https://passwordpassword.com/ Defensive security writing: how attacks work at the level a defender needs, what the public breach record shows, and how language models are used in security. 2026-10-10T00:00:00Z https://passwordpassword.com/posts/item-1-05-cyber-incident-reports-2025-2026.html https://passwordpassword.com/posts/item-1-05-cyber-incident-reports-2025-2026.html Thirty-two companies reported a cyber incident under Item 1.05, the item for material ones, from January 2025 to October 2026. We read all 43 filings. 2026-10-10T00:00:00Z https://passwordpassword.com/posts/conduent-breach-timeline-from-the-filings.html https://passwordpassword.com/posts/conduent-breach-timeline-from-the-filings.html Conduent's breach rebuilt from its SEC filings, notice letters and state and federal breach lists: 84 days unseen, 268 days to the first letter, 62.2M people. 2026-10-07T00:00:00Z https://passwordpassword.com/posts/stealer-logs-in-the-breach-record.html https://passwordpassword.com/posts/stealer-logs-in-the-breach-record.html Six stealer-log entries in the public breach catalogue, measured: 20.7% of addresses loaded in 2025-26, rows versus people, and why the flag is a floor. 2026-09-23T00:00:00Z https://passwordpassword.com/posts/the-breach-record-in-one-spreadsheet.html https://passwordpassword.com/posts/the-breach-record-in-one-spreadsheet.html The public breach catalogue holds 1,036 breaches and 17.8 billion loaded addresses. Grouped by year, data class and size, it says where defensive effort belongs. 2026-09-19T00:00:00Z https://passwordpassword.com/posts/session-tokens-stolen-cookie-flags-rotation.html https://passwordpassword.com/posts/session-tokens-stolen-cookie-flags-rotation.html A stolen session cookie is a logged-in user. Why an idle timeout does not bound the thief, and what absolute timeouts, rotation and device binding change. 2026-09-16T00:00:00Z https://passwordpassword.com/posts/ransomware-kill-chain-mapped-to-controls.html https://passwordpassword.com/posts/ransomware-kill-chain-mapped-to-controls.html Eight stages of a ransomware intrusion mapped to MITRE ATT&CK v19.2 mitigations and CISA's guide, with a script that shows which stages your controls leave open. 2026-09-12T00:00:00Z https://passwordpassword.com/posts/sql-injection-for-people-who-write-queries.html https://passwordpassword.com/posts/sql-injection-for-people-who-write-queries.html How a string-built query lets input change the SQL, why parameterised queries end it, what OWASP and CWE-89 say, and a regression test you can run. 2026-09-05T00:00:00Z https://passwordpassword.com/posts/password-entropy-calculator-nist-800-63b.html https://passwordpassword.com/posts/password-entropy-calculator-nist-800-63b.html A calculator for the entropy of a password generator, the guess-time arithmetic at four rates, and why a chosen password cannot be scored. 2026-09-05T00:00:00Z https://passwordpassword.com/posts/passkeys-explained-for-login-page-owners.html https://passwordpassword.com/posts/passkeys-explained-for-login-page-owners.html What a passkey is in WebAuthn terms, why origin binding makes it phishing-resistant, synced versus device-bound, and what changes on the server side. 2026-09-05T00:00:00Z https://passwordpassword.com/posts/mfa-fatigue-push-bombing-settings-that-stop-it.html https://passwordpassword.com/posts/mfa-fatigue-push-bombing-settings-that-stop-it.html How repeated push prompts turn a stolen password into a login, what NIST, CISA and ATT&CK T1621 say, and the settings that end it. 2026-09-05T00:00:00Z https://passwordpassword.com/posts/how-password-hashing-works-bcrypt-scrypt-argon2.html https://passwordpassword.com/posts/how-password-hashing-works-bcrypt-scrypt-argon2.html What a verifier stores instead of your password, why bcrypt, scrypt and Argon2 are slow on purpose, and why the salt is not a secret. 2026-09-05T00:00:00Z https://passwordpassword.com/posts/credential-stuffing-explained-logs-rate-limiting.html https://passwordpassword.com/posts/credential-stuffing-explained-logs-rate-limiting.html Why reused passwords from old breaches become logins on your site, the shape the attack leaves in your auth logs, and the OWASP and ATT&CK controls that limit it. 2026-09-05T00:00:00Z https://passwordpassword.com/posts/adversary-in-the-middle-phishing-that-beats-mfa.html https://passwordpassword.com/posts/adversary-in-the-middle-phishing-that-beats-mfa.html How a relay phishing page captures a one-time code and the session that follows, what ATT&CK, CISA and NIST say, and the controls that hold against it. 2026-09-05T00:00:00Z