Security
Password managers and passkeys
Two mechanisms that remove the human from the part of authentication humans are worst at — remembering secrets, and judging which site to give them to.
A password manager makes every credential unique, which contains a breach to the one service that leaked it. Its second and underrated property is that it fills credentials only on the domain they belong to, so a manager that declines to autofill is a phishing warning arriving before the mistake.
Passkeys go further by removing the shared secret: the private key never leaves the device, nothing reusable is transmitted, and the credential is bound to the site's origin, so it cannot be handed to a convincing copy. For business accounts they are the strongest option that is also easier than what they replace.
Shared team credentials belong in the manager's shared vault with per-person access that can be revoked, never in a chat message, a spreadsheet or a pinned note. The test is whether access ends when someone leaves; a password in a chat log does not.
Complexity does not survive somebody else's breach. A twenty-character password used in three places is compromised in all three the moment any one of them leaks, and credential-stuffing is automated: the reuse is found within hours, not months.
A definition is free. Being answerable for the figure it produces is the part that is bought, and this term is a working part of the engagements below.
- IT consulting for companies in Dubai and across the Emirates
- A company owns what it can recover without asking anyone's permission. The rest is rented.
The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.