login complete guide parents students essential steps security

Troubleshooting Common Login Issues for Parents and Students

Frequently Encountered Login Errors and Resolution Steps

Note: Error messages often appear in bold red text at the top or center of the login page, accompanied by a small error icon (⚠️ or ❌).

• Error: "Invalid username or password"
  1. Verify the case sensitivity of the username (e.g., "john.doe" vs. "John.Doe"). Many systems treat usernames as case-sensitive.
  2. Check for hidden characters (e.g., spaces, symbols) in the username or password field. Use the "Show Password" toggle if available to confirm.
  3. Ensure the caps lock is off and the correct keyboard layout (e.g., QWERTY vs. AZERTY) is selected.
  4. If using a school-provided account, confirm the username format (e.g., "[studentID]@school.edu" or "[firstlast]").
  5. Attempt a hard refresh (Ctrl + F5 or Cmd + Shift + R) to clear cached login data.
• Error: "Session expired" or "Timeout occurred"
  1. Close all browser tabs and reopen the login page. Idle sessions may expire due to inactivity.
  2. Check browser settings for extensions (e.g., ad blockers, VPNs) that may interfere with session cookies.
  3. Try a different browser (e.g., Chrome, Firefox, Edge) or incognito mode to rule out cache/cookie conflicts.
  4. If using a mobile device, ensure Wi-Fi/cellular data is stable and not throttling connections.
  5. Contact IT support if the issue persists, as this may indicate a server-side timeout or load balancing issue.
• Error: "Account locked due to too many failed attempts"
  1. Wait 15–30 minutes before retrying, as most systems impose a temporary lockout.
  2. If locked out, use the "Forgot Password?" link to reset credentials via email/SMS (steps detailed below).
  3. For school-managed accounts, IT support may need to unlock the account manually. Provide your student/parent ID and proof of identity (e.g., school email domain).
• Error: "Browser not supported" or "Unsupported device"
  1. Update the browser to the latest stable version (e.g., Chrome 120+, Firefox 121+).
  2. Disable browser extensions (e.g., Grammarly, uBlock Origin) temporarily to test compatibility.
  3. Use desktop mode on mobile devices or switch to a laptop/tablet if the platform restricts mobile logins.
  4. Check the platform’s system requirements for supported browsers (e.g., Chrome, Firefox, Safari) and OS versions (Windows 10/11, macOS 12+).

Password Recovery Procedures for Forgotten Credentials

Important: Password recovery links are single-use and expire after 10–30 minutes for security. Save the new password in a secure password manager (e.g., Bitwarden, 1Password).

• Step-by-Step: Reset via Email/SMS
  1. On the login page, click "Forgot Password?" or "Trouble Logging In?" (location varies by platform).
  2. Enter the registered email address or phone number linked to the account. For school accounts, this is typically the official school email (e.g., "[studentID]@school.edu").
  3. Check the inbox (including spam/junk folders) for a recovery email with a time-limited link (e.g., "Reset your password in 20 minutes").
  4. Click the link and follow prompts to create a new password (minimum 8 characters, including uppercase, lowercase, and a number).
  5. Log in with the new credentials and update recovery options (e.g., add a personal email or phone number).
• Alternative: Recovery Without Access to Registered Email
  Users unable to access their recovery email must contact IT support with the following:
  1. Full name and date of birth (for student accounts) or parent/guardian details (for parent portals).
  2. Student ID or enrollment records (e.g., report card access, previous login history).
  3. Proof of identity (e.g., scanned ID, school-issued email confirmation).
  4. IT may verify identity via a secure phone call or in-person authentication before resetting the password.
• Security Recommendations After Recovery
  • Enable Two-Factor Authentication (2FA) if available (e.g., SMS codes, authenticator apps).
  • Avoid reusing passwords from other accounts (e.g., social media, banking).
  • Use a password manager to store credentials securely.

Role of IT Support in Resolving Login Issues

Note: IT support may require 24–48 hours to resolve complex issues (e.g., account recovery for minors, security breaches).

