Remove unintentional file used for testing
Browse files
boop
DELETED
@@ -1,536 +0,0 @@
|
|
1 |
-
[INST]Summarize the following article:
|
2 |
-
|
3 |
-
Link: canonical
|
4 |
-
Link: webmention
|
5 |
-
Mastodon
|
6 |
-
[ Submit ]
|
7 |
-
* Home
|
8 |
-
* Workshops
|
9 |
-
* Speaking
|
10 |
-
* Media
|
11 |
-
* About
|
12 |
-
* Contact
|
13 |
-
* Sponsor
|
14 |
-
* * * * * Sponsored by:
|
15 |
-
|
16 |
-
A Decade of Have I Been Pwned
|
17 |
-
|
18 |
-
* * * * * 04 December 2023
|
19 |
-
|
20 |
-
A decade ago to the day, I published a tweet launching what would
|
21 |
-
surely become yet another pet project that scratched an itch, was
|
22 |
-
kinda useful to a few people but other than that, would shortly
|
23 |
-
fade away into the same obscurity as all the other ones I'd
|
24 |
-
launched over the previous couple of decades:
|
25 |
-
|
26 |
-
It's alive! "Have I been pwned?" by @troyhunt is now up and
|
27 |
-
running. Search for your account across multiple breaches
|
28 |
-
http://t.co/U0QyHZxP6k
|
29 |
-
|
30 |
-
— Have I Been Pwned (@haveibeenpwned) December 4, 2013
|
31 |
-
|
32 |
-
And then, as they say, things kinda escalated quickly. The very
|
33 |
-
next day I published a blog post about how I made it so fast to
|
34 |
-
search through 154M records and thus began a now 185-post epic
|
35 |
-
where I began detailing the minutiae of how I built this thing,
|
36 |
-
the decisions I made about how to run it and commentary on all
|
37 |
-
sorts of different breaches. And now, a 10th birthday blog post
|
38 |
-
about what really sticks out a decade later. And that's precisely
|
39 |
-
what this 185th blog post tagging HIBP is - the noteworthy things
|
40 |
-
of the years past, including a few things I've never discussed
|
41 |
-
publicly before.
|
42 |
-
|
43 |
-
Pwned?
|
44 |
-
|
45 |
-
You know why it's called "Have I Been Pwned"? Try coming up with
|
46 |
-
almost any conceivable normal sounding English name and getting a
|
47 |
-
.com domain for it. Good luck! That was certainly part of it, but
|
48 |
-
another part of the name choice was simply that I honestly didn't
|
49 |
-
expect this thing to go anywhere. It's like I said in the intro of
|
50 |
-
this post where I fully expected this to be another failed
|
51 |
-
project, so why does the name matter?
|
52 |
-
|
53 |
-
But it's weird how "pwned" has stuck and increasingly, become
|
54 |
-
synonymous with HIBP. For many people, the first time they ever
|
55 |
-
hear the word is in the context of "Have I Been..." with an
|
56 |
-
ensuing discussion often explaining the origins of the term as it
|
57 |
-
relates to gaming culture. And if you do go and look for a
|
58 |
-
definition of the term online, you'll come across resources such
|
59 |
-
as How “PWNED” went from hacker slang to the internet’s favourite
|
60 |
-
taunt:
|
61 |
-
|
62 |
-
Then in 2013, when various web services and sites saw an uptick
|
63 |
-
in personal data breaches, security expert Troy Hunt created the
|
64 |
-
website “Have I Been Pwned?” Anyone can type in an email address
|
65 |
-
into the site to check if their personal data has been
|
66 |
-
compromised in a security breach.
|
67 |
-
|
68 |
-
And somehow, this little project is now referenced in the
|
69 |
-
definition of the name it emerged from. Weird.
