korrents

Troy Hunt

@troy-hunt · 7 positions · 0 changes of mind

Security researcher who runs Have I Been Pwned, the service that tells people which breaches their email address turned up in. He writes at troyhunt.com about breaches, passwords and what actually goes wrong, including when it goes wrong to him.

Troy Hunt did not write this page.

We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.

  1. Our reading

    A modern phish is automated end to end: the stolen credentials are used and the data exported within moments of being entered.

    Their wordsThis was obviously highly automated and designed to immediately export the list before the victim could take preventative measures.

    ↗A Sneaky Phish Just Grabbed my Mailchimp Mailing Listtroyhunt.com 1st of 2 in this piece

    Interesting

  3. Our reading

    A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too.

    Their wordsWhen I have conversations with breached companies, my messaging is crystal clear: be transparent and expeditious in your reporting of the incident and prioritise communicating with your customers.

    ↗A Sneaky Phish Just Grabbed my Mailchimp Mailing Listtroyhunt.com 2nd of 2 in this piece

    Interesting
  4. 7 years earlier

  5. Our reading

    Every website needs HTTPS, including a static site with no login and nothing sensitive on it.

    Their wordsSo that's precisely what I've done - intercepted my own traffic passed over an insecure connection and put together a string of demos in a 24-minute video explaining why HTTPS is necessary on a static website.

    ↗Here's Why Your Static Website Needs HTTPStroyhunt.com

    Interesting
  6. 12 months earlier

  7. Our reading

    Much of the received wisdom about passwords has been reversed, yet organisations still apply yesterday’s patterns to today’s threats.

    Their wordsIn some cases, this has led to once-held "truths" about how we create and manage accounts to be totally flipped on their head, yet we still see modern organisations applying the patterns of yesterday to the threats of today.

    ↗Passwords Evolved: Authentication Guidance for the Modern Eratroyhunt.com 1st of 4 in this piece

    Interesting

  9. Our reading

    A password manager does not have to be perfect; it only has to be better than what people do without one.

    Their wordspassword managers don't have to be perfect, they just have to be better than not having one.

    ↗Passwords Evolved: Authentication Guidance for the Modern Eratroyhunt.com 2nd of 4 in this piece

    management

    Interesting

  11. Our reading

    Blocking paste on a password field makes passwords weaker, because people fall back to ones they can type.

    Their wordsWhen a website blocks the pasting of passwords in an attempt to improve security, they force some users to weaken their passwords to the point where they're dumbed down to easily typed versions.

    ↗Passwords Evolved: Authentication Guidance for the Modern Eratroyhunt.com 3rd of 4 in this piece

    Interesting

  13. Our reading

    Mandatory periodic password changes make passwords worse, because people just increment the number on the end.

    Their wordsIf you're working in an environment that mandates regular password changes, you're very likely doing the same thing because it's an easy human control to deal with a technology requirement that's seen as an impediment.

    ↗Passwords Evolved: Authentication Guidance for the Modern Eratroyhunt.com 4th of 4 in this piece

    Interesting