Collaborate Disseminate
In a continued bid to make breach data available to the government departments around the world tasked with protecting their citizens, I’m very happy to welcome the first country onto Have I Been Pwned for 2020 – Denmark! The Danish Centre for Cyber Security (CFCS) joins the existing 7 governments
Continue reading Welcoming the Danish Government to Have I Been Pwned
I really should have started the video about 3 minutes earlier. Had I done that, you’d have caught me toppling backwards into the frangipani tree whilst trying to position my chair and camera which frankly, would have made for entertaining viewing. Instead, this week’s update is focused primarily on a
This is a blog post about disclosure, specifically the difficulty with doing it in a responsible fashion as the reporter whilst also ensuring the impacted organisation behaves responsibly themselves. It’s not a discussion we should be having in 2020, a time of unprecedented regulatory provisions designed to prevent precisely the
Continue reading The Difficulty of Disclosure, Surebet247 and the Streisand Effect
I couldn’t get 2 days into the new decade without without having to deal with ridiculous password criteria from Tik Tok followed by my phone automatically associating with what it thought was my washing machine whilst in a grocery store on the other side of the world (yep, you read
Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it:
If a website sets a cookie then you click a link to another page on that
Continue reading Promiscuous Cookies and Their Impending Death via the SameSite Policy
Sitting down to do this one today I thought it would be brief, turns out a bit more ended up on the agenda than I expected. The GoGetSSL bit in particular was unfolding as I recorded and to their credit, they later apologised for their “rude messages” which is a
When is data “public”? And what does “public” even mean? Does it mean it’s merely visible to the public? Or does it mean the public can do anything they like with it? This discussion comes up time and time again as it did with the huge leak of PDL data
Continue reading When Is Data “Public”? (And 2.5M Public Factual Records in HIBP)
Monday: 40C and lapping up the Gold Coast sunshine. Wednesday: -8C and lapping up… Juicy IPA! I’m back in Oslo and catching up with the locals including running a roundtable discussion for CSOs at Microsoft, visiting the Norwegian National Cyber Security Centre (recently onboarded to HIBP) and chatting with Forbrukerrådet,
Back in July last year, Scott Helme and I shipped a little pet project that tracked the world’s largest websites not implementing HTTPS by default. We called it Why No HTTPS? and it gave people a way to see the largest websites not taking transport layer security seriously. We also
I recorded this right before heading out for my final conference talk of the year at YOW! Melbourne where I was due to do the closing keynote of the event. That’s now done, questions answered and beers drunk and I left the event feeling great. One of the things I