|
70 |
-
|
71 |
-
But, because it's such an odd name that has so frequently been
|
72 |
-
mispronounced or mistyped, I've ended up with a whole raft of
|
73 |
-
bizarre domain names including haveibeenpaened.com,
|
74 |
-
haveibeenpwnded.com, haveibeenporned.com and my personal
|
75 |
-
favourite, haveibeenprawned.com (because a journo literally
|
76 |
-
pronounced it that way in a major news segment 🤦♂️). Not to
|
77 |
-
mention all the other weird variations including
|
78 |
-
haveibeenburned.com, haveigotpwned.com, haveibeenrekt.com and
|
79 |
-
after someone made the suggestion following the revelation that
|
80 |
-
PornHub follows me, haveibeenfucked.com 🤷♂️
|
81 |
-
|
82 |
-
Press
|
83 |
-
|
84 |
-
It's difficult to even know where to start here. How does the
|
85 |
-
little site with the weird name end up in the press? Inevitably,
|
86 |
-
"because data breaches", and it's nuts just how much exposure this
|
87 |
-
project has had because of them. These are often mainstream news
|
88 |
-
events and what reporters often want to impart to people is along
|
89 |
-
the lines of "Here's what you should do if you've been impacted",
|
90 |
-
which often boils down to checking HIBP.
|
91 |
-
|
92 |
-
Press is great for raising awareness of the project, but it has
|
93 |
-
also quite literally DDoS'd the service with the Martin Lewis
|
94 |
-
Money Show in the UK knocking it offline in 2016. Cool! No, for
|
95 |
-
real, I learned some really valuable lessons from that experience
|
96 |
-
which, of course, I shared in a blog post. And then ensured could
|
97 |
-
never happen again.
|
98 |
-
|
99 |
-
Back in 2018, Gizmodo reckoned HIBP was one of the top 100
|
100 |
-
websites that shaped the internet as we knew it, alongside the
|
101 |
-
likes of Wikipedia, Google, Amazon and Goatse (don't Google it).
|
102 |
-
Only the year after it launched, TIME magazine reckon'd it was one
|
103 |
-
of the 50 best websites of the year. And every time I do a Google
|
104 |
-
search for a major news outlet, I find this little website. The
|
105 |
-
Wall Street Journal. The Standard (nice headline!) USA Today.
|
106 |
-
Toronto Star. De Telegraaf. VG. Le Monde. Corriere della Sera.
|
107 |
-
It's wild - I just kept Googling for the largest newspapers in
|
108 |
-
various parts of the world and kept getting hits!
|
109 |
-
|
110 |
-
The point is that it's had impact, and nobody is more surprised
|
111 |
-
about that than me.
|
112 |
-
|
113 |
-
Congress
|
114 |
-
|
115 |
-
How on earth did I end up here?!
|
116 |
-
|
117 |
-
6 years and a few days ago now, I found myself in a place I'd only
|
118 |
-
ever seen before in the movies: Congress. American Congress.
|
119 |
-
Saying "pwned"!
|
120 |
-
|
121 |
-
For reasons I still struggle to completely grasp, the folks there
|
122 |
-
thought it would be a good idea if I flew to the other side of the
|
123 |
-
world and talked about the impact of data breaches on identity
|
124 |
-
verification. "You know they're just trying to get you to DC so
|
125 |
-
they can arrest you for all that stolen data you have, right?! 🤣",
|
126 |
-
the internet quipped. But instead, I had one of the most memorable
|
127 |
-
moments of my career as I read my testimony (these are public
|
128 |
-
hearings so it's all recorded and available to watch), responded
|
129 |
-
to questions from congressmen and congresswomen and rounded out
|
130 |
-
the trip staring down at where they inaugurate presidents:
|
131 |
-
|
132 |
-
Today, that photo adorns the wall outside my office and dozens of
|
133 |
-
times a day I look at it and ask the same question - how did it
|
134 |
-
all lead to this?!
|
135 |
-
|
136 |
-
Svalbard
|
137 |
-
|
138 |
-
The potential sale of HIBP was a very painful, very expensive
|
139 |
-
chapter of life, announced in a blog post from June 2019. For the
|
140 |
-
most part, I was as transparent and honest as I could be about the
|
141 |
-
reasons behind the decision, including the stress:
|
142 |
-
|
143 |
-
To be completely honest, it's been an enormously stressful year
|
144 |
-
dealing with it all.
|
145 |
-
|
146 |
-
More than one year later, I finally wrote about the source of so
|
147 |
-
much of that stress: divorce. Relationship circumstances had put a
|
148 |
-
huge amount of pressure on me and I needed a relief valve which at
|
149 |
-
the time, I thought would be the sale of the project I loved so
|
150 |
-
much but was becoming increasingly demanding. Ultimately, Project
|
151 |
-
Svalbard (the code name for the sale of HIBP), had the opposite
|
152 |
-
effect as years of bitter legal battles with my ex ensued, in part
|
153 |
-
due to the perceived value that would have been realised had it
|
154 |
-
been sold and some big tech company owned my arse for years to
|
155 |
-
come. The project I built out of a passion to do community good
|
156 |
-
was now being used as a tool to extract as much money out of me as
|
157 |
-
possible. There's a wild story to be told there one day but whilst
|
158 |
-
that saga is now well and truly behind me, the scars are still
|
159 |
-
raw.