• Initial Support Triage
  • Verify the user’s identity via predefined questions (e.g., "What was your last successful login date?").
  • Check for known system issues (e.g., server downtime, scheduled maintenance) via internal dashboards.
  • Provide self-service guides (e.g., password reset links, browser compatibility fixes) before escalation.
• Escalation Paths for Complex Issues

  Issue Type	IT Response	User Action Required
  Account Hijacking/Suspicious Activity	Reset password, enable 2FA, and monitor for further unauthorized access. May involve security team review.	Submit a security incident report with timestamps of suspicious logins.
  Account Lockout (Manual Unlock Needed)	Unlock account via admin console (requires supervisor approval for parent accounts).	Provide student ID, parent legal name, and contact details for verification.
  System-Wide Outage	Post updates on the school’s status page or parent portal announcement.	Monitor notifications and avoid repeated login attempts.
  Policy Violation (e.g., Shared Account)	Issue a warning or suspend access until compliance Role-Based Login Access for Parents and Students Educational platforms implement role-based access control (RBAC) to ensure secure, granular permissions for parents and students, aligning with institutional policies and privacy regulations. This system differentiates access levels through technical methods such as user roles, session management, and API-driven permission checks, while also enabling customizable feature visibility. Below are the mechanisms, exclusive features, and administrative processes governing parent-student access. Technical Implementation of Role-Based Access Control Role-based access control (RBAC) in educational platforms relies on three core components: role assignment, permission matrices, and session validation. Platforms typically assign roles (e.g., Parent, Student, Administrator) during account creation or via manual approval workflows. Each role maps to a predefined set of permissions, stored in a permission matrix that dictates access to features like grade reports, attendance logs, or assignment submissions. Technical execution involves: Database-level segregation: Separate tables or schemas for parent/student data, with foreign key relationships linking accounts (e.g., `parent_id` in the `students` table). API gateways: Role-based routing to restrict endpoints (e.g., `/api/grades` only accessible to parents with `view_grades` permission). Session tokens: JWT or OAuth 2.0 tokens embedded with role claims, validated on each request. Attribute-based extensions: Dynamic permissions (e.g., restricting a parent’s access to a specific student’s data via `student_id` claims). Example: A platform might use the following role-permission mapping in a JSON Web Token (JWT) payload: ```json { "sub": "parent@example.com", "roles": ["parent"], "permissions": ["view_grades", "edit_contact_info", "receive_alerts"], "linked_students": ["std_12345"] } ``` Exclusive Features for Parents and Students Platforms design role-specific functionalities to streamline communication and engagement. Below is a comparative table of common features, categorized by user type: Parent-Exclusive Features Student-Exclusive Features Grade and Progress Reports: Real-time access to academic performance, including standardized test scores and teacher comments. Attendance Alerts: Automated notifications for tardiness or absences, with configurable thresholds (e.g., 3 unexcused absences). Communication Tools: Secure messaging with teachers (e.g., for IEP discussions). Request meetings via calendar integrations (e.g., Google Calendar). Financial Management: View tuition balances, payment histories, and fee schedules. Emergency Contacts: Update or designate backup contacts for school communications. Assignment Submissions: Upload documents, record videos, or submit links via integrated tools (e.g., Google Drive, Turnitin). Class Resources: Access syllabi, lecture notes, and supplementary materials (e.g., Khan Academy links). Gradebook Access: View personal grades, rubrics, and feedback without parent interference. Communication Channels: Peer collaboration forums (moderated by teachers). Direct messaging with classmates (with optional parent visibility toggles). Self-Service Tools: Request extensions for assignments. Schedule tutoring sessions via platform integrations. Note: Some features may overlap (e.g., both parents and students can view school announcements), but permissions are enforced at the data granularity level (e.g., parents see all students’ grades in their household; students see only their own). Granting and Removing Parent Access to Student Accounts Parent access is typically managed through a consent-based workflow to comply with laws like FERPA (Family Educational Rights and Privacy Act) or GDPR. The process involves: 1. Initial Request: The student (or guardian) submits a request via the platform’s admin portal or a dedicated form. 2. Verification: The school verifies the parent’s identity (e.g., government-issued ID upload) and relationship to the student (e.g., birth certificate or court-ordered custody documents). 