Oblivious Investor

What Happens if My Password Manager Gets Hacked?

Mike — Mon, 29 Jun 2026 12:00:29 +0000

Password manager providers are naturally attractive targets for hackers. So a critical question to ask is: what happens if an attacker manages to access the servers of the company that provides your password manager software? And the answer to that question will depend on both your own practices as well as the policies and practices of the password manager provider.

Here it’s worth backing up a step and looking at historical security breaches in general. For instance, there have been many cases in which some company (e.g., an insurance company, a credit bureau, a hospital system, or a large retailer) gets hacked, and the attacker is ultimately able to access customer/patient information, such as contact info and Social Security numbers.

But wouldn’t that data have been encrypted on the company’s servers? In other words, even if the attacker was able to download the data, why weren’t they stuck with unusable encrypted data? Sadly, in some cases, the answer is that no, the data in fact was not encrypted on the company’s servers. But even in many cases in which the data was encrypted, the attacker was ultimately able to decrypt the data. Generally, that’s not because the attacker was able to defeat the encryption. (Modern best-practice encryption is quite secure.) Rather, the explanation is a simpler one: the attacker was able to access the decryption keys.

In most cases, when a company is storing encrypted data, they also need to be able to decrypt that data themselves, so that they can use the data when needed. So the decryption keys must be accessible in some way by systems (and sometimes people) at the company. And that is where the security often fails. In the major data breaches that you’ve heard about, what has generally been the case is that the decryption keys were stored in some way that was itself insecure, or the attackers were able to access an application that has access to the keys. The details vary, but the result is typically that the attacker is able to download the encrypted data and access the decryption keys, thereby allowing them to simply decrypt the data.

Now back to our discussion of password manager software specifically. The details vary by provider, but many password managers (including Bitwarden or 1Password) use what is known as zero-knowledge architecture. The idea of zero-knowledge architecture is that the password manager provider itself never has your master password, the key necessary to decrypt your data, or a decrypted version of your usernames, passwords, etc. Your encrypted vault is stored on their servers, and when the vault needs to be decrypted (in order for you to access saved information) that decryption happens entirely on your device. Your device uses your master password to derive the decryption key and then uses that decryption key to decrypt the requested data. To reiterate: with zero-knowledge architecture, the password manager provider never has your master password, the decryption key, or a decrypted version of your vault.

What this means is that, if your password manager is using zero-knowledge architecture with strong encryption practices, and you are using a strong master password, then even if an attacker were able to breach the password manager’s servers and download your encrypted vault, they would almost certainly not be able to decrypt the information. There’s a fundamental difference here between this sort of setup and a setup in which the company is saving not only your encrypted data but also the means to decrypt that data.

Of course, it would still be preferable for your password manager provider not to be hacked at any point. And if you ever learn that your password manager provider has suffered a breach involving customer vaults, you should promptly change the passwords of your most important accounts, and then change the remaining passwords as soon as practical. But if you and your password manager are both following best practices, you don’t need to worry that a data breach would mean that an attacker would immediately have access to all of your passwords.

There are also options for offline password managers. For instance, KeePassXC is a dedicated offline password manager. Alternatively, Bitwarden can be self-hosted on your own server. In these cases, your vault would not be stored on the vendor’s servers and thus would not be accessible at all if the vendor’s servers were breached. One downside is that syncing your passwords across devices or sharing with other family members becomes something you must set up and manage yourself. Also, now you would be fully responsible for security (including backups and other security-related policies). Whether that’s a good thing or a bad thing depends on your skills and how much time you want to spend on the endeavor.

Finally, on the topic of password manager breaches, we have to talk about LastPass. In 2022, LastPass was the subject of a major breach. In addition to being breached, it became clear that they were not following certain other best practices. For one, they were not encrypting the URLs of the websites for which users were saving usernames and passwords. That made it easier for the attacker to pick specific vaults to target for brute-force decryption attacks. (Specifically, the attacker appears to have gone after vaults that had cryptocurrency assets.) Secondly, the vaults of LastPass users with older accounts were not as securely encrypted as they should have been. In 2018, LastPass had upgraded its default for new users, but older users were still on older encryption policies unless they explicitly adjusted the setting themselves. That made it easier for the attacker to effectively use brute-force attacks on customer vaults. (Weaker encryption settings meant that the attacker could make many more password guesses per second against those vaults.) We know that some people did have money stolen as a result. Finally, LastPass customers were not informed that their encrypted vaults had been accessed until months after it had occurred. A more timely notification could have allowed customers to update all of their passwords promptly and avoid any actual losses. For the above reasons, many experts in the field simply no longer feel comfortable using or recommending LastPass. Regardless, the event illustrates the importance of a password manager provider following best practices.

