Independent practical guidance for handling credentials, authentication, API access, secrets, incidents, and everyday IT security.
Credential security is broader than sending a password safely. Good security also depends on identity verification, least privilege, strong authentication, controlled storage, limited retention, rotation, and incident response.
4 published guides in this topic.
A practical comparison of passkeys and passwords, including phishing resistance, recovery, device synchronization, and business deployment.
Read articleMFA can reduce the impact of stolen passwords, but different authentication methods provide different levels of phishing resistance.
Read articleUnderstand how common authentication credentials differ, what each one protects, and why they should not all be handled the same way.
Read articleRecovery and backup codes can bypass normal authentication controls, so they should be handled with the same care as passwords or security keys.
Read article