3. Role Assignment: The system generates a parent account linked to the student’s record, with permissions configured via the RBAC matrix. 4. Notification: The student receives an email confirming the parent’s access, including a summary of shared data (e.g., grades, attendance). Audit Trails: All access changes are logged with timestamps, user IDs, and IP addresses for compliance. Example log entry: ``` { "action": "parent_access_granted", "student_id": "std_12345", "parent_email": "parent@example.com", "timestamp": "2023-10-15T14:30:00Z", "initiated_by": "admin_789", "ip_address": "192.0.2.1" } ``` Removal Process: Parents can revoke their own access via the account settings, or schools may terminate access if consent expires (e.g., annual reauthorization) or legal requirements change (e.g., divorce proceedings). The student is notified of the change, and all shared data access is immediately revoked. Email Notification Template for Parent Credential Updates When a student’s login credentials are updated (e.g., password reset or new parent added), platforms send a standardized email to ensure transparency. Below is a template adhering to FERPA/GDPR compliance, including mandatory disclaimers: ```html Subject: Important: Update to Your Child’s [Platform Name] Account Access Dear [Parent's Name], We have detected an update to the login credentials or access permissions for your child’s account, [Student’s Name], associated with [School Name]. Below are the details of the change: Change Type: [Password Reset / New Parent Added / Access Revoked] Student Name: [Student’s Full Name] Student ID: [std_XXXX] Date of Change: [YYYY-MM-DD] Initiated By: [Student / Parent / School Administrator] What This Means for You: If this was a password reset, your child’s login details have been updated. Ensure they use the new credentials to access their account. If new access was granted, another parent/guardian ([New Parent’s Name]) has been authorized to view specific account details (e.g., grades, attendance). You can review shared permissions in the [Parent Portal]. If access was revoked, you no longer have permission to view the student’s data. Contact [School Contact] if this was unintended. Security Reminder: Never share your login credentials with anyone. If you suspect unauthorized access, report it immediately to [School IT Support Email] or call [Phone Number]. Need Help? Parent Portal Login [School Contact]: [Name] | [Email] | [Phone] Privacy Policy Link Sincerely, [Platform Name] Support Team [School Name] [Physical Address] [Date] ``` Disclaimers Included: 1. Data Scope: Explicitly states which data types are shared (e.g., "grades, attendance"). 2. Actionable Steps: Directs parents to verify changes or contact support. 3. Legal Compliance: References FERPA/GDPR and provides contact details for disputes. 4. Security Warnings: Emphasizes credential protection and reporting procedures. Encoding Note: Ensure the email template is saved as UTF-8 to support special characters (e.g., accented names, emojis in subject lines). Integrating Login Systems with Educational Tools Educational institutions increasingly rely on interconnected digital platforms to streamline communication, resource access, and administrative tasks. A seamless login integration ensures parents and students can navigate learning management systems (LMS), library databases, payment portals, and other tools without redundant credential management. However, improper synchronization or credential reuse introduces security vulnerabilities, while inefficient configurations may lead to user frustration. This section explores the technical and strategic aspects of credential synchronization, third-party vs. custom authentication solutions, and the implementation of single sign-on (SSO) for unified access. A unified login dashboard design is also outlined to optimize usability across school ecosystems. Credential Synchronization Across Educational Platforms Login credentials for parents and students often span multiple systems, including LMS (e.g., Canvas, Moodle), library management tools (e.g., Follett Destiny), and payment gateways (e.g., SchoolPay). Synchronization ensures a single set of credentials grants access to all authorized services, reducing password fatigue and improving security through centralized management. Key synchronization mechanisms include: Directory Services Integration: Schools leverage Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) to store and authenticate user credentials centrally. For example, a student’s AD account can auto-provision access to the LMS and library system upon enrollment. API-Based Sync: Platforms use RESTful APIs to exchange user data (e.g., usernames, roles) between systems. Schools must configure API keys and OAuth 2.0 tokens to enable secure, real-time updates. Identity Providers (IdP): Tools like Microsoft Entra ID or Okta act as intermediaries, validating credentials once and propagating access tokens across integrated services. Risks of Credential Reuse While synchronization improves convenience, relying on reused passwords across