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

Disclaimer:Your subscription to this blog does not create a CPA-client or other professional services relationship between you and Michael Piper or between you and Simple Subjects, LLC. By subscribing, you explicitly agree not to hold Michael Piper or Simple Subjects, LLC liable in any way for damages arising from decisions you make based on the information available herein. Neither Michael Piper nor Simple Subjects, LLC makes any warranty as to the accuracy of any information contained in this communication. The information contained herein is for informational and entertainment purposes only and does not constitute financial advice. On financial matters for which assistance is needed, I strongly urge you to meet with a professional advisor who (unlike me) has a professional relationship with you and who (again, unlike me) knows the relevant details of your situation.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Financial Planning Roundup: Social Security Trust Fund Projected Depletion Moves Closer

Mike — Mon, 22 Jun 2026 12:00:43 +0000

The Trustees of the Social Security and Medicare trust funds released their annual report this month. The big headline finding: “The Old-Age and Survivors Insurance (OASI) Trust Fund will be able to pay 100 percent of total scheduled benefits until the fourth quarter of 2032, one quarter earlier than projected last year. At that time, the fund’s reserves will become depleted and continuing program income will be sufficient to pay 78 percent of total scheduled benefits.”

Summary report here
Full report here (as pdf)

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Asset Allocation with a Very Low Spending Rate from the Portfolio

Mike — Mon, 15 Jun 2026 12:00:19 +0000

A reader writes in, asking:

“What is your view on owning TIPS ladder (Bogleheads preferred) or short term TIPS fund when the majority of expenses are covered by pension and/or social security which are COLA adjusted.

One view I read is from Charles Ellis, who views all sources of stable retirement income (pension, social security) as bond like assets, essentially an indirect TIPS ladder.”

On the “should Social Security or a pension be treated as a bond” topic, my answer is that, no, they aren’t bonds. They are clearly fixed-income. But they are not bonds. (For a more full explanation, please see Social Security: It is an Asset, But Not a Bond.)

The case in which Social Security or an inflation-adjusted pension entirely covers spending needs is just a subset of the broader category of cases in which the household is spending at a very low rate from the portfolio in retirement. That is, for this purpose, we can lump together all cases in which a household is spending anywhere from zero to roughly 2% of the portfolio per year.

In cases like that, there is a huge range of asset allocations that would be reasonable. The household does not need high returns, so they can use a very conservative allocation. On the other hand, the volatility of an aggressive portfolio would not put their well-being at risk either, so an aggressive allocation would also be acceptable. Or anywhere in between.

In other words, at this point, it becomes entirely a matter of preferences. The retirement spending goal has been entirely satisfied. So now the question becomes:

Should we use an aggressive allocation, in order to increase the expected bequest to heirs?
Or should we use a conservative allocation, in order to not have to experience as much volatility?

Either answer is acceptable.

And because a very broad range of allocation (from highly aggressive to highly conservative) is reasonable, all the various sub-topics within the asset allocation topic become even less important.

Should this household own a ladder of individual TIPS? Sure, if that appeals to them. Or not.

Should they own a short-term TIPS fund? Again, sure, if that sounds good to them.

They could use a single LifeStrategy fund or iShares Core Allocation ETF.

Or they could use a “VT + TIPS” portfolio like I do. Or they could use a three-fund portfolio, with the bond fund being any of several different bond funds (short-term TIPS, intermediate-term TIPS, short-term nominal Treasuries, intermediate-term nominal Treasuries, a total bond fund, etc.). Or they could use any of 1,000 other more complicated portfolios, if one such portfolio appeals to them for a particular reason.

In general, when creating or assessing a portfolio, we want to be sure of five things:

The portfolio is diversified (no huge allocation to a single stock).
The portfolio’s risk level is appropriate for the household’s circumstances.
The portfolio is simple enough to manage.
The portfolio does not include anything with unreasonably high costs.
The portfolio is reasonably tax-efficient.

