Latest filing
Collection
8 stories filed to the Digital desk — newest first.
Password rules were built for a threat that barely exists anymore. Here is how the guidance shifted, and what the change looks like from the customer's side of the form.
The device that proves who you are is gone, and every recovery route asks you to prove who you are. There is a way through it, and the order matters.
Backup software reports whether it finished, not whether the result is usable. The only test that answers the second question is putting something back.
These letters are drafted to satisfy a statutory list and to concede as little as possible beyond it. Reading them for what is absent is more useful than reading them for what is there.
Nobody is quoted in this piece. The same questions went to several people who do small business recovery work, and the answers are reported rather than attributed.
The code in a breach notification buys an alert after something has happened. A freeze stops the thing from happening, and only one of the two is free forever.
Three ways of keeping passwords are in wide use and all three are defensible. They fail in different directions, and the right one depends on who else lives in the house.
Change it every ninety days, one capital, one digit, one symbol. Those instructions came from a specific place, and that place reversed them years ago.