Post

Threat 1: password reuse. Your bookkeeper could use the same password on a Minecraft forum that they use for the bank. The fix is a password manager. That's it. Riggle's notes the 1990s advice was wrong, and that writing them down on paper still beats reusing them.

Threat 2: spearphishing. An email from "you" to your admin — wire this account, can't talk now. The fix isn't 2FA. The fix: → A standing agreement that money never moves by email → Known invoices auto-approve → For everything else, you log in and approve

Threat 3: credential stuffing. That Minecraft dump gets run against your login form. Fix by rate limiting your auth endpoints — user and API both. Most teams do one and forget the other. Otherwise, you're doing it mid-attack (yikes).