There is a framing outfit two towns over that runs on three people: the owner, his brother-in-law, and a kid who started as a laborer and now does most of the layout. They pull maybe forty permits a year. All three of them use the same login for the county's online permit portal. Same email address, same password, written on an index card taped inside the door of the job trailer. The password has a capital letter, a number, and an exclamation point, because that is what the portal demanded when the account was created.
Ten years ago, a building official would have looked at that arrangement and seen nothing worth mentioning. Today the same setup is the single weakest thing about how that business operates, and the fix costs about an hour. What changed is not the crew. It is almost everything around them.
What the portal used to be, and what it is now
A decade ago, the county permit system was a place to check a status. You logged in, you saw whether the framing inspection had been scheduled, you logged out. If somebody else got into that account, the worst outcome was that they could read the inspection history on a house you were already working on. Public record, more or less. The account held nothing.
The portal that exists now is a different animal wearing the same name. It stores a payment method, because fees are paid online. It holds the contractor's license number and the certificate of insurance on file. It can schedule and cancel inspections. In many jurisdictions it can accept a contractor's electronic signature on an affidavit, and it sends notices to a single email address of record. That last part is the one people miss. Whoever controls the email address controls the ability to reset the portal password, which means the email account is now a more valuable target than the portal itself.
So the question is no longer "who needs to see the inspection schedule." It is "who should be able to cancel an inspection, change the insurance on file, or move the email of record." Those are three different answers, and one shared index card gives everybody all three.
The advice that got withdrawn, and why it matters on a job trailer
The rules taped inside that trailer door are not the crew's invention. They are the residue of guidance that circulated for roughly fifteen years: eight characters, mixed case, a digit, a symbol, and change it every ninety days. The National Institute of Standards and Technology is the federal body responsible for the digital identity guidelines that most of that advice traced back to, and the guidance moved substantially. Forced periodic rotation fell out of favor. So did mandatory character-class rules. The reasoning was not that complexity is bad. It was that complexity rules and rotation deadlines push people toward predictable patterns, and predictable patterns are exactly what an attacker's software is built to guess.
Watch what the old rules actually produced on that trailer. The password started as a season and a year with an exclamation point. When the portal forced a change, it became the next season and the same year. Three cycles in, anybody who had seen one version could guess the rest. Meanwhile the index card stayed on the door because nobody could hold four rotating variants in their head, and the card was the only thing keeping the crew working.
The current thinking runs the other direction. Length beats character soup. A long passphrase of unrelated words is harder to crack and easier to type on a phone with cold hands. And you change it when there is a reason to change it: someone left, a breach notice arrived, you typed it into something that turned out to be a fake login page. Not on the calendar.
The part that actually moved the needle
If I had one hour with that owner, I would not spend it on password strength. I would spend fifty minutes on two-factor authentication and the email of record, and ten minutes on who gets which account.
Two-factor is the change that separates 2015 from now. Ten years ago it was a niche feature on bank accounts. Today most permit portals, most state contractor license boards, and every major email provider support it, and turning it on means a stolen password alone is no longer enough. The distinction worth knowing: a code sent by text message is meaningfully better than nothing, and an app-generated code or a physical security key is better than the text, because a phone number can be moved to a new carrier by someone who is persuasive on the phone. For a crew that keeps a payment method on file, the app is the right level of effort.
The email of record is the quieter problem. If the portal, the license board, and the insurance certificate all send notices to one address, that address is the master key. It should have the longest passphrase in the business, two-factor turned on, and a recovery method that is not a phone the kid on layout also uses. Ten years ago the email account was where you got messages. Now it is the reset switch for everything else, and that is the shift almost nobody made consciously.
Separate accounts are not a bureaucratic fussiness
Here is the objection I hear, and it is a fair one: three separate logins means three chances for somebody to be locked out at seven in the morning with an inspector already on site. That is a real operational cost, and it is why the index card exists in the first place.
The answer is that most permit portals now support multiple users under one contractor registration, with different permissions. It is worth ten minutes on the phone with the permit clerk to find out whether yours does. Where it does, the arrangement that works is straightforward:
- The owner holds the account that can change the license and insurance on file, and change the email of record. Nobody else needs that.
- Field staff get accounts that can schedule and check inspections, and nothing else. If one of them leaves, you remove one account instead of changing a password everybody knows.
- The payment method sits behind the owner's account, with two-factor on.
Where the portal does not support multiple users, the shared login stays shared, but it stops living on an index card. A password manager on each phone solves it: one shared entry, visible to the three people who need it, revocable when somebody leaves, and long enough that nobody could memorize it anyway. That is the practical version of the change. Not fewer shared credentials. Shared credentials you can take back.
The same decision, ten years apart
Put the two moments side by side. In 2015, a three-person crew sharing one eight-character password for a read-only status page was making a reasonable trade. The account held nothing, the rules told them to churn the password quarterly, and churning it made them write it down. In 2025, that same crew shares a credential that can move money, cancel an inspection on a house with a concrete truck scheduled, and reroute the notices that prove they are insured. The credential got vastly more valuable. The habits did not move with it.
What I like about this particular case is how finite the work is. There is no new software to buy and no consultant to hire. Turn on two-factor for the email of record. Replace the index card password with a long passphrase stored in a manager the crew can reach from their phones. Call the permit office and ask whether the registration supports separate users, then set them up if it does. Stop changing the password on a schedule and start changing it on an event.
An afternoon, once. The crew that does it stops carrying a risk that has quietly grown for a decade while the index card stayed the same.