A key anyone can use
Arjun’s phone used to be Appa’s. It has a crack across one corner, and now it is his.
On Tuesday a message came from a number he did not know. “Congratulations, Arjun! You have won a cricket bat. We have sent you a code. Send it back to claim your prize.”
At the same moment a second message came. It held six digits. It said the code would open his chat account on a new phone.
Arjun likes to ask what a thing really does. So he asked. What would happen if he sent the code back?
The idea
There was no cricket bat. The message was built to do one thing: get the code.
Arjun had asked the question that people who keep things safe ask about everything.
The idea
How would this be abused?
To abuse a thing is to use it for harm, in a way it was not made for.
A code is made to let you in. Abused, it lets somebody else in.
So the question is not whether a thing is bad. It is how somebody who wanted to do harm would use it.
There are two ways to say who you are.
The first is to tell. My name is Arjun. I go to this school. This is my number. That is identification. Lots of people know those things.
The second is to prove. You show something only you hold, like the code that came to your phone. That is authentication.
A stranger can know all about you and still not get in. The door does not ask what he knows. It asks for the code.
At the school gate, Anand uncle knows every face. He waves Arjun in, and he would stop a stranger.
A code is not like that. It has no eyes. The door cannot see who is typing. It only checks that the code is right, and then it says “hi, Arjun” to whoever typed it.
That is why a code is never shared, not even with somebody kind. Whoever holds it is you, as far as the door can tell.
What people say instead
At dinner Arjun told Ajji about the cricket bat.
Ajji laughed and patted his hand. “Who would bother with an old woman like me, kanna? These thieves want rich people with big houses.”
Arjun did not argue. It is what most people picture.
But that message was not written for one person. It went out to thousands of phones at once, Ajji’s too. The sender picks nobody. He waits for the few who send the code back.
Two more
Two days later Ajji’s phone rang. The man said he was from her bank. He knew her name, her bank and the last four digits of her card.
“A code will come to you now, madam. I will call back for it.”
The code came. Ajji’s glasses were downstairs, so she gave Arjun the phone. “Read it to me, kanna.”
Arjun read out the words, not the digits. “Never share this code. Your bank will never ask for it.”
When the man called back, Ajji said no and put the phone down.
That week Appa got a message too. “Your electricity will be cut tonight. Pay the bill at this link.”
The page looked exactly like the real one. It asked for his card number. Then it asked for the code his bank had just sent.
Appa stopped. “Why would a bill page need my bank’s code?” He closed it.
Three doors, one question
A cricket bat, a bank call, a bill page: three different doors, three messages built three different ways. Arjun asked the same question of each one. Where would the code go, and what would it open? Each time, the code was the one thing the message was really built to carry away, however kind or urgent the words around it sounded. None of the three had asked for his name first, only for the code.
A tally, kept on the inside cover
He started keeping count: one mark for every message that asked for a code, whoever it claimed to be, one more beside it for how the code was meant to travel, and a third for whether he had trusted it at first. By the end of the week, the tally had a fourth column too: what he had decided to do about it, and a fifth for whether he had been right.
What Appa asked instead
Appa did not ask whether the message looked real. He asked a different question: why would this page, of all pages, need the one number his bank had only just sent him. The link had a name, a logo, even the right colours. None of that answered his question. Only the code’s path did. A real bill, he found out later, never needs that number at all, because the biller is never the one holding it.
One line Arjun wrote down
“If a message needs my code to do what it says, the message is doing someone else’s errand, not mine.” He kept that line on the first page of the notebook, above the two columns.
Appa’s other habit
Appa checked one more thing before he ever typed a code anywhere: whether he had asked for the message at all. A bill he was expecting could wait an hour. One he was not expecting got the same question every time, however urgent it sounded. He taught Arjun to ask it too, before anything else.
What stayed the same, each time
A name Arjun knew, a reason to hurry, a thing only he could give. The three messages never matched on anything else, but they always matched on those.
Spot it
Two messages. Ask each one Arjun’s question.
1
A new number: “Arjun, it’s Kiran. I lost my phone. A code came to you by mistake. Please send it to me.” Where would the code go? What would it open?
2
A message says a parcel for Amma is stuck. To release it, she must share the code her bank just sent. Where would the code go? What would it open?
Arjun keeps a notebook with two columns. What a thing says it does. What it really does. This week the second column got longer.
One code, one door
A cricket bat, a bank call, a bill. Each message was built to get one code.
The two you were asked about work the same way. The code that came “by mistake” was Arjun’s own. It would open his chat account for whoever held it. The parcel code came from Amma’s bank. It would open her bank account, not a parcel.
So a code stays with the person it came to. It stays there even when the one asking sounds kind, or knows your name.
Arjun thought of Ajja’s story about a teacher called Dignaga, long ago. When somebody was sure of a thing, he asked: what kind of thing is this, really? The caller knew Ajji’s name, her bank and four digits. All three were true. But all three were things about Ajji. The door wants a different kind of thing. Knowing about you is not the same kind of thing as being you.
The name
People who keep things safe call Arjun’s question a security mindset.
Security is keeping what is yours safe. A mindset is a habit of thinking that you carry everywhere.
So a security mindset is the habit of asking, about anything new, how it would be abused. It is not being scared of every message. It is one question, asked before you answer.
Every evening Ajji locks the front gate with the big iron key. The lock does not know Arjun from a stranger. It only knows the key.
This week, at home
With somebody at home, find one message on their phone that brought a code. Read its words together, not the digits. What does it say never to do?
Where you will see this next
Next chapter: somebody decided how each of these doors works.