Journal of Cybersecurity, 5(1). www.doi.org/10.1093/cybsec/tyz015.

Livingstone, S. Stoilova, M. & Nandagiri, R. (2019) Children's data and privacy online: Growing up in a digital age. An evidence review. London: London School of Economics and Political Science. https://www.lse.ac.uk/media-and-communications/assets/documents/research/projects/childrens-privacy-online/Evidence-review.pdf.

Maqsood, S., Biddle, R., Maqsood, S., & Chiasson, S. (2018). An exploratory study of children's online password behaviours. Proceedings of the 17th ACM Conference on Interaction Design and Children. doi: www.doi.org/10.1145/3202185.3210772

Ratakonda, D. K., French, T., & Fails, J. A. (2019). My Name Is My Password. Proceedings of the 18th ACM International Conference on Interaction Design and Children. www.doi.org/10.1145/3311927.3325327.