> To the article's defense neither claim was verified, but both claims were reported. When the journalist cannot validate a claim themselves, or with experts, i

> To the article's defense neither claim was verified, but both claims were reported. When the journalist cannot validate a claim themselves, or with experts, it is completely acceptable to report the claim and report the validation status. The reporter says they successfully produced passwords, sounds clean-cut and dry to me. Don't you think this is a pretty important claim to verify, instead of asserting without giving proof? Granted, if a dictionary attack gives you a bunch of 'password' variants, you probably don't need much more evidence. If the reporter is so invested in producing this story, then being able to say "no, these are definitely passwords" in the face of the executive would be the golden ticket, right?