NM-011: Account creation standard

1. Requirements

1. A username used nowhere else, on any platform, ever
2. A password generated by a local manager rather than composed
3. The recovery phrase written on paper and stored away from the device
4. PGP two factor enabled at creation rather than later
5. The signing key backed up offline the same day it is generated

2. The irreversible decision

Passwords can be changed and keys can be rotated. A username that also exists on a forum you have posted to for years cannot be unlinked afterwards, because the association was created the moment both existed. This is the only requirement here with no repair path, which is why it appears first.

3. Two factor

With PGP two factor enabled, signing in requires proving control of a key as well as knowing the password. A credential leak becomes an inconvenience rather than the loss of the account. The corresponding risk is losing the key, which is why the backup requirement is stated in the same document rather than separately.

4. Recovery material handling

The recovery phrase restores the account and is therefore the object every phishing page is built to collect. It belongs on paper. It does not belong in a synced note, a screenshot, or any web form, including one that presents itself as an account recovery tool.

5. Verification

This standard is met when a leaked password alone would not open the account, a lost device would not lose the account, and nothing about the username connects to any identity you hold elsewhere.