A key anyone can use
Arjun’s phone used to be Appa’s. It has a crack across one corner, and now it is his.
On Tuesday a message came from a number he did not know. “Congratulations, Arjun! You have won a cricket bat. We have sent you a code. Send it back to claim your prize.”
At the same moment a second message came. It held six digits. It said the code would open his chat account on a new phone.
Arjun likes to ask what a thing really does. So he asked. What would happen if he sent the code back?
The idea
There was no cricket bat. The message was built to do one thing: get the code.
Arjun had asked the question that people who keep things safe ask about everything.
The idea
How would this be abused?
To abuse a thing is to use it for harm, in a way it was not made for.
A code is made to let you in. Abused, it lets somebody else in.
So the question is not whether a thing is bad. It is how somebody who wanted to do harm would use it.
There are two ways to say who you are.
The first is to tell. My name is Arjun. I go to this school. This is my number. That is identification. Lots of people know those things.
The second is to prove. You show something only you hold, like the code that came to your phone. That is authentication.
A stranger can know all about you and still not get in. The door does not ask what he knows. It asks for the code.
At the school gate, Anand uncle knows every face. He waves Arjun in, and he would stop a stranger.
A code is not like that. It has no eyes. The door cannot see who is typing. It only checks that the code is right, and then it says “hi, Arjun” to whoever typed it.
That is why a code is never shared, not even with somebody kind. Whoever holds it is you, as far as the door can tell.
What people say instead
At dinner Arjun told Ajji about the cricket bat.
Ajji laughed and patted his hand. “Who would bother with an old woman like me, kanna? These thieves want rich people with big houses.”
Arjun did not argue. It is what most people picture.
But that message was not written for one person. It went out to thousands of phones at once, Ajji’s too. The sender picks nobody. He waits for the few who send the code back.
Two more
Two days later Ajji’s phone rang. The man said he was from her bank. He knew her name, her bank and the last four digits of her card.
“A code will come to you now, madam. I will call back for it.”
The code came. Ajji’s glasses were downstairs, so she gave Arjun the phone. “Read it to me, kanna.”
Arjun read out the words, not the digits. “Never share this code. Your bank will never ask for it.”
When the man called back, Ajji said no and put the phone down.
That week Appa got a message too. “Your electricity will be cut tonight. Pay the bill at this link.”
The page looked exactly like the real one. It asked for his card number. Then it asked for the code his bank had just sent.
Appa stopped. “Why would a bill page need my bank’s code?” He closed it.
Spot it
Two messages. Ask each one Arjun’s question.
1
A new number: “Arjun, it’s Kiran. I lost my phone. A code came to you by mistake. Please send it to me.” Where would the code go? What would it open?
2
A message says a parcel for Amma is stuck. To release it, she must share the code her bank just sent. Where would the code go? What would it open?
Arjun keeps a notebook with two columns. What a thing says it does. What it really does. This week the second column got longer.
One code, one door
A cricket bat, a bank call, a bill. Each message was built to get one code.
The two you were asked about work the same way. The code that came “by mistake” was Arjun’s own. It would open his chat account for whoever held it. The parcel code came from Amma’s bank. It would open her bank account, not a parcel.
So a code stays with the person it came to. It stays there even when the one asking sounds kind, or knows your name.
This week, at home
With somebody at home, find one message on their phone that brought a code. Read its words together, not the digits. What does it say never to do?
Arjun thought of Ajja’s story about a teacher called Dignaga, long ago. When somebody was sure of a thing, he asked: what kind of thing is this, really? The caller knew Ajji’s name, her bank and four digits. All three were true. But all three were things about Ajji. The door wants a different kind of thing. Knowing about you is not the same kind of thing as being you.
The name
People who keep things safe call Arjun’s question a security mindset.
Security is keeping what is yours safe. A mindset is a habit of thinking that you carry everywhere.
So a security mindset is the habit of asking, about anything new, how it would be abused. It is not being scared of every message. It is one question, asked before you answer.
Every evening Ajji locks the front gate with the big iron key. The lock does not know Arjun from a stranger. It only knows the key.
Where you will see this next
Next chapter: somebody decided how each of these doors works.