platforms exposes institutions to credential stuffing attacks. A 2022 study by Verizon’s Data Breach Investigations Report found that 80% of breaches involved stolen or weak credentials. Schools should enforce: Unique Credentials: Require distinct passwords for each platform or use multi-factor authentication (MFA) for critical systems. Password Policies: Enforce complexity rules (e.g., 12+ characters, special symbols) and regular rotations. Credential Monitoring: Deploy tools like Have I Been Pwned APIs to alert users if their credentials appear in data breaches. Comparison of Third-Party Login Providers vs. Custom Solutions Schools must weigh the trade-offs between third-party identity providers (IdPs) and custom-built authentication systems. The choice impacts security, cost, and scalability. Third-Party Providers (Google, Microsoft, Okta) "Third-party IdPs reduce development overhead but may introduce vendor lock-in and compliance risks." Aspect Google Workspace Microsoft Entra ID (Azure AD) Okta Ease of Integration Seamless with G Suite apps; limited to Google ecosystem. Broad compatibility with Windows/Linux; deep Microsoft 365 integration. Universal support; plugins for 7,000+ apps. Security Features MFA, conditional access, phishing protection. Advanced threat detection, PIM (Privileged Identity Management). Granular policy controls, adaptive MFA. Cost Free for education (limited users); paid tiers for advanced features. Free tier for basic AD; enterprise plans start at $6/user/month. Starts at $5/user/month; custom pricing for large institutions. Data Privacy Subject to U.S. jurisdiction (FERPA compliance requires add-ons). Complies with FERPA/School Bus Safety Act; data stored in user’s region. SOC 2 Type II certified; customizable data residency. Customization Limited branding; restricted to Google’s UI. Moderate branding; PowerShell scripting for automation. Highly customizable; supports SAML 2.0/OIDC. Custom Solutions Schools opting for in-house systems (e.g., self-hosted LDAP or open-source IdPs like Keycloak) gain: Full Control: Tailored workflows, data storage, and compliance with local regulations (e.g., GDPR for international schools). Cost Savings: Avoid per-user licensing fees (though initial setup costs are higher). Challenges: Requires IT expertise for maintenance, updates, and security patches. Lack of built-in support for third-party apps (e.g., Zoom, Google Classroom). Higher risk of misconfigurations leading to breaches. Recommendation: Hybrid approaches (e.g., using Microsoft Entra ID for core systems and custom scripts for niche tools) balance flexibility and security. Configuring Single Sign-On (SSO) for School Ecosystems SSO eliminates the need for multiple logins by enabling one set of credentials to access all integrated services. Schools typically implement SSO via SAML 2.0 or OIDC (OpenID Connect). Below are the steps for administrators and end-users. Administrator Configuration Steps 1. Select an Identity Provider (IdP): Choose between third-party (e.g., Microsoft Entra ID) or self-hosted (e.g., Keycloak). Ensure the IdP supports the required protocols (SAML/OIDC) for all integrated services. 2. Register Applications in the IdP: For Microsoft Entra ID: Navigate to Azure Portal > Azure Active Directory > Enterprise Applications > New Application. Select "Non-gallery application" and enter a display name (e.g., "School LMS"). Configure SAML-based SSO and upload the service provider’s metadata XML file (provided by the LMS vendor). For Okta: Go to Applications > Create App Integration > SAML 2.0. Input the LMS’s Audience URI (Entity ID) and ACS URL (Assertion Consumer Service). 3. Configure Service Provider (SP) Settings: Obtain the IdP’s metadata URL or download the XML configuration file. Upload this to the SP (e.g., Canvas LMS admin panel under Settings > SSO). Map user attributes (e.g., `email`, `givenName`) to ensure correct role-based access. 4. Test and Enforce SSO: Use the IdP’s test account to simulate login and verify attribute mapping. Disable legacy authentication methods (e.g., direct LMS logins) post-deployment. End-User Workflow 1. Initial Login: Users access any SSO-enabled service (e.g., LMS homepage). They are redirected to the IdP login page (e.g., school.microsoft.com). 2. Authentication: Users enter credentials once; the IdP issues a token containing user attributes. 3. Access Granting: The token is sent to the SP, which validates it and grants access without re-authentication. 4. Session Management: Users remain logged in across services until the session expires (configurable by admins, typically 8–24 hours). Common SSO Protocols SAML 2.0: Industry standard for enterprise SSO; used by Canvas, Blackboard, and Follett. OIDC: Modern alternative with JSON-based tokens; preferred for cloud-native apps (e.g., Google Classroom). LDAP: Legacy protocol for directory-based authentication (less secure; avoid for new deployments). Designing a Unified Login Dashboard for Schools A centralized dashboard aggregates access to all school-related services, reducing cognitive load for users. Below is a visual layout description with priority features highlighted. Dashboard Structure 1. Header Bar (Top Priority): School Logo (left-aligned) and Search Bar (for quick access to resources). User Profile Dropdown (right-aligned) displaying: Name, role (Parent/Student), and quick links (e.g., "My Grades," "Messages"). Logout Button (prominently placed). 