What a Charity’s Registration Does and Doesn’t Prove
Registered, tax-exempt, top-rated: each charity label answers a different question. What the checks prove, what New York’s fundraising data shows, what to ask.
The cover story / Social engineering
The story before the request.
How a plausible role makes an unusual request feel ordinary. A closer look at pretexting and the way trust gets borrowed.
Read the pretexting essay 6 min read · Human behaviorOne Call, Many Apps: The Trade-Off Inside Single Sign-On
Google’s report on a vishing group shows what one fooled sign-in can reach. Why SSO still makes sense, what it concentrates, and how to limit a session.
Ideas worth a closer look
Trust. Pressure. Proof.
Urgency does more than rush you. It removes the second opinion.
A deadline becomes dangerous when it is used to replace verification, isolate a decision or excuse a change in process.
6 min read
A familiar voice is a clue, not a verification method
When a call sounds like someone you know, the safest question is not whether you can hear an AI artifact. It is how to check the request outside that call.
6 min read
Phishing-resistant MFA protects a sign-in. It does not approve the story around it.
Passkeys and security keys are valuable controls. Understanding their scope helps explain why account recovery, consent and payment decisions still matter.
6 min readA workplace dossier
Better systems.
Not better blame.
Two readings on the processes around a person, from identity checks to the first reply after a report.