For any given household, there are going to be many potential options that satisfy all five requirements. There is no perfect portfolio, but there are countless perfectly fine portfolios.

And specifically for a retiree household with a very low spending rate, requirement #2 on the list becomes less of a limiting factor than it often might be, so now there is an even broader range of acceptable portfolios.

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Financial Planning Roundup: 2026 Edition of Taxes Made Simple

Mike — Mon, 08 Jun 2026 12:00:01 +0000

A quick announcement for today: I just released the 2026 edition of Taxes Made Simple. It includes all the stuff that’s new for 2026 (and 2025), such as the $1,000 charitable donation deduction for non-itemizers, the senior deduction, the deductions for qualified tip income, qualified overtime income, and vehicle loan interest.

If you think it would be helpful for you or a loved one, I’d encourage you to grab a copy. Or leave a review if you’ve read it in the past and found it helpful:

Taxes Made Simple: Income Taxes Explained in 100 Pages or Less

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Vanguard’s New Target Maturity Corporate Bond ETFs

Mike — Mon, 01 Jun 2026 12:00:27 +0000

In March of this year, Vanguard released a new line of Target Maturity Corporate Bond ETFs. (Prospectus here.) The line currently consists of Vanguard Target Maturity 2027 Corporate Bond ETF (VBCA) through Vanguard Target Maturity 2036 Corporate Bond ETF (VBCJ). In other words, one fund for each year, up to ten years in the future.

The funds do pretty much what you’d expect from the name:

Each fund holds (domestic) investment-grade corporate bonds that mature (or are expected to be called) in the year in question. For example, the Vanguard Target Maturity 2029 Corporate Bond ETF holds bonds that mature or are expected to be called in 2029.
Each month, the fund distributes whatever income the underlying bonds paid.
And then once all the bonds have matured, the fund makes a final distribution of the entire net asset value.

The idea, broadly, is that these funds could be used to create a corporate bond ladder, extending up to 10 years in the future. Vanguard even released a neat “BondBuilder Laddering Tool” to go along with the funds.

If you’re going to own corporate bonds, diversification among issuers is critical, for exactly the same reason why diversification is critical when owning stocks: you don’t want to have a disaster if any one company goes out of business.

So if you want to build a ladder of corporate bonds, using funds like these is much easier than buying individual bonds from a whole bunch of different issuers.

But do you want to build a ladder of corporate bonds?

I don’t, particularly.

To be clear, there’s nothing at all wrong with doing so. But most of the time if I’m considering a bond ladder, it’s specifically for asset-liability matching. That is, the point is the safety that a ladder can provide (due to holding bonds until maturity), relative to most funds (which maintain a steady average maturity and thus if you ever want to sell shares to raise cash, you’re always selling bonds prior to maturity). And if the goal is safety, then I specifically want the ladder to be Treasury Inflation-Protected Securities (TIPS).

Again, there’s nothing at all wrong with these funds. They’re low-cost, and I expect they’ll do a great job of doing what they say they’ll do. If you want a corporate bond ladder, these are a good choice (for up to 10 years of ladder rungs, that is).

It’s also worth noting that iShares has offered target-maturity investment-grade corporate bond ETFs since 2016. They are also low-cost and do basically the same thing. So the idea isn’t new. This is just Vanguard also offering a product in this category. (iShares also offers target-maturity ETFs of nominal Treasury bonds, TIPS, municipal bonds, and high-yield corporate bonds.)

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Financial Planning Roundup: New Book Recommendation

Mike — Mon, 25 May 2026 12:00:03 +0000

Over all the years I’ve been writing this blog, Ben Carlson is among the top few writers I’ve linked to most often (Jim Dahle and Christine Benz are probably the competitors).

Ben recently released a new book, which I just finished reading: Risk and Reward: How to handle market volatility and build long-term wealth. In short, it’s excellent. It would be on my short list of books to recommend to a new investor, and I think it’s a fun read for any experienced investor who enjoys good investment writing.

The book drills home the “…and now stick with the plan” lesson, in a variety of ways: stories, history, and (as you’d expect from Ben’s blog) a whole bunch of great charts for anybody who is a visual learner.

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Using AI for Tax Research

Mike — Mon, 18 May 2026 12:50:43 +0000

I recently had an email exchange with an Oblivious Investor reader about the (new for 2026) deduction of $1,000 ($2,000 if married filing jointly) for charitable contributions, for people who don’t itemize. The question was whether the deduction reduces adjusted gross income (AGI) or not.

