Mastodon

Weekly update 33 (sunrise edition)

Wow, what a day! I got up at about 3:30 this morning and have been going non-stop dealing with the masses of feedback as a result of the billion-and-a-bit breached records I'm presently loading into HIBP. I talk about it in the blog post, but the "small" one of 458 million records is already loaded and as I type this, at about 17:30 Friday, the big one of almost 600M is still a long way off (probably mid-morning for me tomorrow). Anyway, between other commitments and the looong lead-time of uplo...

Password reuse, credential stuffing and another billion records in Have I been pwned

The short version: I'm loading over 1 billion breached accounts into HIBP. These are from 2 different "combo lists", collections of email addresses and passwords from all sorts of different locations. I've verified their accuracy (including my own record in one of them) and many hundreds of millions of the email addresses are not already in HIBP. Because of the nature of the data coming from different places, if you're in there then treat it as a reminder that your data is out there circulating...

Microsoft Flow + Azure Storage + WebJobs + MailChimp + Outlook

A few years back, I added a donations page to Have I been pwned (HIBP) [https://haveibeenpwned.com/Donate]. Now as I explained at the time, I didn't particularly need them to cover my hard-cash outgoings because I run the thing on a shoestring, but as I explain on that page, it takes a massive amount of effort. If people want to fling me a coffee or some beers, that's just great and I appreciate it enormously. Problem is, it's hard to individually show that appreciation. Especially during a busy...

Reckon you've seen some stupid security things? Here, hold my beer...

My mate Lars Klint shared this tweet the other day: > Your password is not unique. pic.twitter.com/ga4GwxtzrQ [https://t.co/ga4GwxtzrQ] — Lars Klint (@larsklint) April 16, 2017 [https://twitter.com/larsklint/status/853507749488975873] Naturally, I passed it on [https://twitter.com/troyhunt/status/853517036131041280] because let's face it, that's some crazy shit going on right there. To which the Twitters responded with equal parts abject horror and berating comments for not having already iden...

Weekly update 32

Home again and blog wise, it was a quiet week. I've been working on some new material you'll see next month as well as preparing for upcoming Europe travels where I've got a heap of events to get to. I've got a new Lenovo to show you in this update plus I do talk quite a bit about that one blog post on building out a Ubiquiti network for my brother and his family which I'm now kinda jealous of! All that and a few other things in the update below, I've got a few extra things in the works for next...

Wiring a home network from the ground-up with Ubiquiti

The title of this blog post is what many of us techie folks dream of - free reign to build your own home network! It might seem like a pretty geeky dream (ok, it is a pretty geeky dream), but the reality is that we're increasingly dependent on our home networks these days because of the amount of stuff we connect to them. That little consumer-grade combination modem and wireless access point your ISP gave you or the one you bought from the local PC store is going to struggle to provide fast, rel...

Weekly update 31 (Sydney Opera House edition)

Another beautiful spot today while I'm back in Sydney working on the agenda for NDC here in August [http://ndcsydney.com/]. It's a quick trip albeit one very jammed-packed as we work through over 700 talk submissions and try to distil them down to the best ~135 of the bunch. There's a few weeks of early bird tickets left so if you're down here in Aus (or feel like a holiday), get in and grab them cheap. This week, I'm really excited about this: > This is awesome - for the first time after 5 y...

New Pluralsight course: Azure Beyond Websites

I've been really actively involved with building things on Microsoft's Azure cloud for probably about 4 or 5 years now. Many of you will know already that Have I been pwned [https://haveibeenpwned.com/] (HIBP) was built from the ground up on Azure (in fact, one of the reasons I built the service was to play with Azure "in anger"!), what less people know is the work I'd been doing before that. In my previous life looking after Pfizer's software architecture in this corner of the world [https://w...

All your websites using StartCom certificates are about to break

A Twitterer sent me this a few days ago: > .@troyhunt [https://twitter.com/troyhunt] you've got SSL issues in Chrome 58+ on @ASafaWeb [https://twitter.com/ASafaWeb] pic.twitter.com/qtUiMxV9tW [https://t.co/qtUiMxV9tW] — Jonathan (@Eonasdan) April 13, 2017 [https://twitter.com/Eonasdan/status/852523365076267008] Now normally when I get a report about an SSL thing not working (by which we mean TLS, but we say SSL anyway), I jump on over to SSL Labs (see?!) and run a report I can then direct peo...

Mandatory ISP data retention and the law of unintended consequences

Well, good one Australia, UK and whoever else has embarked on this hare-brained scheme, you've just made things a whole lot worse. Our respective governments (in all their ivory-towered wisdom), have decided that because one of us could one day decide to become a terrorist, they'd better keep a big whack of our internet browsing history just in case. The theory these genius policy makers have is that if they can probe into all our lives far enough, they'll be able to see when we're doing terrori...