Banks, Arbitrary Password Restrictions and Why They Don’t Matter

Presently sponsored by: Sponsored by Okta: You wouldn’t roll your own hashing algorithm, so why build your own auth? Secure users in mins with a free dev account.

Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don’t matter. Also, allow me to argue with myself for a moment: banks shouldn’t have these restrictions in place anyway.

I want to put forward cases for both arguments

Continue reading Banks, Arbitrary Password Restrictions and Why They Don’t Matter→

Weekly Update 156

Presently sponsored by: Sponsored by Okta: You wouldn’t roll your own hashing algorithm, so why build your own auth? Secure users in mins with a free dev account.

Turns out it’s actually a sunny day in Oslo today, although it’s the last one I’ll see here for quite some time before heading off to Denmark then other European things for the remainder of this trip. I’m talking a little about those events (all listed on my events page

Continue reading Weekly Update 156→

Weekly Update 155

Presently sponsored by: Friends don’t let friends write user auth. Use Okta instead. Start your free trial today.

From the emerging spring to the impending autumn, I’m back in Oslo at the beginning of another series of European events that’ll take me across Norway, Denmark, Hungary and Switzerland. This week’s update comes from under the glow of a warm outdoor heater at ridiculous o’clock as my sleep cycle

Continue reading Weekly Update 155→

Weekly Update 154

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

How’s that for a setting in this week’s video? 🌴 First day of spring here which aligned with a father’s day on the water:

May all your father’s days be full of fun and laughter 😎 pic.twitter.com/pN1dQ38cDr

— Troy Hunt (@troyhunt) September 1, 2019

Back on business as

Continue reading Weekly Update 154→

Weekly Update 153

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

Australia! Sunshine, good coffee and back in the water on the tail end of “winter”. I’m pretty late doing this week’s video as the time has disappeared rather quickly and I’m making the most of it before the next round of events. Be that as it may, there’s a bunch

Continue reading Weekly Update 153→

Weekly Update 152

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

I made it out of Vegas! That was a rather intense 8 days and if I’m honest, returning to the relative tranquillity of Oslo has been lovely (not to mention the massive uptick in coffee quality). But just as the US to Europe jet lag passes, it’s time to head

Continue reading Weekly Update 152→

Extended Validation Certificates are (Really, Really) Dead

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

Almost one year ago now, I declared extended validation certificates dead. The entity name had just been removed from Safari on iOS, it was about to be removed from Safari on Mojave and there were indications that Chrome would remove it from the desktop in the future (they already weren’t

Continue reading Extended Validation Certificates are (Really, Really) Dead→

Weekly Update 151

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

Well that’s Vegas done. 8 days of absolutely non-stop events that’s now pretty much robbed me of my voice but hey, I got a flying cow! Scott and I both spent BSides, Black Hat and DEF CON doing “hallway con” or in other words, wandering around just meeting people. The

Continue reading Weekly Update 151→

Weekly Update 150

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

Vegas! I’m a bit late with this week’s update but I thought I’d catch up with Scott Helme and do the video together. We’re talking about the events in Vegas, the ongoing Project Svalbard process, some very screwy messaging about certificates from Sectigo and the Irish government coming on board

Continue reading Weekly Update 150→

Welcoming the Irish Government to Have I Been Pwned

Presently sponsored by: strongDM-see why Splunk’s CISO says “strongDM enables you to see what happens, replay & analyze incidents. You can’t get that anywhere else”

Over the last year and a bit I’ve been working to make more data in HIBP freely available to governments around the world that want to monitor their own exposure in data breaches. Like the rest of us, governments regularly rely on services that fall victim to attacks resulting in

Continue reading Welcoming the Irish Government to Have I Been Pwned→