The short answer is that, no, it does not reduce adjusted gross income.

But what’s perhaps more interesting is the conversation the reader was having at the same time, with Gemini AI, about the same topic. The reader had asked whether the deduction is an “above the line” or “below the line” deduction.

And the AI gave an answer that was frankly nonsensical. That’s likely because there’s conflicting writing on the internet about this topic, in part because the terms “above the line” and “below the line” are no longer sufficient to describe the categories of deductions that we have.

We used to have only:

Adjustments to gross income (i.e., things that reduce adjusted gross income), which were known as above-the-line deductions.
Itemized deductions, which were known as below-the-line deductions.

These days, we have a third category of deductions, which do not reduce adjusted gross income but which are not itemized deductions. Included in this category are:

The $1,000 ($2,000 if MFJ) deduction in question for charitable contributions.
The deduction for qualified business income (i.e., pass-through income).
The deduction for qualified tip income.
The deduction for qualified overtime income.
The deduction for vehicle loan interest.
The enhanced senior deduction.

Some people are calling these deductions “above the line” because they aren’t itemized. And some people are calling them “below the line” because they do not reduce adjusted gross income. And so human readers reading these different articles — as well as AI chatbots being trained on these articles — get confused.

When Gemini was asked to look specifically at the law itself and help interpret that, Gemini answered that it’s an above the line deduction, reducing AGI. Here’s Gemini’s explanation:

The specific language in Section 70424 of the Act that executes this change is as follows:

“(b) DEDUCTION ALLOWED IN COMPUTING ADJUSTED GROSS INCOME.—”

“Section 62(a) of the Internal Revenue Code of 1986 is amended by inserting after paragraph (21) the following new paragraph:”

“(22) CHARITABLE CONTRIBUTIONS OF INDIVIDUALS WHO DO NOT ELECT TO ITEMIZE DEDUCTIONS.— In the case of an individual who does not elect to itemize deductions for the taxable year, the deduction allowed by section 170(p).”

Gemini’s reasoning makes perfect sense — or it would, if that wording actually existed in the legislation. But it doesn’t. The entire wording Gemini is quoting is completely hallucinated. It doesn’t appear in the actual text of the law at all.

It’s remarkable though that the wording Gemini is providing is exactly what the law would say, if it were trying to make the deduction an adjustment to income. The AI is being very clever here — it just fundamentally misunderstands the assignment. It found wording from other pieces of legislation, in which a new deduction was made an adjustment to income. And it modified the wording exactly as needed, to fit the new context.

It’s exactly the sort of thing you’d want if you were using it to help write software code: finding something that worked in a very similar situation, and then modifying it in just the right way to fit this new situation.

But that’s precisely the opposite of what we want in tax research. We don’t want it to create new wording. We need it to specifically look at the wording that is there, understand that wording, and explain it to us.

AI chatbots can be very helpful, for a range of different tasks. But they can still get things wrong — and in ways in which no human ever would. (A human may very well answer the same tax question incorrectly, but no human in their right mind would completely fabricate a bunch of legislative wording as part of their answer.)

If you want to use AIs for tax research, there are a few things that can help improve the results:

In your permanent account settings, give it some information along the lines of “Correctness is always a critical concern. If you are ever unsure of anything, please let me know and/or ask questions. Please never give me an answer of which you are unsure.” (Note though that this can cut down on hallucinations but will not eliminate them, as the model can sometimes be confident but incorrect.)
In the actual prompt you give, do not only ask it to base its answer on the law, first ask it to find the text of the law itself. Confirm that it has read the text. And then ask your question. For example, start your conversation with: “Please look on the law.cornell.edu website for the IRC section about health savings accounts. Please find and read that.” And then go from there, with whatever questions you have about HSAs.
And for any points that are absolutely critical (i.e., points where it would be very problematic if the information you received was wrong), ask it specifically where it is finding the information in question. And then go confirm that for yourself. Acceptable sources include Internal Revenue Code sections, Treasury Regulations, Revenue Rulings, Revenue Procedures, and judicial decisions. IRS publications or articles anywhere (including IRS.gov) are not sufficient.

