Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals
Visit troyhunt.com → RSS feedOn Hacker News May 2011 – Aug 2026
Security & Privacy 111Web & Frontend 16Tech Industry & Business 12Society, Policy & Culture 6Hardware & Electronics 5Tools & Productivity 4
What if I told you... that you can get visitors to your site to automatically check for a bunch of security issues. And then, when any are found, those visitors will let you know about it automatically. And the best bit is that you can set this up in a
I got a rather odd invoice via PayPal the other day, it looks like this: Naturally the first thing I did was to look for spoof email indicators, but none of the usual suspects were showing up: 1. It was from member@paypal.com.au 2. The mail headers were
Last week I wrote about how Life Is About to Get a Whole Lot Harder for Websites Without HTTPS [https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/]. Somewhere in the comments there, the discussion went off on a tangent about commercial CAs, the threat
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Recently I’ve had a couple of opportunities to think again about how a secure password reset function should operate, firstly whilst building this…
It feels like not a week goes by without someone sending me yet another credential stuffing list. It's usually something to the effect of "hey, have you seen the Spotify breach", to which I politely reply with a link to my old No, Spotify Wasn't Hacked blog post
Yesterday I had a bunch of people point me at a tweet from a politician in the UK named Nadine Dorries [https://twitter.com/NadineDorries]. As it turns out, some folks were rather alarmed about her position on sharing what we would normally consider to be a secret. In this
It happened again last week. No, not Yahoo! Voices [https://www.troyhunt.com/2012/07/what-do-sony-and-yahoo-have-in-common.html], not the Phandroid Android forums [http://www.zdnet.com/android-forums-hacked-1-million-user-credentials-stolen-7000000817/] , not NVidia [http://www.zdnet.com/nvidia-confirms-
The first time I ever wrote publicly about a company's security vulnerabilities, my boss came to have a word with me after seeing my name in the news headlines. One of the worst days I've ever had was right in the middle of the Have I Been Pwned
Been a lot of "victim blaming" going on these last few days. The victim, through no fault of their own, has been the target of numerous angry tweets designed to ridicule their role in internet security and suggest they are incapable of performing their duty. Here's where it all
I’ve been considering purchasing one of these t-shirts: This shirt would announce to everyone who crosses my path that I am, in fact, the world’s greatest lover. They would know this because I have a t-shirt that tells them so and it would give them enormous
It’s a bit hard to even know where to begin with this one, perhaps at the start and then I’ll try and piece all the bits together as best I can. As you may already know if you’re familiar with this blog, I run the service Have
Let's start with a quick quiz: Take a look at haveibeenpwned.com [https://haveibeenpwned.com/] (HIBP) and tell me where the traffic is encrypted between: You see HTTPS which is good so you know it's doing crypto things in your browser, but where's the other end of
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
There's a "hidden" API on HIBP. Well, it's not "hidden" insofar as it's easily discoverable if you watch the network traffic from the client, but it's not meant to be called directly, rather only via the web app. It's called "unified search" and it looks
Last month I was over in Norway doing training for ProgramUtvikling, [http://programutvikling.no/] the good folks who run the NDC conferences I've become so attached to. I was running my usual “Hack Yourself First” workshop [https://www.troyhunt.com/2016/02/more-europe-even-more-again-and-more.
HTTPS or SSL or TLS or whatever you want to call it can be a confusing beast. Some say it’s just about protecting your password and banking info whilst the packets are flying around the web but I’ve long said that SSL is not about encryption [https://www.
Let me start with this headline [http://www.reuters.com/article/us-cyber-passwords-idUSKCN0XV1I6]: Other headlines went on to suggest that you need to change your password right now [http://www.iflscience.com/technology/millions-passwords-hotmail-gmail-and-yahoo-have-been-stolen] if you're using the likes
That's it - I'm calling it - HTTPS adoption has now reached the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] where it's gathering enough momentum that it will very shortly become "the norm" rather than the exception it so frequently was in the past.
A couple of months ago, I launched version 2 of Pwned Passwords [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/]. This is a collection of over half a billion passwords which have previously appeared in data breaches and the intention is that they're used as a
If you've landed on this page because you saw a strange message on a completely different website then followed a link to here, drop a note to the site owner and let them know what happened. If, on the other hand, you're on this page because you're
Who wants free stuff? C’mon, everybody wants a free lunch, right? Yes, yes they do and that’s precisely the trigger used in scams like this one. Recently I wrote about the mechanics of another Facebook scam [https://www.troyhunt.com/2012/10/she-did-what-in-school-mechanics-
Over the weekend, a Have I Been Pwned [https://haveibeenpwned.com/] (HIBP) subscriber contacted me after they found their Spotify credentials online. It turns out that this particular woman went searching for her specific password after finding "some guy listening to Mexican music from a foreign device on my acct"
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
If you’re a regular reader, you may have noticed a rather major job change on my behalf [https://www.troyhunt.com/2015/05/so-dust-has-finally-settled.html] recently. The day to day office grind has gone and corporate life is now well and truly behind me, where
I tweeted this the other day, and the internet was not pleased: > HTTPS is slow. No - wait - is it HTTP that's slow?! https://t.co/T49GG7oCaK pic.twitter.com/cfnYOpXMWc [https://t.co/cfnYOpXMWc] — Troy Hunt (@troyhunt) July 8, 2016 [https://twitter.com/troyhunt/status/751317949349130240] In fact, a
The tech news recently has seen quite a lot of chatter about an alleged haul of Apple credentials [http://www.zdnet.com/article/apple-icloud-ransom-what-you-need-to-know/], apparently about 250 million of them in all. Allegedly. Maybe. Or was it 300 million? [https://www.macrumors.com/
I love a good XKCD comic; Randall Munroe has a unique way of cutting right to the crux of technology issues and always doing it in a humorous fashion. Little Bobby Tables [http://xkcd.com/327/] remains an all-time classic and it’s amazing how many times you’ll
Spoiler: I have data from the story in the title of this post, it's mostly what I expected it to be, I've just added it to HIBP where I've called it "Data Troll", and I'm going to give everyone a lot more context below. Here goes:
I heard about this guy, walked into a federal bank with a portable phone, handed the phone to the teller, the guy on the other end of the phone said: “We got this guy’s little girl, and if you don’t give him all your money, we’re gonna
My son turned 7 earlier this month. I've been getting him into coding [https://www.troyhunt.com/kids-and-code-simple-programming-on/] and teaching him the fundamentals of using a PC which I reckon is a pretty essential life skill these days. Part of that is helping him