Before class · do this at home
Watch, read, then come
CS50x 2026 · Week cyber: CS50 Cybersecurity (lectures 0–1: Securing Accounts, Securing Data) by David J. Malan. Watch the lecture on YouTube (you are also enrolled on edX), read the notes, skim the slides. Our lecture builds on it instead of repeating it.
Learning objectives
By the end of this week you can:
- 1 Trace a packet from your laptop to a server: Wi-Fi, router, ISP, backbone, DNS, TCP handshake, HTTP, TLS.
- 2 Describe a CPU, RAM, storage and the memory hierarchy, and relate it to the stack and heap of week 6.
- 3 Explain password hashing and salting, and why a leaked hash is still a problem.
- 4 Explain symmetric and public-key encryption at the level of 'what is shared and what is secret', and what HTTPS protects.
- 5 Recognize phishing, SQL injection, buffer overflows and weak defaults as the same failure: trusting input.
- 6 Apply basic hygiene: password managers, 2FA, updates, least privilege.
★ the wow moment
Your Wi-Fi password never leaves your laptop, and the server can still verify you know it.
That sounds impossible, and it is the everyday magic of cryptography: hashing lets a server check a password it never stores, and public-key encryption lets two strangers agree on a secret while the whole Internet listens. Both come from mathematics you can read in an afternoon, and both are why online banking exists at all.
Topics
- Hardware: CPU, cores and clock speed, RAM versus SSD, the memory hierarchy (registers, cache, RAM, disk) and why the stack and heap of week 6 live in RAM.
- Networks: packets, IP addresses, routers and the path across the Internet; DNS; TCP versus UDP; ports; a
traceroutelive. - The web layer: HTTP again, cookies and sessions, what a server and a CDN are.
- Securing accounts: password entropy, brute force and dictionary attacks, hashing and salting, password managers, 2FA, passkeys.
- Securing data: symmetric encryption, public-key encryption, digital signatures, HTTPS and certificates, end-to-end encryption.
- Attacks you can now explain: phishing, SQL injection, buffer overflow, cross-site scripting, and the one rule behind all defenses: never trust input.
Full notes are published before the lecture. The lab, Lab 11: Hash, Crack, Defend, hashes passwords in Python, cracks weak ones, adds salt, and checks a password against the Have I Been Pwned API without sending it.
In industry
-
Security is now everyone's job
The bugs in weeks 4 (buffer overflow), 6 (use-after-free) and 11 (SQL injection) are the top of every vulnerability list. Companies pay bounties in the hundreds of thousands of dollars for them.
-
The cloud is other people's computers
AWS, Azure and Google Cloud are data centers full of the same CPUs and RAM you learn about, rented by the second. Knowing the hardware is knowing what you pay for.
-
HTTPS everywhere
Since Let's Encrypt made certificates free (2015), the web went from mostly unencrypted to over 95% encrypted. The padlock is TLS, built on the public-key ideas of this week.
-
Phishing beats technology
Most breaches start with a person, not a bug. The 2FA you turn on today is the single most effective defense there is.
Lab 11: Hash, Crack, Defend
Hash passwords, crack the weak ones with a dictionary attack, add salt so the attack stops working, and check a password against known breaches without ever sending it. Python · due Fri, Dec 18 · 23:59 · 10 points · opens in week 13 Open lab instructions →Go deeper
- CS50's Introduction to Cybersecurity · Free, non-technical, excellent.
- Stanford CS101: The Internet
- How does HTTPS work? (illustrated)
- Have I Been Pwned · Check whether your email appears in a known breach.
Tags:InternetTCP/IPDNSHTTPHTTPSTLSCPURAMhashingsaltingencryptionpublic keyphishing2FA