I always find data breaches like today’s Ashley Madison one [http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/] curious in terms of how people react. But this one is particularly curious because of the promise of “discreet” encounters: Of course when the modus operandi of the site is to facilitate extramarital affairs then “discreet” is somewhat of a virtue… if they actually were discreet about their customers’ identities! This all made me think back to the Adult...

If you’re a regular reader, you may have noticed a rather major job change on my behalf [https://www.troyhunt.com/2015/05/so-dust-has-finally-settled.html] recently. The day to day office grind has gone and corporate life is now well and truly behind me, where it will firmly stay. One of the things that amazed me most when I finally wrote about this is how surprised so many people were that I actually had a normal day job: > Can't believe @troyhunt [https://twitter.com/troyhunt] had another jo...

So this has been getting quite a bit of airtime today: > @Sacro [https://twitter.com/Sacro] Hi Ben, I understand but as a business we've chosen not to have the compatibility with password managers. Thanks, Joe — British Gas Help (@BritishGasHelp) July 14, 2015 [https://twitter.com/BritishGasHelp/status/620956147680432128] Yes, it’s ridiculous and British Gas are getting the lambasting they so deserve, but egregious security faux pas is hardly a new thing for them: > @passy [https://twitter....

This is really not what you ever want to see on your own site: It’s a JavaScript prompt and no, it’s not meant to be there. Someone had successfully mounted an XSS attack against this very website! Now I’ve written a lot about XSS, I’ve authored multiple Pluralsight courses that talk about it in detail and I’ve run many workshops on the topic teaching others the very mechanics of how cross site scripting works. Yet here we are – XSS on my own blog. Fortunately, this was discovered by frien...

Over the last week, the Hacking Team story has absolutely exploded. It’s dominated the security news, featured heavily in tech publications and regularly appeared in the mainstream press. The 400GB of data leaked has been extensively torrented, mirrored and reproduced then of course commentated on at length in various articles and social media pieces. In terms of public breaches, this is as exposed as data gets. Clearly, this incident is also highly controversial. Hacking Team has long been und...

Recent I wrote about Speaker style bingo [https://www.troyhunt.com/2015/06/speaker-style-bingo-10-presentation.html] which called out a bunch of common anti-patterns I see (and indeed have done myself) in technical talks. If I’m honest, I’m a bit surprised at how much attention that post garnered and it appears to have really resonated with people. When I wrote that post, I was back home but between speaking events in Europe so was both reflecting on the talks I’d just done and preparing for the...

I hate getting notices like this one from a few hours ago: I’ve had many of these already over the years and I’m sure I’ll see many more in the years to come, that’s just how the web seems to work these days. But here’s what really got my attention in Plex’s email today: > We're sorry for the inconvenience, but both your privacy and security are very important to us Oh good, feeling much better now! So privacy and security are important, but with the benefit of hindsight, probably not imp...

I had a crazy trip to the Norwegian Developers Conference in Oslo this month; 2 days of workshops, a user group presentation, 2 conference talks, a podcast and a panel discussion. Despite the craziness of it all though, I was massively pleased that after the dust settled on the more than 150 speakers presenting over 200 talks, I found myself up here: Those little buzzers in front of the screen were hit on the way out and it so happened that I had a huge number of the green ones selected for...

During my travels over recent weeks I’ve been doing a quick demo that works like this: First, I open up the dev tools in Chrome and select the network tab. Second, I load up americanexpress.com [http://americanexpress.com] and show the network requests: I point out how the first one goes out over HTTP because this is what browsers do when you don’t explicitly enter a scheme such as “https://”. The server responds to this request with an HTTP 301 “Moved Permanently” and a “location” header w...

You know how you like free stuff? And cloud? And security? Of course you do – what’s not to like?! Well because Pluralsight and CloudFlare love it, we’re making my latest course available to everyone 100% for free for the next week [https://get.pluralsight.com/free-weekly-course.html]. [https://get.pluralsight.com/free-weekly-course.html] This is a great course for anyone who wants a very slick way of quickly adding SSL and raft of other security features to their site with a bare minimum of...