Our software swapped [1] for [2] because [2] is listed as the canonical URL in [1].

Which article is better? They both seem pretty good and I'm unclear on the difference.

Contents of the canonical URL appears to change over time by showing the latest blog post, which is currently this[1] that was just published today, not what was originally submitted.

[1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+s...

Ah thanks - let's change to that above instead of https://isc.sans.edu/diary/0.