Blog
Articles about passwords, security, and why almost everything we were taught was wrong.
Passkeys: the password that doesn't exist
For decades we tried to make passwords harder to guess. Passkeys do something else: they take away the secret the server had to keep. The site is left holding a public key that's worthless to a thief, and phishing stops working. It doesn't fix everything.
Security questions are a password you never chose
A security question is a password with three defects: you didn't pick it, it can be guessed, and it's usually written down somewhere public. In 2015 Google measured it with real data and the result was damning twice over: the answers get guessed and they also get forgotten. Lie to protect yourself and you end up locked out.
2FA: why SMS is the worst of the good options
Turning on SMS 2FA is one of the best decisions you can make today, and also the first one you'll have to revisit. Its weak point isn't the encryption or your phone: it's the person answering the phone at your carrier. Here's the whole ladder, from SMS to a hardware key.
What really happens when your password leaks
Your password doesn't leak and vanish: it leaks and starts circulating. It gets cracked at leisure, merged with other lists, and ends up in a combo someone tries on your bank. What makes it valuable isn't that it was weak. It's that it was the same one.
Hash, salt, bcrypt and Argon2: what a well-built site does with your password
Every time you're let in, something gets checked. But checking isn't knowing. The story of how we learned not to store passwords, and of why the function that protects them has to be slow — and expensive — by design.
How long your password really takes to crack
The sites promising you '3 million years' are hiding half the equation. The same password can fall in an afternoon or hold for centuries depending on how the site you signed up to chose to store it — something you don't get to pick and nobody explains. Here's what's behind the number.