|
160 |
-
|
161 |
-
There were many times throughout Project Svalbard where I felt
|
162 |
-
like I was living out an episode of Silicon Valley, especially as
|
163 |
-
I hopped between interviews at the who's-who of tech firms in San
|
164 |
-
Francisco to meet potential acquirers. But there was one moment in
|
165 |
-
particular that I knew at the time would form an indelible memory,
|
166 |
-
so I took a photo of it:
|
167 |
-
|
168 |
-
I'm sitting in a rental car in Yosemite whilst driving from the
|
169 |
-
aforementioned meetings in SF and onto Vegas for the annual big
|
170 |
-
cyber-events. I had a scheduled call with a big tech firm who was
|
171 |
-
a potential acquirer and should that deal go through, the guy I
|
172 |
-
was speaking to would be my new boss. I'd done that dozens of
|
173 |
-
times by now and I don't know if it was because I was especially
|
174 |
-
tired or emotional or if there was something in the way he phrased
|
175 |
-
the question, but this triggered something deep inside me:
|
176 |
-
|
177 |
-
So Troy, what would your perfect day in the office look like?
|
178 |
-
|
179 |
-
I didn't say it this directly, but I kid you not this is exactly
|
180 |
-
what popped into my mind:
|
181 |
-
|
182 |
-
I get on my jet ski and I do whatever the fuck I want
|
183 |
-
|
184 |
-
My potential new overlord had somehow managed to find exactly the
|
185 |
-
raw nerve to touch that made me realise how valuable independence
|
186 |
-
had become to me. 6 months later, Project Svalbard was dead after
|
187 |
-
a deal I'd struck fell through. I still can't talk about the
|
188 |
-
precise circumstances due to being NDA'd up to wazoo, but the term
|
189 |
-
we chose to use was "a change of business circumstances on behalf
|
190 |
-
of the purchaser". With the benefit of hindsight, I've never been
|
191 |
-
so happy to have lost so much 😊
|
192 |
-
|
193 |
-
The FBI
|
194 |
-
|
195 |
-
10 years ago, I certainly didn't see this on the cards:
|
196 |
-
|
197 |
-
This is so cool, thanks @FBI 😊 pic.twitter.com/aqMi3as91O
|
198 |
-
|
199 |
-
— Troy Hunt (@troyhunt) June 28, 2023
|
200 |
-
|
201 |
-
Nor did I expect them to be actively feeding data into HIBP. Or
|
202 |
-
the UK's NCA to be feeding data in. Or various other law
|
203 |
-
enforcement agencies the world over. And I never envisioned a time
|
204 |
-
where dozens of national governments would be happy to talk about
|
205 |
-
using the service.
|
206 |
-
|
207 |
-
A couple of months ago, the ABC wrote a long piece on how this
|
208 |
-
whole thing is, to use their term, a strange sign of the times.
|
209 |
-
|
210 |
-
He’s just “a dude on the web”, but Troy Hunt has ended up
|
211 |
-
playing an oddly central role in global cybersecurity.
|
212 |
-
|
213 |
-
It's strange until you look at through the lens of aligned
|
214 |
-
objectives: the whole idea of HIBP was "to do good things after
|
215 |
-
bad things happen" which is well aligned with the mandates of law
|
216 |
-
enforcement agencies. You could call it... common ground:
|
217 |
-
|
218 |
-
IFrame
|
219 |
-
|
220 |
-
This is something I suspect a lot of people don't understand -
|
221 |
-
that law enforcement agencies often work in conjunction with
|
222 |
-
private enterprise to further their goals of protecting people
|
223 |
-
just like you and me. It's something I certainly didn't understand
|
224 |
-
10 years ago, and I still remember the initial surprise when
|
225 |
-
agencies started reaching out. Many years on, these have become
|
226 |
-
really productive relationships with a bunch of top notch people,
|
227 |
-
a number of whom I now count as friends and make an effort to
|
228 |
-
spend time with on my travels.
