Collaborate Disseminate
Last week Google announced some changes to Chrome, specifically that come January 2017, practices like this are going to start resulting is browser warnings:
That’s just one of many such examples I’ve called out in the past and frankly, I have about zero sympathy for those who are doing this
Continue reading Here’s how broken today’s web will feel in Chrome’s secure-by-default future
I see a lot of data breaches. I see a lot of legit ones and I see a lot of fake ones and because of that, I always verify them before making any claims that an organisation has been hacked. Usually I’ll verify and then in conjunction with journalists I
Continue reading Someone just lost 324k payment records, complete with CVVs
Three weeks ago today, I wrote about implementing a rate limit on the Have I been pwned (HIBP) API and the original plan was to have it begin a week from today. I want to talk more about why the rate limit was required and why I’ve had to bring
Continue reading The “Have I been pwned” API rate limit has been brought forward – here’s why
Earlier today, Motherboard reported on what had been rumoured for some time, namely that Dropbox had been hacked. Not just a little bit hacked and not in that “someone has cobbled together a list of credentials that work on Dropbox” hacked either, but proper hacked to the tune of 68
Let’s start with a quick quiz:
Take a look at haveibeenpwned.com (HIBP) and tell me where the traffic is encrypted between:
You see HTTPS which is good so you know it’s doing crypto things in your browser, but where’s the other end of the encryption? I mean at what
Continue reading CloudFlare, SSL and unhealthy security absolutism
CDNs are good. You get to put your web things all over the world and then have them served to your global audience from a location close to them. For example, because this blog is served through CloudFlare and about two thirds of the requests to my site come direct
Continue reading Protecting your embedded content with subresource integrity (SRI)
Another day, another data breach:
Full news on the GTAGaming breach is here: https://t.co/KuNSuol442 (vBulletin again)
— Troy Hunt (@troyhunt) August 23, 2016
Yesterday it was a different one:
vBulletin… “Epic Games: Information Regarding Recent Forum Compromise” https://t.co/YqQlSRbtLU
— Troy Hunt (@troyhunt)
I’ve been running my Hack Yourself First workshop all over the world where I talk to software developers about various security risks which they then get to exploit firsthand. It’s a lot of fun and very hands on and practical which inevitably means spending time looking at real world implementations
Continue reading Understanding account enumeration, the video tutorial edition
I’ve just wrapped up a couple of Hack Yourself First workshops down closer to home in Australia and true to usual form, attendees found some absolute zinger security implementations. Previous workshops have found various vulnerabilities ranging from realestate.com.au’s lack of HTTPS in their Android app (pro tip: don’t
Continue reading Website enumeration insanity: how our personal data is leaked
It’s almost 3 years ago now that I launched the Have I been pwned (HIBP) API and made it free and unlimited. No dollars, no rate limits just query it at will and results not flagged as sensitive will be returned. Since then it’s been called, well, I don’t know
Continue reading The “Have I been pwned” API, rate limiting and commercial use