Have I Been Pwned

For some years now, one of the first things I’ve dropped into any new project has been ELMAH [https://code.google.com/p/elmah/]. Grab it from NuGet, provision yourself a SQL database table and watch magic happen as every unhandled error gets dumped into the DB and is reviewable via a handler which exposes the original stack trace amongst other info such as server variables and POST data. In theory, you also secure this. In practice, many people don’t [https://www.google.com/search?q=inurl%3Aelma...

So we were about halfway through watching the Wolf of Wall Street at the local cinema the other day and the iPhone starts buzzing like a mad thing. It’s on silent, of course, but you get that sense that something important is happening just by virtue of the frequency of the thing randomly jumping around in your pocket every few seconds. But it’s a night out with my wife – a rare night out – and I’m not about to risk a sneaky glance at the phone. Now this is a long movie (as awesome as it was),...

As prophesised, it has happened – Tesco has had a serious security incident [http://www.bbc.co.uk/news/technology-26171130]. The prophecy, for new readers, was my piece on Lessons in website security anti-patterns by Tesco [https://www.troyhunt.com/2012/07/lessons-in-website-security-anti.html] from a couple of years back. The catalyst for that post was this now infamous tweet in response to my pointing out that they had mixed content on an otherwise secure page: [https://twitter.com/Tesco/sta...

In the end, I decided the fairest, most balanced way was to piss everyone off equally. Of course I’m talking about API versioning and not since the great “tabs versus spaces” debate have I seen so many strong beliefs in entirely different camps. Imagine this: HTTP GET: https://haveibeenpwned.com/api/breachedaccount/foo Response: ["Adobe","Gawker"] This was just fine. When I built Have I been pwned? [https://haveibeenpwned.com] (HIBP) in late November, it was intended to be a simple, fas...

These real world experiences with Azure are now available in the Pluralsight course "Modernizing Your Websites with Azure Platform as a Service" [http://www.pluralsight.com/courses/modernizing-websites-microsoft-azure] Yesterday I wrote part 1 of this 2 part series [https://www.troyhunt.com/2014/01/azure-will-save-you-from-unexpected.html] and explained the Godzilla redundant approach of storage in Azure. Each bit of data you put into Azure storage gets replicated multiple times over within the...

These real world experiences with Azure are now available in the Pluralsight course "Modernizing Your Websites with Azure Platform as a Service" [http://www.pluralsight.com/courses/modernizing-websites-microsoft-azure]The other day I wrote about how I’d implemented the notification service behind Have I been pwned? [https://www.troyhunt.com/2014/01/behind-notification-service-of-have-i.html] and I pointed out how I’d used SQL Azure to manage the data associated with this part of the service. Ye...

These real world experiences with Azure are now available in the Pluralsight course "Modernizing Your Websites with Azure Platform as a Service" [http://www.pluralsight.com/courses/modernizing-websites-microsoft-azure]Azure Web Sites are not your father’s hosting. The big thing you need to wrap your head around is that this model of standing up web sites moves us away from the classic paradigm of just firing up files over FTP then not thinking about the hosting again to one where serving content...

It’s about six weeks into the life of Have I been pwned? [https://haveibeenpwned.com] now and I’m enormously pleased with the reception its received. The fact that I’ve had to write posts like the micro optimisation one [https://www.troyhunt.com/2013/12/micro-optimising-web-content-for.html] or the one about getting too big for Google [https://www.troyhunt.com/2013/12/too-big-for-google-when-analytics-fails.html] and had to deal with all the problems I’ve discussed there has actually been a very...

These real world experiences with Azure are now available in the Pluralsight course "Modernizing Your Websites with Azure Platform as a Service" [http://www.pluralsight.com/courses/modernizing-websites-microsoft-azure]A few weeks ago now I launched the notification service for Have I been pwned? [https://www.troyhunt.com/2013/12/have-you-been-pwned-now-you-can-be.html] (HIBP). The premise of the service is that whilst it’s great to be able to go to the HIBP website [https://haveibeenpwned.com/]...

Well we almost made it through the first day of the new year without a major data breach; it got to about mid-afternoon my time then wammo! The 2014 breach count was off and racing. If I’m honest, I actually spent some procrastinating over whether this could really be considered a breach and indeed if the data was even of any functional value to an attacker. I came to the conclusion that it is and, well, it is. Let me explain the thinking and why I’ve made it searchable via Have I been pwned? [...