|
229 |
-
|
230 |
-
Passwords
|
231 |
-
|
232 |
-
This was never on the cards originally. In fact, I'd always been
|
233 |
-
adamant that there should never be passwords in HIBP although in
|
234 |
-
my defence, the sentiment was that they should never appear next
|
235 |
-
to the username to which they originally accompanied. But looking
|
236 |
-
at passwords through the lens of how breach data can be used to do
|
237 |
-
good things, a list of known compromised passwords disassociated
|
238 |
-
from any form of PII made a lot of sense. So, in 2017, Pwned
|
239 |
-
Passwords was born. You know what I was saying earlier about
|
240 |
-
things escalating quickly? Yeah:
|
241 |
-
|
242 |
-
Setting all new records for Pwned Passwords this week: biggest
|
243 |
-
day ever yesterday at 282M requests and biggest rolling 30 days
|
244 |
-
ever, now passing the 6 *billion* requests mark!
|
245 |
-
pic.twitter.com/dQiuQim3da
|
246 |
-
|
247 |
-
— Troy Hunt (@troyhunt) September 12, 2023
|
248 |
-
|
249 |
-
As if to make the point, I just checked the latest stats and last
|
250 |
-
week we did 301.6M requests in a single day. 100% of those
|
251 |
-
requests - and that's not a rounded number either, it's
|
252 |
-
100.0000000000% - were served from Cloudflare's cache 🤯
|
253 |
-
|
254 |
-
There's so much I love about this service. I love that it's free,
|
255 |
-
there's no auth, it's entirely open source (both code and data),
|
256 |
-
the FBI feeds data into it and perhaps most importantly, it has
|
257 |
-
real impact on security. It's such a simple thing, but every time
|
258 |
-
you see a headline such as "Big online website hit with credential
|
259 |
-
stuffing attack", a significant portion of the accounts being
|
260 |
-
taken over have passwords that could easily have been blocked.
|
261 |
-
|
262 |
-
The Paradox of Handling Data Breaches
|
263 |
-
|
264 |
-
On multiple occasions now, I've had conversations that can best be
|
265 |
-
paraphrased as follows:
|
266 |
-
|
267 |
-
Random Internet Person: I'm going to report you to the FBI for
|
268 |
-
having all that stolen data
|
269 |
-
|
270 |
-
Me: Maybe you should start by Googling "troy hunt fbi" first...
|
271 |
-
|
272 |
-
But I understand where they're coming from and the paradox I refer
|
273 |
-
to is the perceived conflict between handling what is usually the
|
274 |
-
output of a crime whilst simultaneously trying to perform a
|
275 |
-
community good. It's the same discussion I've often had with
|
276 |
-
people citing privacy laws in their corner of the world (often the
|
277 |
-
EU and GDPR) as the reason why HIBP shouldn't exist: "but you're
|
278 |
-
processing data without informed consent!", they'll claim. The
|
279 |
-
issue of there being other legal bases for processing aside,
|
280 |
-
nobody consents to being in a data breach! The natural progression
|
281 |
-
of that conversation is that being in a data breach is a parallel
|
282 |
-
discussion to HIBP then indexing it and making it searchable,
|
283 |
-
which is something I've devoted many words to addressing in the
|
284 |
-
past.
|
285 |
-
|
286 |
-
But for all the bluster the occasional random internet person can
|
287 |
-
have (and honestly, I could count the number of annual instances
|
288 |
-
of this on one hand), nothing has come of any complaints. And when
|
289 |
-
I say "complaints", it's often nothing more than a polite
|
290 |
-
conversation which may simply conclude with an acknowledgment of
|
291 |
-
opposing views and that's it. There has been one exception in the
|
292 |
-
entire decade of running this service where a complaint did come
|
293 |
-
via a government privacy regulator, I responded to all the
|
294 |
-
questions that were asked and that was the end of it.
