IDEALIT Passport
Menu

Passport search

Find a lesson or fix

Type at least two characters.

    Browse help by symptomBrowse all references
    How to start
    Public course previewThis is not your assigned passport. No identity, answers, or completion progress are stored here.How to start your passport
    Guided lesson
    02 / 04About 25 minuteschanges sign-in security

    Protect Accounts And Secrets

    Decide which sign-in information must stay secret. Keep or set up the required account protections, then answer fictional scenarios. Do not submit any secret.

    Where you will workOn this web page
    1. 1Understand
    2. 2Try it yourself
    3. 3Check and submit

    Before you start#

    An account is your personal identity at a service. A credential proves access; keep its secret part private. A password manager encrypts unique passwords and recovery information. Two-factor authentication (2FA) asks for another proof after a password. Keep an approved setup that already works; the steps below explain missing setup.

    Item Boundary
    Password, token, recovery code Approved private secret store; never a public record
    SSH private key Stays private on its computer
    SSH public key (the .pub file) May be given to the named service
    Example settings file Setting names and fictional values only

    A token authorizes service access. An SSH key pair separates the public key from the private proof. A passphrase is a password protecting the private-key file; it does not make the file safe to share. Git's ignore rule prevents recording selected files; it is not encryption or permission to disclose their contents.

    A fictional token has entered a public commit. Would deleting that file stop someone using the token? Decide the containment action before the explanation.

    Why deleting the file is insufficient

    Copies and history can retain it. The service must disable or replace the exposed credential. Preserve evidence with credentials and private details removed and use the private reporting route. This is a fictional decision; do not disable a healthy account to practise.

    Keep private keys private even when protected by a passphrase. Use fictional values in example files.

    Start the practice

    Practice

    Work through the decisions

    Follow in order

    Steps

    Keep working approved protections. Set up only missing safeguards, then answer fictional scenarios. Publish no credential or recovery code.

    1. 01

      Prepare an approved password manager

      Read and answer on this web page

      A password manager is an encrypted application for storing unique passwords and recovery information. Keep a working approved password manager if you already use one. Otherwise, on a personal computer follow ETH's KeePass guidance and use KeePassXC; on an ETH-managed device ask the responsible IT support before installing software. Do not store ETH passwords in an unapproved cloud-hosted vault.

      Read the ETH KeePass guidance

      Look forYou have an approved private place for unique passwords and recovery codes, or you have requested installation help for a managed device.

      Explanation and help
      What this means
      Enable GitHub two-factor authentication.
      Safe recovery
      Do not create plain-text password notes or reuse a password while waiting for support.
    2. 02

      Enable GitHub two-factor authentication

      Read and answer on this web page

      Two-factor authentication (2FA) asks for a second proof after your password. Open your personal GitHub password and authentication settings, enable 2FA, configure the recovery methods offered by GitHub, and store the recovery codes in the approved private location from the previous step. Never upload a recovery code to the Passport.

      Open GitHub authentication settingsRead GitHub recovery-method guidance

      Look forGitHub reports that two-factor authentication is enabled and the recovery-code view is closed after secure storage.

      Explanation and help
      What this means
      Continue to file-based secrets.
      Safe recovery
      Complete GitHub account recovery privately; never submit a recovery code as evidence.
    3. 03

      Keep secrets outside Git

      Read and answer on this web page

      Use the secret/public boundary above. Ignored means Git is configured not to record a file, not that the file is safe to share. An example environment file names settings without their real values. Keep working protections; do not revoke a healthy credential for this exercise.

      Look forNo secret value is inside any file that Git is asked to record or share.

      Explanation and help
      What this means
      Continue to the exposure procedure.
      Safe recovery
      Remove the value from the project files and any staged Git change, then rotate it if it may have been exposed.
    4. 04

      Know the first response to exposure

      Read and answer on this web page

      For the fictional exposure, decide what stops further credential use. In a real exposure, follow the private incident procedure immediately: revoke (disable) or rotate (replace) the affected credential, preserve evidence with credentials and private details removed and report. Deleting a message or Git version does not contain it. Do not perform a real revocation for the fictional question.

      Open the incident and help procedure

      Look forYou can name the containment action for the fictional credential and the private reporting route.

      Explanation and help
      What this means
      Complete the fictional scenarios without performing a real revocation.
      Safe recovery
      Stop using the affected account. Use the linked incident procedure to contact your supervisor or lab IT, ETH cyber incident support, or ETH High-Performance Computing (HPC) support, according to the affected system.
    5. 05

      Complete the scenarios

      Read and answer on this web page

      Answer every question below using the rules above. Treat every credential question as safety-critical.

      Look forAll credential-critical answers are correct.

      Explanation and help
      What this means
      Run Check my work.
      Safe recovery
      Read the feedback and retry; do not guess around a secret-handling rule.

    Finish the lesson

    Check and submit

    Answer these 3 questions, then confirm the work you checked.

    Every answer must be correct. Completion appears after the automatic GitHub check passes.

    01A token may have been exposed. What comes first?Safety-critical
    02When a service asks for an SSH key, which file may be shared?Safety-critical
    03How should you verify GitHub two-factor authentication without exposing a secret?Safety-critical
    Before submitting
    Open my real passport first

    You can check sample answers here. Open your local Passport to check your practice files and submit the lesson.

    Preview onlyYou can try the questions here. This page does not store or submit your answers.
    Need help?Open recovery steps and AI-review guidance

    If Blocked#

    If you suspect a real exposure, stop the exercise and follow Incidents and getting help. Do not post the secret in a GitHub issue or ask an AI tool to inspect it.

    Useful references:

    Understand Before Accepting AI Output#

    An AI-generated cleanup command may destroy evidence without revoking the credential. Verify the issuing service, scope, and incident path yourself.