Yesterday I had a bunch of people point me at a tweet from a politician in the UK named Nadine Dorries [https://twitter.com/NadineDorries]. As it turns out, some folks were rather alarmed about her position on sharing what we would normally consider to be a secret. In this case, that secret is her password and, well, just read it: > My staff log onto my computer on my desk with my login everyday. Including interns on exchange programmes. For the officer on @BBCNews [https://twitter.com/BBCNews?...

Last week, I was sitting next to a croc-infested river in the middle of nowhere (relatively speaking). This week, I'm in front of the United States Capital having just spoken to the very people who create the laws that govern not just the US but let's face it, have a significant impact on the rest of the world. Today was just one of those moments that make you go... whoa. But it was an awesome day. Everything went smoothly, I said all the major things I wanted to say and everyone seemed happy f...

Last week I wrote about my upcoming congressional testimony [https://www.troyhunt.com/im-testifying-in-front-of-congress-in-washington-dc-about-data-breaches-what-should-i-say/] and wow - you guys are awesome! Seriously, the feedback there was absolutely sensational and it's helped shape what I'll be saying to the US Congress, including lifting specific wording and phrases provided by some of you. Thank you! As I explained in that first blog post, I'm required to submit a written testimony 48...

This is going to be a couple of weeks of polar opposite updates: This week I'm in Rockhampton, a regional centre in my home state where I'm surrounded by gum trees, chirping birds and a croc-invested river. Next week will be Washington DC where I'll have just finished testifying in front of US Congress. Whoa. That's the big story this week. This year. This career. It's both a massive thing and a walk in the park, the former because it's testifying in front of freakin' congress and the latter be...

Edit: I'm putting this up front as a lot of people are asking for it - the hearing will be live-streamed on YouTube and there's already an embedded video on the hearing page [https://energycommerce.house.gov/hearings/identity-verification-post-breach-world/] . There's a title I never expected to write! But it's exactly what it sounds like and on Thursday next week, I'll be up in front of US congress on the other side of the world testifying about the impact of data breaches [https://energycomme...

A bit of a "business as usual" week this one, but then this business is never really "usual"! I start out with a talk at McAfee's MPOWER conference in Sydney and a bit of chatter about some upcoming ones (including the one I still can't talk about... but will next week!) In terms of new things, I've now got my hands on an iPhone X so I spend a bunch of time talking about that. It only arrived yesterday so I'm still learning and forming opinions, but early feedback is that I love this phone! Wel...

I run a workshop titled Hack Yourself First [https://www.troyhunt.com/workshops/] in which people usually responsible for building web apps get to try their hand at breaking them. As it turns out, breaking websites is a heap of fun (with the obvious caveats) and people really get into the exercises. The first one that starts to push people into territory that's usually unfamiliar to builders is the module on XSS. In that module, we cover reflected XSS which relies on the premise of untrusted dat...

Loads of bits and pieces this week ranging from travel (including something truly awesome that I can't go into detail on just yet) to Report URI to HIBP. There's also the competition for the Lenovo ThinkPad where I talk about the 4 finalists and if you're reading this within about 18 hours of me posting it, you can still vote for them here: > It's time to vote! I've picked the best 4 projects using the @haveibeenpwned [https://twitter.com/haveibeenpwned?ref_src=twsrc%5Etfw] API to do some reall...

Here's something I hear quite a bit when talking about security things: > Our site isn't a target, it doesn't have anything valuable on it This is usually the retort that comes back in defence of some pretty shady practices and in the mind of the defendant, it's a perfectly reasonable position. They don't collect any credentials, they don't have any payment info and in many cases, the site is simply a static representation of content that rarely changes. So what upside is there for an attacke...

I've actually had a day off today. Well mostly - I am still writing this piece and publishing a data breach - but I've pretty much spent the day between pool, beach and jet ski hence my being a bit dishevelled today ? Be that as it may, it's been a massive week and that's primarily due to the launch of Report URI V2 and in particular, the announcement that I've joined Scott in running the project. I've contributed dollars, social leverage and expertise because I genuinely think it's an awesome...