|
295 |
-
|
296 |
-
People
|
297 |
-
|
298 |
-
When you have a pet project like HIBP was in the beginning, it's
|
299 |
-
usually just you putting in the hours. That's fine, it's a hobby
|
300 |
-
and you're scratching an itch, so what does it matter that there's
|
301 |
-
nobody else involved? Like many similar passion projects, HIBP
|
302 |
-
consumed a lot of hours from early on, everything from obviously
|
303 |
-
building the service then sourcing data breaches, verifying and
|
304 |
-
disclosing them, writing up descriptions and even editing every
|
305 |
-
single one of those 700+ logos by hand to be just the right
|
306 |
-
dimensions and file size. But in the beginning, if I'd just
|
307 |
-
stopped one day, what would happen? Nothing. But today, a
|
308 |
-
genuinely important part of the internet that a huge number of
|
309 |
-
individuals, corporations and governments have built dependencies
|
310 |
-
on would stop working if I lost interest.
|
311 |
-
|
312 |
-
The dependency on just me was partly behind the possible sale in
|
313 |
-
2019, but clearly that didn't eventuate. There was always the
|
314 |
-
option to employ people and build it out like most people would a
|
315 |
-
normal company, but every time I gave that consideration it just
|
316 |
-
didn't stack up for a whole bunch of reasons. It was certainly
|
317 |
-
feasible from the perspective of building some sort of valuable
|
318 |
-
commercial entity, but in just the same way as that question about
|
319 |
-
my perfect day in the office sucked the soul from my body, so did
|
320 |
-
the prospect of being responsible for other people. Employment
|
321 |
-
contracts. Salary negotiations. Performance reviews. Sick leave
|
322 |
-
and annual leave and all sorts of other people issues from
|
323 |
-
strangers I'd need to entrust with "my baby". So, bringing in more
|
324 |
-
people was a really unattractive idea, with 2 exceptions:
|
325 |
-
|
326 |
-
In early 2021, my (soon to be at the time) wife Charlotte started
|
327 |
-
working for HIBP.
|
328 |
-
|
329 |
-
Charlotte had spent the last 8 years working with people just like
|
330 |
-
me; software nerds. As a project manager for the NDC conferences
|
331 |
-
based out of Norway, she'd dealt with hundreds of speakers
|
332 |
-
(including me on many occasions), and thousands of attendees at
|
333 |
-
the best conference I've ever been a part of. Plus, she spent a
|
334 |
-
great deal of time coordinating sponsors, corporate attendees and
|
335 |
-
all sorts of other folks that live in the tech world HIBP
|
336 |
-
inhabited. For Charlotte, even though she's not a technical person
|
337 |
-
(her qualifications are in PR and entrepreneurial studies), this
|
338 |
-
was very familiar territory.
|
339 |
-
|
340 |
-
So, for the last few years, Charlotte has done absolutely
|
341 |
-
everything that she can to ensure that I can focus on the things
|
342 |
-
that need my attention. She onboards new corporate subscribers,
|
343 |
-
handles masses of tickets for API and domain subscribers and does
|
344 |
-
all the accounting and tax work. And she does this tirelessly
|
345 |
-
every single day at all sorts of hours whether we're at home or
|
346 |
-
travelling. She is... amazing 🤩
|
347 |
-
|
348 |
-
Earlier this year, Stefán Jökull Sigurðarson started working for
|
349 |
-
us part time writing code, cleaning up code, migrating code and,
|
350 |
-
well, doing lots of different code things.
|
351 |
-
|
352 |
-
Just today I asked Stefán what I should write about him, thinking
|
353 |
-
he'd give me some bullet points I'd massage and then incorporate
|
354 |
-
into this blog post. Instead, I reckon what he wrote was so spot
|
355 |
-
on that I'm just going to quote the entire thing here:
|
356 |
-
|
357 |
-
"Just" that having had my eye on the service since it was
|
358 |
-
released and then developing one of the first big integrations
|
359 |
-
with the PwnedPasswords v2 API in EVE, coinciding with us
|
360 |
-
meeting for the first time at NDC Oslo in 2018 shortly after,
|
361 |
-
HIBP has managed to take me on this awesome journey where it has
|
362 |
-
been a part of launching my public speaking career, contributing
|
363 |
-
to OSS with Pwned Passwords, becoming an MVP and helped me meet
|
364 |
-
a bunch of awesome people and allowed me to contribute to a
|
365 |
-
better and hopefully safer internet. I'm very happy and honoured
|
366 |
-
to a be a part of this project which is full of awesome
|
367 |
-
challenges and interesting problems to deal with. Having meeting
|
368 |
-
invites from the FBI in my inbox a few years after doing a few
|
369 |
-
experimental rest calls to the Pwned Passwords API in early 2018
|
370 |
-
was definitely not something I was expecting 😅
|
371 |
-
|
372 |
-
What really resonated with me in Stefán's message is that for him,
|
373 |
-
this isn't just a job, it's a passion. His journey is my journey
|
374 |
-
in that we freely devoted our time to do something we love and it
|
375 |
-
led to many wonderful things, including MVP roles and speaking at
|
376 |
-
"Charlotte's" conference, NDC. Stefán is based in Iceland, but
|
377 |
-
we've still had many opportunities to share beers together and
|
378 |
-
establish a relationship that transcends merely writing code. I
|
379 |
-
can't think of anyone better to do what he does today.
