Collaborate Disseminate
Every now and then, I look at one of the videos I’ve just recorded and only realise then how tired I look. This was one of those weeks and it was absolutely jam-packed! There was some awesome stuff and there was some very frustrating stuff. Let me add briefly to…
Last August, I launched a little feature within Have I Been Pwned (HIBP) I called Pwned Passwords. This was a list of 320 million passwords from a range of different data breaches which organisations could use to better protect their own systems. How? NIST explains:
When processing requests to establish
Continue reading I’ve Just Launched “Pwned Passwords” V2 With Half a Billion Passwords for Download
I had plans this week. Monday was going to be full of coding work around Pwned Passwords V2 (and a few other HIBP things) then Texthelp went and got themselves pwned and there went my day writing about the ramifications of that. This is a genuinely important issue and the…
I’ll start this post where I start many of my talks – what does a hacker look like? Or perhaps more specifically, what do people think a hacker looks like? It’s probably a scary image, one that’s a bit mysterious, a shady character lurking in the hidden depths of the…
Continue reading Making Light of the “Dark Web” (and Debunking the FUD)
A couple of years back as the US presidential campaign was ramping up, the Trump camp did something stupid. I know, we’re all shocked but bear with me because it’s an important part of the narrative of this post. One of their developers embedded this code in the campaign’s donation…
Continue reading The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries
I’m not entirely sure how I’ve gotten to the end of the week feeling completely wrung out whilst having only written the one thing, but here we are. In fairness though, I’ve put a heap of work into Pwned Passwords version 2 and finally completed the data set. There’s some…
Password strength aside, users understand passwords. That’s why they are still the best way to secure things. Continue reading Security Sense: Password Strength Lies in its Universality
I’ve been giving a bunch of thought to passwords lately. Here we have this absolute cornerstone of security – a paradigm that every single person with an online account understands – yet we see fundamentally different approaches to how services handle them. Some have strict complexity rules. Some have low…
Continue reading How Long is Long Enough? Minimum Password Lengths by the World’s Top Sites
I’m home! It’s nice being home 😀
This week I start by getting a couple of things off my chest, namely some pretty wacky reactions to my suggesting that we’re never going to see a coders’ hippocratic oath and how I feel when media outlets say “the dark web”…
I’ve long been a proponent of Content Security Policies (CSPs). I’ve used them to fix mixed content warnings on this blog after Disqus made a little mistake, you’ll see one adorning Have I Been Pwned (HIBP) and I even wrote a dedicated Pluralsight course on browser security headers. I’m a…
Continue reading My Blog Now Has a Content Security Policy – Here’s How I’ve Done It