Collaborate Disseminate
We’re on a beach! It’s the day after 3 pretty intense days of NDC conference and the day before Scott heads back to the UK so beach was an easy decision. The conference went fantastically well and, in all honesty, was the most enjoyable workshop I think I’ve done out…
It’s a new Pluralsight course! Yes, I know I said that yesterday too, but this is a new new Pluralsight course and it’s the second part in our series on Creating a Security-centric Culture. As I wrote there back in Jan, we’re doing this course on a quarterly basis and…
Just a tad over 5 years ago, I released my first ever Pluralsight course – OWASP Top 10 Web Application Security Risks for ASP.NET. More than 32k people have listened to more than 78k hours of content in this course making it not just the most popular course I’ve…
This week, Scott Helme is getting bitten by Aussie critters whilst working from a desert island. He’s here on the Gold Coast for the NDC Security event next week so I thought we’d record the update together so we grabbed a couple of cold ones, wandered down to the backyard…
Remember when web security was all about looking for padlocks? I mean in terms of the advice we gave your everyday people, that’s what it boiled down to – “look for the padlock before entering passwords or credit card info into a website”. Back in the day, this…
It’s a (new) weekly update! Lights are in, things are much brighter and… I think it was a bit too bright and the camera was pointed too high. This is all experimentation, folks, and I appreciate everyone’s input as I tune things to try and get a consistent, quality result….
Ah JavaScript, the answer to – and cause of – all our problems on the web today! Just kidding, jQuery has solved all our JS problems now…
But seriously, JS is a major component of so much of what we build online these days and as with our other online…
Continue reading New Pluralsight Course: JavaScript Security Play by Play
A couple of months ago, I launched version 2 of Pwned Passwords. This is a collection of over half a billion passwords which have previously appeared in data breaches and the intention is that they’re used as a black list; these are the “secrets” that NIST referred to…
Continue reading 86% of Passwords are Terrible (and Other Statistics)
The more time that goes by and the more deeply I give it thought, the more convinced I am that the web is held together with sticky tape. No – cyber-sticky tape! Because especially when it comes to security, there are fundamental and inherent shortcomings in everything from HTTP to…
When I launched Pwned Passwords in August, I honestly didn’t know how much it would be used. I made 320M SHA-1 password hashes downloadable and also stood up an API to query the data “as a service” by either a plain text password or a SHA-1 hash. (Incidentally,…
Continue reading Enhancing Pwned Passwords Privacy by Exclusively Supporting Anonymity