A grants-office researcher reuses the city's email password on a sock-puppet account. What uniqueness rule should they follow?
Select an answer to reveal the explanation.
Short Explanation
Same password on the sock puppet and the city inbox is one key for the front door and the fake mustache. If the persona leaks, the mailbox goes with it. Unique secrets keep a burned research account from opening municipal email.
Full Explanation
A research account must have its own password so a persona compromise does not unlock municipal email. Reusing the city's email password on a sock-puppet account creates credential reuse that turns a platform breach into an inbox breach for the grants office. Claiming reuse is required so single sign-on can recover the persona during an audit invents a recovery model that endangers production mail. Using a shorter version of the civic password still leaks enough material for cracking and remains reuse. Storing the shared password in the public grants FAQ so backups are unnecessary publishes secrets. Exam caveat: password managers should generate unique high-entropy secrets for each persona without deriving them from civic credentials. Operational check: rotate any persona password that ever matched or derived from municipal email credentials, and verify the civic mailbox password was not reused elsewhere. Keep the civic purpose, method limits, and exhibit labels aligned so reviewers can see what was public-source work versus other authorities. Document residual uncertainty explicitly rather than implying completeness. Prefer reversible public methods and preserve exhibits that a second analyst can reopen without guessing.