Troy Hunt

Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals

Welcoming the Finnish Government to Have I Been Pwned

Today I'm very happy to welcome the Finnish government to Have I Been Pwned by granting their National Cyber Security Centre full and free access to query their government domains. API access to query their domains will give them greater visibility into the impact of data breaches on the Finnish government. Finland is now the 5th Nordic country and 21st national CERT to be onboarded with many more from around the globe to be announced shortly....

Weekly Update 247

Lots of stuff going on this week, beginning with me losing my mind try to get local control of IoT devices. I'm writing up a much more extensive blog post on this, suffice to say it's a complete mess and all of the suggestions I've had have been well-intentioned, but infeasible for various reasons. But as I say in the video, it has all been worth it and I do get a lot of enjoyment from playing with it all 😊 That and many other cyber things in this week's update. ReferencesTrying to get local control of Tuya lights is an exercise in absolute futility (read the thread to feel my pain 😭)A scammer tried to use the W3C validator to...

Nameless Malware Discovered by NordLocker is Now in Have I Been Pwned

I've had a couple of cases to date where email addresses compromised by malware then discovered in the course of investigations have been provided to Have I Been Pwned (HIBP). Firstly by the Estonian Central Criminal Police a few years ago, then by the FBI and global counterparts this April and now, in the third such case, by NordLocker. (Full disclosure: I'm a strategic advisor for NordVPN who shares the same parent company.) NordLocker has written about the nameless malware that stole 1.2 TB of private data and the first sentence sets the scene: Between 2018 and 2020, a custom Trojan-type malware infiltrated over 3 million Windows-based computers and stole 1.2 terabytes (TB) of personal informationNordLocker goes into...

Expanding the Have I Been Pwned Volunteer Community

Ever notice how there was a massive gap of almost 9 months between announcing the intention to start open sourcing Have I Been Pwned (HIBP) in August last year and then finally a couple of weeks ago, actually taking the first step with Pwned Passwords? Many people certainly noticed the time because I kept getting asked when it was actually going to happen. With the best of intentions, people wondered why I hadn't just done it already because hey, this was going to make my life easier, right? Uh, no. Along with a heap of other moving parts I needed to get on top of before starting to open up code, one thing that kept me up at night was...

Welcoming the Uruguayan Government to Have I Been Pwned

This week as part of the ongoing initiative to make breach data available to national governments, I'm very happy to welcome the national CERT of Uruguay, CERTuy. They are now the 2nd Latin American country and 20th country worldwide to have free and easy API level access to all their government domains. I'm going to continue onboarding governments as they reach out and ask for access, my hope being that greater visibility to the impact of data breaches helps minimise the disruption they cause to government departments across the globe....

Weekly Update 246

This week has been absolutely dominated by code contributions to Pwned Passwords. This is such an awesome, humbling experience that so many people have wanted to contribute their time to something that makes online life better for all of us. The challenge I have now is, as expected, managing the pull requests, reviewing code and ensuring the project heads in the right direction as support for ingesting the FBI -provided passwords is built out. I have an idea around that I'm working on at the moment and hope to be able to talk more about it soon. In the interim, keep the contributions coming and I look forward to seeing all this go out to production in the very near...

Welcoming the Belgian Government to Have I Been Pwned

Supporting national CERTs with free API domain searches across their assets is becoming an increasing focus for Have I Been Pwned and today I'm happy to welcome the 19th government on board, Belgium. As of now, the Centre for Cyber Security Belgium (CCB) has full access to query all their gov domains and gain deeper visibility into the impact of data breaches on their departments. Extending HIBP's reach to more governments around the world helps amplify the usefulness of the project and I look forward to welcoming many more national CERTs in the future....

Welcoming the Dominican Republic Government to Have I Been Pwned

Continuing with the launch of the Have I Been Pwned Domain Search API to national government cyber agencies, I am very happy to welcome the first Latin American country on board, the Dominican Republic. Their National Cybersecurity Incident Response Team (CSIRT-RD) is the 18th national CERT that has free and open access to domain inquiries across all of its government assets. Each of these announcements results in a large number of additional government requests. I will continue to welcome new national CERTs on a regular cadence and look forward to seeing many other parts of the world represented in the future....

Weekly Update 245

This week is the culmination of planning that began all the way back in August last year when I announced the intention to start open sourcing the HIBP code base. Today, it's finally happened with Pwned Passwords now completely open to all. That's only been possible with the help of the .NET Foundation because as I've said many times now, this is new territory for me. And just to make things really interesting, we're all going to build some code for the FBI to feed passwords obtained in the process of their various investigations into HIBP. Cool 😎 ReferencesPwned Passwords, the .NET Foundation and the FBI (this is just awesome from top to bottom 😎)The IoT march forward continues, this time...

Pwned Passwords, Open Source in the .NET Foundation and Working with the FBI

I've got 2 massive things to announce today that have been a long time in the works and by pure coincidence, have aligned such that I can share them together here today. One you would have been waiting for and one totally out of left field. Both these announcements are being made at a time where Pwned Passwords is seeing unprecedented growth: Getting closer and closer to the 1B requests a month mark for @haveibeenpwned's Pwned Passwords. 99.6% of those have come direct from @Cloudflare's cache too 😎 pic.twitter.com/zRRbkhT27P — Troy Hunt (@troyhunt) May 27, 2021 That's significant because the sheer volume of requests greatly amplifies the effectiveness of the announcements below. So,...