DEV Community: Kokal Limited

How We Stopped Password Reuse From Sinking Our Small Team

Kokal Limited — Mon, 13 Jul 2026 13:21:52 +0000

If you work at a small company, you already know the credential situation: five to twenty people, each juggling logins for email, CRM, payroll, cloud storage, and a dozen vendor portals. Some save passwords in the browser. Some keep a spreadsheet. A few just hit "forgot password" every single time.

That's not a workflow — it's a breach waiting to happen.

The numbers are ugly

81% of breaches involve stolen or weak passwords (Verizon 2026 DBIR)
$98,000 average cost per incident for businesses under 50 employees (IBM 2026)
65% of people reuse passwords across work and personal accounts (NCSC)

That last one is the killer. Reuse means one breached marketing SaaS can unlock your entire stack. As developers, we get this intuitively — it's the same reason you never store secrets in plaintext.

What a password manager actually fixes

Think of a business password manager as three controls bundled together:

1. Generation — every account gets a unique secret from a CSPRNG, not Summer2026!:

# what a decent generator does under the hood
openssl rand -base64 24
# => 8f2Kd9xQ1mZ7pL4vR6nT0wYc

2. Storage — encrypted at rest and in transit:

at rest:     AES-256
in transit:  TLS 1.3
access:      authorized team members only

3. Policy enforcement — admins set minimum standards, require MFA on the vault, and audit who touched what.

What to screen for (the dev checklist)

Consumer tools and free personal vaults skip the parts teams need. When evaluating, look for:

Admin console with shared vaults per department (finance, ops, eng)
Role-based access — admin / editor / viewer, not "everyone gets everything"
Instant revocation when someone offboards
Audit logs so credential access is traceable
MFA enforcement on the vault itself

If a tool can't do role-based access and instant revoke, you're back to sharing secrets over Slack — which defeats the entire point.

CISA explicitly recommends password managers as a core control for organizations of any size. Pair one with MFA and you've closed the gap most SMB breaches walk right through.

The takeaway

You don't need an enterprise IT team to fix credential hygiene. Pick a manager with real admin controls, generate unique passwords everywhere, turn on MFA, and audit access quarterly. It's the single highest-leverage security move a small team can make in an afternoon.

Originally published on strongpassfactory.com

Passkeys for SMBs: Going Passwordless in 2026 (A Developer's Guide)

Kokal Limited — Mon, 13 Jul 2026 13:20:39 +0000

If you build or maintain internal tools for a small team, you've probably watched passwords rot from the inside: reused across a dozen SaaS apps, pasted into Slack, parked in a spreadsheet named logins_final_v2.xlsx. Passkeys fix the root cause. Here's the developer-level version of why, and how the flow actually works.

Passwords vs. passkeys, architecturally

A password is a shared secret — you know it, the server knows it, and anything on the wire between you can grab it. A passkey is a FIDO2 credential built on public-key cryptography. Your device holds the private key; the server only ever sees the public key.

That single difference kills whole attack classes:

Phishing — there's nothing to type, and the credential is bound to the origin.
Breach leaks — the server never held your private key.
Credential stuffing — each assertion is scoped to a specific domain, so it can't be replayed.

The flow

Registration stores a public key. Authentication is a challenge/response the server verifies against it:

// Authentication (simplified WebAuthn)
const assertion = await navigator.credentials.get({
  publicKey: {
    challenge: serverChallenge,        // random bytes from your backend
    rpId: "yourapp.com",               // origin-bound: phishing-resistant
    userVerification: "required",      // face / fingerprint / device PIN
  },
});
// Device signs the challenge with the private key.
// Backend verifies the signature against the stored public key.

The private key never leaves the authenticator. No secret crosses the network — just a signature over a one-time challenge.

Why it matters for small teams

You don't need an enterprise identity platform to benefit. In 2026, Google Workspace, GitHub, Slack, and basically every major business app accept passkeys out of the box — no new software, no dedicated IT hire.

The payoff is concrete:

The Verizon 2026 DBIR attributes 81% of breaches to stolen or weak passwords.
IBM's 2026 report puts the average breach cost for sub-50-employee businesses at $98,000.
Google measured passkeys cutting login time by ~40% with a higher first-attempt success rate — which for a small shop means fewer reset tickets and "I'm locked out" pings.

Where passwords still hang around

Passkeys aren't a silver bullet. You'll still want a password (or recovery flow) for account bootstrap, legacy systems without WebAuthn support, and cross-device recovery when someone loses their only authenticator. Treat passkeys as the default and passwords as the fallback, not the reverse.

If you're rolling this out across a team, start by enabling passkeys on your highest-value accounts (email, code host, cloud console) and work outward.

Originally published on strongpassfactory.com

Test Published

Kokal Limited — Mon, 13 Jul 2026 13:14:14 +0000