|
380 |
-
|
381 |
-
Breaches
|
382 |
-
|
383 |
-
731 breaches later, here we are. So, what stands out? Just going
|
384 |
-
off the top of my head here:
|
385 |
-
|
386 |
-
Ashley Madison. Every knows the name so it needs no introduction,
|
387 |
-
but that incident in 2015 had a major impact on HIBP in terms of
|
388 |
-
use of the service, and also a major impact on me in terms of the
|
389 |
-
engagements I had with impacted parties. My blog post on Here’s
|
390 |
-
what Ashley Madison members have told me still feels harrowing to
|
391 |
-
read.
|
392 |
-
|
393 |
-
Collection #1. This is the one that really contributed to my
|
394 |
-
stress levels in early 2019 and had a profound impact on my
|
395 |
-
decision to look at selling the service. Read about where those
|
396 |
-
773M records came from (still the largest breach in HIBP to date).
|
397 |
-
|
398 |
-
Rosebutt. Don't make a joke about it, don't make a joke about it,
|
399 |
-
don't... aw man, thanks The Register! (link to an archive.org
|
400 |
-
version as they seem to have thought better of their image choice
|
401 |
-
later on...) The point is that even serious data breaches can have
|
402 |
-
their moments of levity.
|
403 |
-
|
404 |
-
Shit Express. Sometimes, you just need a bit of hilarity in your
|
405 |
-
data breach. Shit Express is literally a site to send other people
|
406 |
-
pieces of that - anonymously - and they got breached, thus
|
407 |
-
somewhat affecting their anonymity. The more serious point is that
|
408 |
-
as I later wrote, claims of anonymity are often highly misleading.
|
409 |
-
|
410 |
-
Future
|
411 |
-
|
412 |
-
I often joke about my life being very much about getting up each
|
413 |
-
morning, reading my emails and events from overnight and then just
|
414 |
-
winging it from there. Of course there are the occasional
|
415 |
-
scheduled things not to mention travel commitments, but for the
|
416 |
-
most part it's very much just rolling with whatever is demanding
|
417 |
-
attention on the day. This is also probably a significant part of
|
418 |
-
why I don't really want to see this thing grow into a larger
|
419 |
-
concern with more responsibilities, I just don't want to lose that
|
420 |
-
freedom. Yet...
|
421 |
-
|
422 |
-
We're gradually moving in a direction where things become more
|
423 |
-
formalised. 3 years ago, I did 100% of everything myself. 1 year
|
424 |
-
ago, I did everything technical myself. 6 months ago, we had no
|
425 |
-
ticketing system for support. But these are small, incremental
|
426 |
-
steps forward and that's what I'd like to see continuing. I want
|
427 |
-
HIBP to outlive me, I just don't want it to become a burden I'm
|
428 |
-
beholden to in the process. I'd like to have more people involved
|
429 |
-
but as you can see from above, that's been a very slow process
|
430 |
-
with only those very close to me playing a role.
