Collaborate Disseminate
It feels like not a week goes by without someone sending me yet another credential stuffing list. It’s usually something to the effect of “hey, have you seen the Spotify breach”, to which I politely reply with a link to my old No, Spotify Wasn’
Continue reading Inside the Massive Naz.API Credential Stuffing List
I’m worried that there could be some particular private information about me be leaked somewhere online.
I’m already aware of haveibeenpwned.com and doxbin.com, but what other sites exist there where I can look, especially deep websites?
… Continue reading Where can i look which information about me exists online [closed]
A decade ago to the day, I published a tweet launching what would surely become yet another pet project that scratched an itch, was kinda useful to a few people but other than that, would shortly fade away into the same obscurity as all the other ones I’d
Allegedly, Acuity had a data breach. That’s the context that accompanied a massive trove of data that was sent to me 2 years ago now. I looked into it, tried to attribute and verify it then put it in the “too hard basket” and moved onto
Continue reading Acuity Who? Attempts and Failures to Attribute 437GB of Breached Data
I like to think of investigating data breaches as a sort of scientific search for truth. You start out with a theory (a set of data coming from an alleged source), but you don’t have a vested interested in whether the claim is true or not, rather you
Continue reading Hackers, Scrapers & Fakers: What’s Really Inside the Latest LinkedIn Dataset
If I administer a webpage that allows users to create accounts, and assuming I don’t keep or even ever have access to plaintext passwords, is it possible for me to detect that one of my users is using a known bad password?
I am guessing th… Continue reading Is it possible to check for pwned/common passwords using salted hashes of the passwords?
Last week I was contacted by CERT Poland. They’d observed a phishing campaign that had collected 68k credentials from unsuspecting victims and asked if HIBP may be used to help alert these individuals to their exposure. The campaign began with a typical email requesting more information:
In this
Today, the US Justice Department announced a multinational operation involving actions in the United States, France, Germany, the Netherlands, and the United Kingdom to disrupt the botnet and malware known as Qakbot and take down its infrastructure. Beyond just taking down the backbone of the operation, the FBI began actively
There’s a “hidden” API on HIBP. Well, it’s not “hidden” insofar as it’s easily discoverable if you watch the network traffic from the client, but it’s not meant to be called directly, rather only via the web app.
Continue reading Fighting API Bots with Cloudflare’s Invisible Turnstile
I’ve been teaching my 13-year old son Ari how to code since I first got him started on Scratch many years ago, and gradually progressed through to the current day where he’s getting into Python in Visual Studio Code. As I was writing the new domain
Continue reading All New Have I Been Pwned Domain Search APIs and Splunk Integration