It’s critical to understand that AIs do not behave the same way that humans do. The situations in which AIs make mistakes, and the ways in which they make mistakes, are different than for humans. So if you’re going to rely on AI answers for critical topics, you have to be thorough/explicit about confirming the information on your own.

I often think of an AI chatbot as an employee that is: smart, extremely eager to please, hardworking, and literally an alien from another planet. Imagine that that’s who you have sitting on a stool next to you. It’s ready to work! But you can’t assume that it will understand you in the same way that a human would. They can not only get things wrong, they can sometimes fundamentally misunderstand the assignment in a way that no human would (as in the case above, in which it decided that making up tax law was what the user wanted).

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Investing Blog Roundup: Household Finances as an Early Indicator of Cognitive Decline

Mike — Mon, 11 May 2026 12:00:23 +0000

A Planet Money podcast episode last week directed me to a paper released earlier this year: Dementia and Long-run Trajectories in Household Finances. The authors explain their findings in pretty plain English, so I’m just going to quote their work:

“Our results point to impaired financial decision-making beginning about six years prior to clinically recognizable dementia.”

“A growing body of work links cognitive ability to financial outcomes such as portfolio allocation, credit use, and susceptibility to fraud. […] Most recently, Mazzonna and Peracchi (2024) show that older adults are often unaware of their own cognitive decline, and that such misperception can lead to persistent financial mistakes. We extend this literature by showing that the economic consequences of cognitive decline appear well before the onset of dementia symptoms (or clinical diagnosis) and manifest in sustained losses in household wealth.”

“Our findings underscore that dementia-related financial risk should be viewed as a universal and forward-looking household risk, not just a concern for those who are already symptomatic or diagnosed. Because financial mistakes often appear before individuals or families become aware of any cognitive decline, relying solely on diagnosis or subjective awareness is unlikely to be sufficient. Safeguards that can be implemented well in advance—such as designating trusted financial contacts, simplifying financial arrangements, or allocating part of retirement wealth to products with guaranteed payouts—may help reduce exposure to losses from impaired financial decision-making.”

Their findings are exactly in line with the stories I keep hearing stories from readers: situations in which, conversationally, Mom/Dad/Uncle Steve still seems fine. No obvious red flags. And yet, they’re making financial decisions that make no sense or falling victim to scams that they would not have fallen for just a few years ago.

Of course, dementia (or other significant cognitive decline) does not happen to everybody. But we don’t know in advance to whom it will happen. And waiting until there are obvious personality-related symptoms before putting protective financial policies in place doesn’t work very well, because the financial problems often come first.

I think the authors suggestions are excellent: simplified portfolios (and simplified finances in general), designated trusted financial contacts (to allow the financial institutions to share information with that contact), options for guaranteed income (most notably: delaying Social Security). And I’ll add: adopting security practices that are resistant to scams/phishing (i.e., passkeys and security keys).

A key point here is that all of the above suggestions are generally good ideas regardless of the possibility of cognitive decline.

Dementia and Long-run Trajectories in Household Finances from Jing Li, Kathleen M. McGarry, Lauren Hersch Nicholas, and Jonathan S. Skinner
How Your Bank Account Might Predict Dementia (The Indicator from Planet Money podcast episode)

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Keeping Vulnerable Loved Ones (and Yourself) Safe from Fraud

Mike — Mon, 04 May 2026 12:00:39 +0000

“Have your parents been scammed yet?” Jim Dahle asked me, in a brief one-on-one conversation at the recent White Coat Investor Conference.

The implication, of course, is that it’s a matter of when it happens rather than whether it happens.

At the conference, three other attendees happened to share stories with me of their parents being scammed. (And, to be clear, I was not walking around polling people on this topic.)

And we recently discussed the stats from the FBI showing explosive growth in the rate at which people age 60+ are becoming victims of cybercrime.

Frankly, we have a situation on our hands.

Technology keeps moving. If anything, it’s speeding up. But as humans, at some point, we slow down. That’s just the nature of things.

That’s a major part of the context for this whole discussion of cybersecurity. It’s not just about how we can keep ourselves safe, it’s also about how we can keep our elders and less tech-savvy loved ones safe. And the combination of tech advancements (which older people are less likely to have kept up with) plus the possibility of some degree of cognitive decline makes for a challenging situation.

