About Password Password

Password Password is a defensive security site. It is maintained by one person, with no vendor behind it; the articles are produced from the sources each one names, under that person's direction, and how this site is made has the details.

Editor

C. B. Zakarian (a pen name) is the owner and editor of Password Password. C. B. Zakarian holds a Ph.D. in Information Systems, with a focus on data science, from the University of North Carolina at Greensboro (2016), and is an assistant professor.

Since October 6, 2026, every new piece on Password Password is read and approved by C. B. Zakarian before it is published. Pages published earlier are being reviewed in weekly batches, and each reviewed page shows the date of its review.

What is published

Attack and defense articles take one class of attack and explain how it works at the level a defender needs to recognise it, detect it, and close it. That level is deliberate: enough mechanism to make the defence make sense, never a recipe for getting into a system that is not yours.

Breach record articles put the public record of data breaches into a spreadsheet and read it: the timelines, the vectors, the numbers, sourced to the company's own notice, the regulator's filing, the court document, or the Have I Been Pwned breach entry. The datasets ship with the articles.

LLMs and security articles look at where language models are actually being used on both sides: detection and triage, red-team research, prompt injection, and the papers, cited by arXiv identifier, that measured any of it.

Passwords and auth covers credential hygiene, hashing, passkeys, multi-factor authentication, and the arithmetic of guessing, with the calculations shown.

Defender tooling is scripts: log parsing, monitoring, inventory, checking your own systems.

The line this site does not cross

Everything here is written for defenders and for people securing systems they own or are authorised to test. The site does not publish working intrusion tooling, credential lists, bypass recipes, or step-by-step access to anyone else's systems, and it does not describe how to evade detection. When a topic cannot be written inside that line, it is not written. If you find a vulnerability in a real system, report it to its owner through their disclosure process.

How the facts stay honest

Breach numbers come from the record, not from memory. Every article ends with its sources. Every dataset carries the retrieval date, because breach entries get revised. No exclamation marks, and no fear-mongering: most security is unglamorous maintenance, and this site says so.

Corrections are welcome and acted on: contact.