Sometimes we can’t even get the basics of Cybersecurity correct

https://medium.com/asecuritysite-when-bob-met-alice/sometimes-we-cant-even-get-the-basics-of-cybersecurity-correct-2e8c065d9455
A truly appalling case study of getting password storage wrong. 

It’s a Huge Mistake to Memorize Your Passwords

https://onezero.medium.com/its-a-huge-mistake-to-memorize-your-passwords-2bdc1fdd64c2
a survey of best password managers

An inside look at how credential stuffing operations work

https://www.zdnet.com/article/an-inside-look-at-how-credential-stuffing-operations-work
How a credential stuffing attack works.

The Mathematics of (Hacking) Passwords

https://medium.com/scientific-american/the-mathematics-of-hacking-passwords-82a45d7e9d0f
Not quite up to the latest algorithms like Argon2, but a good start.

The Problem With Passwords…

https://medium.com/asecuritysite-when-bob-met-alice/the-problem-with-passwords-b555dbab07f4
A simple hash won't cut it any more.

Everything you ever wanted to know about building a secure password reset feature

https://www.troyhunt.com/everything-you-ever-wanted-to-know/
The flowchart, ins and outs of password reset.

PHP Encryption Methods for Passwords & Other Sensitive Data

https://deliciousbrains.com/php-encryption-methods/
Not your father's MD5 hash.

Storing Passwords the Right Way

https://engagedphp.com/2018/03/storing-passwords-the-right-way/
Brief into to the new PHP 7.2 functions for password management with libsodium. 

1.4 Billion Clear Text Credentials Discovered in a Single Database

https://medium.com/4iqdelvedeep/1-4-billion-clear-text-credentials-discovered-in-a-single-database-3131d0a1ae14
First of all, any systems should never store passwords in cleartext. Those that do, this happens.

NIST’s new password rules – what you need to know

https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/
Yea!!! NIST's latest password rules SP 800-63-3 get it mostly right!! No more arbitrary expiration!