Passwords and Auth
Credential hygiene, hashing, passkeys, MFA, and the arithmetic of guessing, with calculators and data.
-
Password entropy, honestly computed, and what NIST 800-63B says
A calculator for the entropy of a password generator, the guess-time arithmetic at four rates, and why a chosen password cannot be scored.
-
Passkeys explained for people who run a login page
What a passkey is in WebAuthn terms, why origin binding makes it phishing-resistant, synced versus device-bound, and what changes on the server side.
-
MFA fatigue and push bombing: what it is and the settings that stop it
How repeated push prompts turn a stolen password into a login, what NIST, CISA and ATT&CK T1621 say, and the settings that end it.
-
How password hashing works: bcrypt, scrypt, Argon2, and the salt
What a verifier stores instead of your password, why bcrypt, scrypt and Argon2 are slow on purpose, and why the salt is not a secret.