2. Primary Navigation Menu (Horizontal or Vertical): Role-Based Tabs: Students: "Courses," "Library," "Payment Portal," "Calendar." Parents: "Student Dashboard," "Teacher Communication," "Billing," "Events." Admin Tab (hidden unless user has elevated permissions): "User Management," "SSO Settings," "Reports." 3. Quick-Access Widgets (Middle Section): Upcoming Deadlines: Calendar widget showing assignments, payments, and events. Announcements: Feed of school-wide notifications (e.g., "Back-to-School Fair – Sept 15"). Favorite Apps: Customizable tiles for frequently used tools (e.g., Google Classroom, Khan Academy). 4. Service Legal and Ethical Considerations for Login Systems in Educational Platforms Educational institutions and digital platforms handling student and parent login data must adhere to strict legal and ethical frameworks to ensure compliance with data privacy laws while maintaining trust. Non-compliance can result in severe penalties, including fines, legal action, and reputational damage. This section examines the regulatory landscape, ethical challenges in login security, and structured compliance timelines to guide schools and administrators in implementing secure, legally sound login systems. The protection of student and parent data is governed by a combination of federal, state, and international laws, each with specific requirements for data collection, storage, access, and breach notification. Ethical considerations further complicate login security, particularly when balancing user convenience with robust protection against unauthorized access. Below, the legal obligations, privacy policy best practices, ethical dilemmas, and compliance timelines are outlined to provide a comprehensive framework for responsible login system management. Data Privacy Laws Governing Student and Parent Login Data Educational institutions and digital platforms processing login credentials for minors and their families must comply with multiple data privacy laws, including Children’s Online Privacy Protection Act (COPPA), Family Educational Rights and Privacy Act (FERPA), General Data Protection Regulation (GDPR), and state-specific laws such as the California Consumer Privacy Act (CCPA). Each law imposes distinct obligations regarding data collection, consent, storage, and breach disclosure. Key Legal Requirements: COPPA (U.S.): Applies to online services collecting data from children under 13. Login systems must obtain verifiable parental consent before collecting or storing personal information, including usernames, passwords, and biometric data. Schools must also provide parents with access to and deletion rights over their child’s data. FERPA (U.S.): Protects education records, including login credentials stored in school-managed systems. Schools must ensure role-based access controls (e.g., parents can only view their child’s data) and disclose breaches to affected parties within no more than 30 days. GDPR (EU/International): Applies to institutions processing data of EU residents, requiring explicit consent for data storage, right to access/modify/delete data, and data minimization (collecting only necessary login information). Breaches must be reported to authorities within 72 hours. CCPA/CPRA (California): Grants rights to opt-out of data sales, access personal information, and request deletion. Schools must disclose categories of collected login data and allow parents/students to exercise these rights. Penalties for Non-Compliance: Non-adherence to these laws can result in: COPPA: Fines up to $43,280 per violation (adjusted annually) and potential lawsuits. FERPA: Loss of federal funding, legal action, and damage to institutional reputation. GDPR: Fines up to 4% of annual global revenue or €20 million, whichever is higher. CCPA: Fines up to $7,500 per intentional violation and potential class-action lawsuits. Privacy Policy Script for Login Data Handling A well-drafted privacy policy clarifies how login data is collected, used, stored, and protected, ensuring transparency and legal compliance. Below is a structured template for educational platforms, with key terms bolded for emphasis. Privacy Policy for Login Data At [Institution Name], we prioritize the security and confidentiality of login credentials provided by parents and students. This policy explains how we handle such data in compliance with COPPA, FERPA, GDPR, and applicable state laws. 1. Data Collection and Purpose We collect login credentials (usernames, passwords, and multi-factor authentication tokens) solely to: Authenticate access to educational platforms. Ensure role-based permissions (e.g., parents access only their child’s data). Comply with legal obligations (e.g., FERPA record-keeping). 