|
431 |
-
|
432 |
-
The only thing I have real certainty on at the moment is that
|
433 |
-
there will be more breaches. I've commented many times recently
|
434 |
-
that the scourge that is ransomware feels like it's really
|
435 |
-
accelerated lately, I wonder how many of the people in the emails
|
436 |
-
and documents and all sorts of other data that get dumped there
|
437 |
-
ever learn of their exposure? It's a non-trivial exercise to index
|
438 |
-
that (for all sorts of reasons), but it also seems like an
|
439 |
-
increasingly worthy exercise. Who knows, let's see how I feel when
|
440 |
-
I get up tomorrow morning 🙂
|
441 |
-
|
442 |
-
Finally, for this week's regular video, I'm going to make a
|
443 |
-
birthday special and do it live with Charlotte. Please come and
|
444 |
-
join us, I'm not entirely sure what we'll cover (I'll work it out
|
445 |
-
on the morning!) but let's make a virtual 10th birthday party out
|
446 |
-
of it 🎂
|
447 |
-
|
448 |
-
IFrame
|
449 |
-
Have I Been Pwned Tweet Post Update Email RSS
|
450 |
-
Troy Hunt's Picture
|
451 |
-
|
452 |
-
Troy Hunt
|
453 |
-
|
454 |
-
Hi, I'm Troy Hunt, I write this blog, create courses for
|
455 |
-
Pluralsight and am a Microsoft Regional Director and MVP who
|
456 |
-
travels the world speaking at events and training technology
|
457 |
-
professionals
|
458 |
-
|
459 |
-
Please enable JavaScript to view the comments powered by Disqus.
|
460 |
-
|
461 |
-
Troy Hunt
|
462 |
-
|
463 |
-
Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and
|
464 |
-
am a Microsoft Regional Director and MVP who travels the world
|
465 |
-
speaking at events and training technology professionals
|
466 |
-
|
467 |
-
Upcoming Events
|
468 |
-
|
469 |
-
I often run private workshops around these, here's upcoming events
|
470 |
-
I'll be at:
|
471 |
-
|
472 |
-
Must Read
|
473 |
-
|
474 |
-
* Data breach disclosure 101: How to succeed after you've failed
|
475 |
-
* Data from connected CloudPets teddy bears leaked and ransomed,
|
476 |
-
exposing kids' voice messages
|
477 |
-
* Here's how I verify data breaches
|
478 |
-
* When a nation is hacked: Understanding the ginormous
|
479 |
-
Philippines data breach
|
480 |
-
* How I optimised my life to make my job redundant
|
481 |
-
|
482 |
-
Don't have Pluralsight already? How about a 10 day free trial?
|
483 |
-
That'll get you access to thousands of courses amongst which are
|
484 |
-
dozens of my own including:
|
485 |
-
|
486 |
-
1. OWASP Top 10 Web Application Security Risks for ASP.NET
|
487 |
-
2. What Every Developer Must Know About HTTPS
|
488 |
-
3. Hack Yourself First: How to go on the Cyber-Offense
|
489 |
-
4. The Information Security Big Picture
|
490 |
-
5. Ethical Hacking: Social Engineering
|
491 |
-
6. Modernizing Your Websites with Azure Platform as a Service
|
492 |
-
7. Introduction to Browser Security Headers
|
493 |
-
8. Ethical Hacking: SQL Injection
|
494 |
-
9. Web Security and the OWASP Top 10: The Big Picture
|
495 |
-
10. Ethical Hacking: Hacking Web Applications
|
496 |
-
|
497 |
-
This is already the newest post!
|
498 |
-
|
499 |
-
Weekly Update 376
|
500 |
-
|
501 |
-
Subscribe
|
502 |
-
|
503 |
-
Subscribe Now!
|
504 |
-
|
505 |
-
Send new blog posts:
|
506 |
-
[ ] daily
|
507 |
-
[ ] weekly
|
508 |
-
|
509 |
-
_____________________ [ go! ]
|
510 |
-
|
511 |
-
Hey, just quickly confirm you're not a robot:
|
512 |
-
|
513 |
-
Submitting...
|
514 |
-
|
515 |
-
Got it! Check your email, click the confirmation link I just sent
|
516 |
-
you and we're done.
|
517 |
-
|
518 |
-
Copyright 2023, Troy Hunt
|
519 |
-
|
520 |
-
This work is licensed under a Creative Commons Attribution 4.0
|
521 |
-
International License. In other words, share generously but
|
522 |
-
provide attribution.
|
523 |
-
|
524 |
-
Disclaimer
|
525 |
-
|
526 |
-
Opinions expressed here are my own and may not reflect those of
|
527 |
-
others. Unless I'm quoting someone, they're just my own views.
|
528 |
-
|
529 |
-
Published with Ghost
|
530 |
-
|
531 |
-
This site runs entirely on Ghost and is made possible thanks to
|
532 |
-
their kind support. Read more about why I chose to use Ghost.
|
533 |
-
|
534 |
-
* * * * *
|
535 |
-
|
536 |
-
[/INST]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|