And to be clear, when I mention cognitive decline here, I’m not referring to full-blown dementia (although that obviously does dramatically increase the likelihood of being victimized). I’m talking about the more mundane but common situation in which a person is still capable of functioning normally in day-to-day activities, yet their ability to promptly detect a fishy situation — their “bullshit radar,” if you will — has started to become somewhat less sensitive.

What follows are important steps you can take to make yourself safer. And after implementing these policies for yourself, you can help your vulnerable loved ones implement them as well.

An important thing to note here is that if there are multiple people in the household, everything is only as secure as the weakest link. Each person should be following these policies.

Communication Policies

If you receive any inbound communication (whether email, text, or phone call) that purports to be from a company or government agency with which you have any sort of account:

Do not reply.
Do not give them any information whatsoever.
Do not click on any links.

Essentially, don’t interact with inbound communications. If you need to interact with any organization with which you have an important account, make sure it is you reaching out to them, via a trusted means. That could be:

Calling the number on the back of your credit/debit card.
Typing the company’s URL directly into your browser.
Visiting their website via a previously-saved browser bookmark (or navigating there via your password manager).
Using an app on your phone (e.g., using the Bank of America mobile app, to contact Bank of America).

And the same thing goes for situations in which you’re contacted by (ostensibly) a loved one asking for money. Don’t engage with the inbound communication. Instead, reach out to the person in question via the contact information that you already have saved.

Credential Management Policies

To be clear, by far the largest risk for most individuals is getting tricked, rather than actually being hacked in some way. A major portion of cybercrime incidents are cases in which the victim:

Accidentally gives a thief their multi-factor authentication code (e.g., over the phone or by text) because they thought the thief was somebody else, or
Accidentally enters their login credentials on a fake website.

If you can eliminate those two possibilities, you have dramatically reduced the risk. Policies that work toward reducing or eliminating those possibilities include:

Use passkeys when a website allows you to do so.
Use security keys (i.e., YubiKey or similar) as the multi-factor authentication option when allowed to do so.
Use a password manager (so that when a website forces you to use password-based login rather than a passkey, your password manager will not populate the password if you end up on the wrong website).
Remove less-secure sign-in methods and account-recovery methods, to the extent you’re allowed to do so.

Essentially, you can’t get tricked into sharing the password with a malicious party if signing in with a password isn’t even an option (i.e., because the only sign-in option is to use a passkey). And you can’t get tricked into sharing the multi-factor authentication code with a malicious party if there is no such code (i.e., because the only accepted MFA option is a physical security key).

Other important policies regarding login credentials include:

Use strong passwords for your various accounts. (Your password manager should have a tool for generating such.)
Do not reuse passwords across different accounts.
Use strong passcodes for mobile devices and tablets.
Use an authenticator app as the multi-factor option (rather than SMS or email), if security keys are not an option and the website doesn’t allow passkeys.
Activate SIM-swap protection with your mobile carrier.
Use fake answers to “security” questions whenever an account asks you to set up such things (e.g., your third grade teacher’s last name was “i6c@vNShpJy$$9oV”), and store those answers in your password manager.

Other General Policies

Some of the other highest-impact security policies you can implement would be to:

Freeze credit at all the major credit bureaus, and implement a security freeze with ChexSystems.
Create an IRS Identity Protection PIN (and enroll to get a new one each year).
Take advantage of any security features your brokerage firms offer such as money transfer lock at Fidelity or ACATS lock at Vanguard.
Keep your operating system and apps up to date on all devices. (It’s unfortunate, but in many cases this will mean replacing devices at a point at which they’re still functional, in order to keep them on a current operating system.)

It’s Time to Upgrade Our Practices

To be clear, the policies mentioned in this article are not meant to be an exhaustive list. There are 100+ additional practices you could adopt, which would further improve your security. But the policies mentioned above are some of the highest-impact things you can do to keep yourself and/or your vulnerable loved ones safe. And if you implement all of the above, you (or your vulnerable loved one) will be a much harder target than most people.

Admittedly, for many people, this will mean learning to use some new tools (passkeys, security keys, password manager, authenticator app). But now’s the time. It’s not going to be any easier to start learning these things a few years from now.

And an important thing to note (and an important thing to mention, if you’re helping a loved one implement these practices) is that passkeys, security keys, and password managers all provide significant convenience benefits, relative to the alternatives. That is, in addition to being more secure:

Logging in via passkey is generally more convenient than logging in via password + MFA code.
Using a security key as the MFA method is generally more convenient than SMS, email, or authenticator app as the MFA method.
Using a password manager is more convenient than trying to remember your passwords, record them on paper, or record them manually in some other electronic format.

