So today is Have I Been Pwned's [https://www.troyhunt.com/introducing-have-i-been-pwned/] (HIBP's) 5th birthday. I started this project out of equal parts community service and curiosity and then somehow, over the last 5 years it's grown into something massive; hundreds of thousands of unique sessions a day, millions of subscribers, working with governments around the world and even fronting up to testify in Congress. I'd love to say I had the foresight to see all this coming but I didn't. Not...

I'm pushing this out a day late so firstly, apologies for the break in what's otherwise a pretty steady cadence. But having said that, as I say at the start of this video I've really been struggling with work / life balance lately. As such, I recorded this Thursday evening then spent most of Friday on the jet ski with my son. We balanced out a lot of work on this trip ? > But check out the scenery! Just stunning. Saw hundreds of turtles, dugongs, mantas and star fish. Just an amazing place. pic...

It's a no-blog week, but that doesn't mean any less is happening! This week, I've finally wrapped up the Lego Bugatti, got myself into the new iPad, connected my washing machine (I know, I know, I didn't plan it this way!) and then isolated it on a separate IoT network. What a time we live in... Oh - and speaking of times we live in, our data is getting thrown around the place like never before thanks to data aggregators and their constant breaches and frankly, I'm a bit fed up with it. All that...

Bit of a change of scenery this week; I've gone to the other end of the house whilst invasive palm tree roots are water blasted out from beneath my office window as part of our garden renos. But hey, that's a nice place to be on a day like this ? Other than the location, it's business as usual. There's been some interesting discussion on biometric this morning, I'm appealing to developers of extensions and add-ons to whitelist themselves when a CSP is present and I'm talking about Google's U2F...

Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet [https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a-password-killer/] and then secondly, about how we all bear some responsibility for making good password choices [https://www.troyhunt.com/when-accounts-are-hacked-victims-must-share-the-blame/]. A few people took some of the points I made in those posts as being contentious, although on reflection I sus...

You know what I really like? A nice, slick, clean set of violation reports from the content security policy (CSP) I run on Have I Been Pwned (HIBP). You know what I really don't like? Logging on to Report URI and being greeted with something like this: This blog post is about how add-ons and extensions in browsers cause CSP violations like the ones above and how they should be dealt with. Some brief background first as I'll be sharing this post with a bunch of folks for which this may be new: A...

Wow, didn't the passwords discussions go nuts this week! Passwords suck and they must die, they're never going to die, people are using bad ones, people should be able to use bad ones, developers are at fault and my personal favourite in the "how on earth did you reach that conclusion" category, I should actually do something to educate people about passwords rather than blaming them for using bad ones. I've gotta stop laying around doing nothing with my days... But seriously, both posts on pas...

It's just another day on the internet when the news is full of headlines about accounts being hacked. Yesterday was a perfect example of that with 2 separate noteworthy stories adorning my early morning Twitter feed. The first one was about HSBC disclosing a "security incident" [https://www.zdnet.com/article/hsbc-discloses-security-incident/] which, upon closer inspection, boiled down to this: > The security incident that HSBC described in its letter seems to fit the characteristics of brute-fo...

A lot has changed in the Microsoft technology world in the last 7 years since I launched ASafaWeb in September 2011 [https://www.troyhunt.com/building-safer-web-with-asafaweb/]. Windows XP is no longer the dominant operating system (Win 7 actually caught up the month I launched ASafaWeb [http://gs.statcounter.com/windows-version-market-share/desktop/worldwide/#monthly-201001-201810] ). Internet Explorer is no longer the dominant browser (Chrome was in 3rd place back then [http://gs.statcounter.c...

These days, I get a lot of messages from people on security related things. Often it's related to data breaches or sloppy behaviour on behalf of some online service playing fast and loose with HTTPS or passwords or some other easily observable security posture. But on a fairly regular basis, I get an email from someone which effectively boils down to this: > Hey, have you seen [insert thing here]? It's totally going to kill passwords! No, it's not and to save myself from repeating the same mess...