Field notes
Three decisions, worked through properly.
Each note follows the same shape: what the decision is, what is actually going on underneath it, and what I do about it. Written to be read in a few minutes.
Field note 01 · 23 October 2026 · Account hygiene
Two hours that decide whether your accounts survive a breach
When a service you use is breached, the leaked file is almost never a single password. It is a table: an email address, a password hash, sometimes a session token, sometimes a phone number. The damage is not done the day the file leaks. It is done over the following weeks, when that table is tried against every other service where you might have reused the same credential.
This is why "change your password" is the wrong first instruction. The correct first instruction is to ask a different question: which of my accounts, if taken over, would let someone take over everything else? For most people there are three, in this order — the email account that receives password resets, the account that holds their payment details, and the account that holds their recovery phone number.
The work is therefore ordered, not counted. First: put multi-factor authentication on the recovery email account, because it is the one that resets the others. Second: install a password manager and let it generate unique credentials, beginning with those three accounts rather than sweeping everything at once. Third: check what an attacker would find if they tried to recover your account — an old phone number, a security question whose answer is on your public profile, a backup email you no longer use.
Two hours, spent in that order, closes far more risk than two weeks spent changing passwords alphabetically.
Field note 02 · Phishing
Phishing is a design problem, not a user problem
The standard account of phishing goes like this: a careless user clicked a link, and the user is the weak point. Training programmes are built on that account. So are the posters. And yet the same people who fail a phishing simulation are usually able, in ordinary life, to spot a fake shopfront, a forged signature or a scam phone call. The skill is present. The interface defeats it.
Look at what a browser actually shows the user. The address bar — the one piece of evidence that would settle the question — has spent twenty years being progressively hidden, shortened and pushed out of view, while the page itself is allowed to imitate a login form pixel for pixel. A domain such as accounts-google-security.com is, to a careful reader, obviously not Google. To a reader who has been trained by a decade of interfaces to look at the logo and the layout, it is Google.
The practical response is not more vigilance, which is a limited and depletable resource. It is to move the decision out of the moment of judgement. Use password managers that refuse to autofill on a domain they have not seen before: the absence of the expected entry is a signal that arrives before you have to read anything. Reach services through a bookmark rather than a link. Treat any message that creates urgency as untrusted until it has been verified through a second channel that the message itself cannot control.
None of that requires the user to be more careful. It requires the user to have one fewer decision to make badly.
Field note 03 · Digital footprint
Your footprint is a database you didn't mean to build
A digital footprint is usually described as the sum of what you have posted. That description is misleading, because the interesting part of a footprint is not the posting. It is the aggregation.
Consider what happens to a single public profile. The profile is indexed by search engines, which is intended. It is also copied by archive services, summarised by scrapers, and correlated against a dozen other sources: a comment on a forum, a repository commit with a real email address in the metadata, a photograph with location data still attached, a username reused across three services. None of those facts is sensitive alone. Joined together, they describe a person — where they live, what they do, when they are away from home, who they know.
The practical consequence is that footprint management cannot be reduced to deletion. Deleting the original post does not remove the copy, and it does not remove the joins. What you can manage is the consistency and the leakage: one deliberately chosen public identity rather than several overlapping ones; metadata stripped before upload; an email address for public use that is not the one on your bank account; and a periodic check of what a search for your own name returns.
That is also where the value sits. A footprint built deliberately is an asset — it is what an employer reads before an interview, and it is the reason this site exists. The problem is not having a footprint. It is having one that was assembled by other people.