2. Data Storage and Security Login data is encrypted in transit (using TLS 1.2+) and at rest (via AES-256 encryption). Passwords are hashed using bcrypt or Argon2 to prevent exposure. Access controls restrict retrieval to authorized personnel (e.g., IT administrators for troubleshooting). Third-party vendors processing login data must sign Data Processing Agreements (DPAs) and comply with our security standards. 3. Data Retention Active login credentials are retained only as long as the account is active. Deleted accounts undergo a 7-day retention period for audit purposes before permanent erasure. Parents and students may request data deletion under COPPA/FERPA/GDPR by contacting [support email]. 4. Data Sharing and Disclosure Login data is never sold or rented to third parties. Law enforcement requests are honored only with court orders or subpoenas, and we notify affected parties where legally required. Breach notifications are issued within 72 hours (GDPR) or 30 days (FERPA) of discovery. 5. User Rights Parents may access, modify, or delete their child’s login data upon request. Students aged 13+ (under GDPR/CCPA) have the right to access and delete their data. Opt-out mechanisms are provided for data collection where applicable (e.g., biometric logins). 6. Updates and Compliance This policy is reviewed annually and updated to reflect legal changes (e.g., new privacy laws). Users are notified of significant modifications via email or platform announcements. Contact Us For questions or requests, contact: [Privacy Officer Email] | [Institution Address] Ethical Dilemmas in Login Security and Proposed Solutions Balancing user convenience with security rigor presents ethical challenges in login system design. Schools often face trade-offs between ease of access (e.g., password reuse, single-sign-on) and protection against breaches. Below are common dilemmas and actionable solutions to mitigate risks while maintaining usability. Common Ethical Conflicts: Password Reuse vs. Security: Students and parents frequently reuse passwords across platforms, increasing breach risks. Solution: Enforce minimum password complexity (e.g., 12+ characters, no dictionary words) and multi-factor authentication (MFA) for all accounts. Provide password managers (e.g., Bitwarden) for secure storage. Single-Sign-On (SSO) Convenience vs. Centralized Risk: SSO simplifies access but creates a single point of failure. Solution: Implement Federated Identity Management (FIM) with identity providers (IdPs) like Google Workspace or Microsoft Entra, ensuring session timeouts and conditional access policies (e.g., device compliance checks). Biometric Data Collection: Fingerprint or facial recognition logins improve convenience but raise privacy concerns. Solution: Obtain explicit parental consent (COPPA) and allow opt-out options. Store biometric data locally on devices (not centralized servers) where possible. Data Minimization vs. Functionality: Collecting minimal login data (e.g., only usernames) may hinder personalized educational tools. Solution: Adopt just-in-time data collection—request additional data (e.g., email for recovery) only when necessary and anonymize where possible. Ethical Best Practices: Transparency: Clearly communicate data usage in privacy policies and obtain consent for all data collection. User Education: Train parents and students on phishing risks, password hygiene, and recognizing suspicious login prompts. Regular Audits: Conduct third-party security audits annually to assess ethical compliance and identify vulnerabilities. Incident Response Plans: Develop breach response protocols that prioritize user notification and remediation over institutional protection. Compliance Timeline for Login System Requirements Maintaining compliance with data privacy laws requires ongoing monitoring, audits, and proactive measures. Below is a structured annual compliance timeline outlining key deadlines, responsible parties, and actions to ensure adherence to legal and ethical standards. Mastering login systems for parents and students is not merely about resolving technical hurdles but fostering a culture of digital responsibility within educational environments. From enforcing stringent password policies to deploying adaptive authentication measures, the strategies outlined here empower institutions to fortify their platforms against evolving threats while enhancing user experience. By adopting proactive security practices, leveraging role-based access controls, and aligning with legal frameworks, schools can create a resilient foundation for seamless digital engagement. The key lies in continuous adaptation—balancing innovation with vigilance to ensure every login remains both secure and accessible for all stakeholders. Deadline Requirement Responsible Party Action Items January 1 (Annual) Privacy Policy Review Legal/Compliance Team

  • cybersecurity best practices schools
  • educational login security
  • multi-factor authentication guide
  • parent student authentication
  • role based access control education

  Leave a Comment

  Name

  Comment

  Post Comment

  Comments are moderated before appearing. The data you submit is processed according to the Privacy Policy of ir.msu.ac.zw.