I had a crazy trip to the Norwegian Developers Conference in Oslo this month; 2 days of workshops, a user group presentation, 2 conference talks, a podcast and a panel discussion. Despite the craziness of it all though, I was massively pleased that after the dust settled on the more than 150 speakers presenting over 200 talks, I found myself up here: Those little buzzers in front of the screen were hit on the way out and it so happened that I had a huge number of the green ones selected for...

During my travels over recent weeks I’ve been doing a quick demo that works like this: First, I open up the dev tools in Chrome and select the network tab. Second, I load up americanexpress.com [http://americanexpress.com] and show the network requests: I point out how the first one goes out over HTTP because this is what browsers do when you don’t explicitly enter a scheme such as “https://”. The server responds to this request with an HTTP 301 “Moved Permanently” and a “location” header w...

You know how you like free stuff? And cloud? And security? Of course you do – what’s not to like?! Well because Pluralsight and CloudFlare love it, we’re making my latest course available to everyone 100% for free for the next week [https://get.pluralsight.com/free-weekly-course.html]. [https://get.pluralsight.com/free-weekly-course.html] This is a great course for anyone who wants a very slick way of quickly adding SSL and raft of other security features to their site with a bare minimum of...

I’ve had a week and a bit playing with the Apple Watch, pretty much all of that time being on flights and at events which is probably not a normal usage representation, but it’s certainly given me a chance to give it a good workout. Some stuff is good, some is bad and a bunch of it is quite frankly absolutely pointless. But I expected that – it’s what you get with first gen tech – what I was more interested in is how it changes the way I might do otherwise normal everyday stuff. Pictures speak...

A couple of weeks ago I did a free webinar on Pluralsight titled Why SQL Injection Remains the #1 Web Security Risk Today (and what you should know about it) [https://get.pluralsight.com/webinar_why_sql_injection_remains_the_1_web_security_risk_today.html] . This is a rather self-explanatory title and it’s completely true – SQL injection remains a big thing and we keep getting it wrong. Like an example? Only 8 months ago, Drupal had a major vulnerability in their product [https://www.drupal.org/...

You may not realise this, but you use CloudFlare [https://www.cloudflare.com/]. You probably use it every day and you do so without even realising it. You reap numerous benefits from it as well but they’re seamless – it just makes your browsing experience better. By better I mean faster and most importantly in the context of this blog post and my latest Pluralsight course [http://www.pluralsight.com/courses/cloudflare-security-getting-started], more secure. Unless you’re an attacker in which cas...

There’s been a huge amount of activity on Have I been pwned? [https://haveibeenpwned.com/] (HIBP) in recent weeks, particularly in the wake of the Adult Friend Finder breach [http://time.com/3893946/adultfriendfinder-data-breach/] which drew a lot of attention. The activity has comprised of organic browser-based traffic as well hits to the API [https://haveibeenpwned.com/API/v2]. The latter in particular is interesting as you can see a steady rate of traffic (or a steady increase of traffic) sud...

For the first time in about as long as I can remember, I’m at a conference and not actually presenting anything. It’s enormously liberating actually and it’s allowed me to soak up a heap of info without being preoccupied with actually, well, doing stuff. Mind you, I’m chairing half a dozen sessions at AusCERT 2015 but that amounts to introducing someone, sitting back to enjoy their talk then thanking them very much. Anyway, all this sitting around and watching other people talk about technology...

I get a lot of this sort of thing: “Hey, how come your site only gets a B grade on the SSL Labs test?” They’re referring to my Have I been pwned? [https://haveibeenpwned.com/] (HIBP) site and they’re right, it only scores a B grade [https://www.ssllabs.com/ssltest/analyze.html?d=haveibeenpwned.com]: [https://www.ssllabs.com/ssltest/analyze.html?d=haveibeenpwned.com] The killer blow here is highlighted in orange – RC4. It’s a weak cipher by today’s terms and evidently it’s capped my grade lo...

It’s the “Hack Yourself First” trilogy: Watch the talk [https://yow.eventer.com/yow-2014-1222/hack-yourself-first-go-on-the-cyber-offence-before-online-attackers-do-by-troy-hunt-1698] , take the Pluralsight course [http://www.pluralsight.com/courses/hack-yourself-first] and now you can spend a couple of days with me in Amsterdam next month on June 22 and 23 doing the workshop [https://training.xebia.com/developer-skills/hack-yourself-first-how-to-go-on-the-cyber-offence/] . I’ve teamed up with X...