The thieves have better tools available to them than they did just a handful of years ago. We have better tools available to us as well. But we have to actually use them. If your (or your loved one’s) security practices are no stronger than they were 10+ years ago, it’s time to upgrade those practices.

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Investing Blog Roundup: Government Guidance on Passkeys (from the UK)

Mike — Mon, 27 Apr 2026 12:00:45 +0000

We’ve been discussing passkeys a fair bit here in recent weeks, and by coincidence last week the UK’s National Cyber Security Centre released a new paper and guidance on the topic.

General guidance document: Passkeys: what you need to know
Press release: NCSC: Leave passwords in the past – passkeys are the future
Technical paper: Comparing the security properties of traditional user credentials and FIDO2 credentials for personal use

Below are a handful of quotes from the publications. Please note how strongly worded these statements are. And these are from a governmental cybersecurity organization, which is presumably being very intentional with its wording.

From the “what you need to know” document:

“Passkeys are a more secure alternative to passwords that you don’t need to remember as they are created and managed safely by the software on your device(s). […] The NCSC supports the public adoption of passkeys and recommends using passkeys over passwords wherever available.”

From the press release:

“Passwords are no longer resilient enough for the contemporary world.”

“Passkeys should now be consumers’ first choice of login across all digital services, the UK government’s technical authority on cyber security has announced today (Thursday).

Overhauling decades of security practice, the National Cyber Security Centre […] has taken the decision to no longer recommend individuals use passwords where passkeys are available because passwords lack the relative resilience to modern cyber threats.”

From the paper:

“At all stages of a credential’s lifecycle, and against all commonly observed attacks, FIDO2 credentials including passkeys are as secure or more secure than all forms of traditional MFA for individuals.”

Also of note (from the press release):

“Where a particular service does not support passkeys, the NCSC’s advice to consumers is to use a password manager to create stronger passwords and keep using two-step verification.”

If you want to read the paper (or even just the “Summary and recommendations” section at the end of the paper), a few points on terminology might be helpful:

The word passkey itself is a colloquial term, and its exact usage varies a bit from one case to another.
FIDO2 credential is a technical term for what would often colloquially be called passkeys.
When this paper uses the term passkey it is specifically referring to passkeys synced via the cloud. It uses the terms single-device passkey or device-bound FIDO2 credential to refer to what we might think of as passkeys stored on a single device, not synced to the cloud.
Sync fabric refers to whatever system is being used to store your passkeys in the cloud and sync them across devices (e.g., Apple Passwords, Google Password Manager, etc.).
Relying party refers to whatever website or app you’re logging into when using a passkey.

What is the Best Age to Claim Social Security?

Read the answers to this question and several other Social Security questions in my latest book:

Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less

Click here to see it on Amazon.

You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).

Oblivious Investor

What Happens if My Password Manager Gets Hacked?

What is the Best Age to Claim Social Security?

Financial Planning Roundup: Social Security Trust Fund Projected Depletion Moves Closer

Other Recommended Reading

What is the Best Age to Claim Social Security?

Asset Allocation with a Very Low Spending Rate from the Portfolio

What is the Best Age to Claim Social Security?

Financial Planning Roundup: 2026 Edition of Taxes Made Simple

Other Recommended Reading

What is the Best Age to Claim Social Security?

Vanguard’s New Target Maturity Corporate Bond ETFs

What is the Best Age to Claim Social Security?

Financial Planning Roundup: New Book Recommendation

Other Recommended Reading

What is the Best Age to Claim Social Security?

Using AI for Tax Research

What is the Best Age to Claim Social Security?

Investing Blog Roundup: Household Finances as an Early Indicator of Cognitive Decline

Other Recommended Reading

What is the Best Age to Claim Social Security?

Keeping Vulnerable Loved Ones (and Yourself) Safe from Fraud

Communication Policies

Credential Management Policies

Other General Policies

It’s Time to Upgrade Our Practices

What is the Best Age to Claim Social Security?

Investing Blog Roundup: Government Guidance on Passkeys (from the UK)

Other Recommended Reading/Viewing/Listening

What is the Best Age to Claim Social Security?