Troy Hunt

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>I recorded this a week after Charlotte appeared with me, fresh out of isolation with a negative COVID test. However... 9 year old Elle had tested positive on Monday (albeit entirely symptomatic, so no idea how long she&apos;d been positive) but hey, hopefully she&apos;d be clear</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2022/01/Splash-Template.jpg" alt="Weekly Update 278"><p>I recorded this a week after Charlotte appeared with me, fresh out of isolation with a negative COVID test. However... 9 year old Elle had tested positive on Monday (albeit entirely symptomatic, so no idea how long she&apos;d been positive) but hey, hopefully she&apos;d be clear today. Yeah, nah and to top it off, 12 year old Ari was positive. Also entirely asymptomatic (and double-vaxed) so instead of ending today with our freedom, we&apos;re ending day 15 of our ongoing isolation in, well, more ongoing isolation. If only this family could grasp the concept of parallel processing rather than running the whole thing out in sequence... But hey, we&apos;re in a wonderful environment, everyone is well and it&apos;s near beer o&apos;clock at the time of writing so life remains good &#x1F60E; &#x1F37A;</p><p>Oh - and a bunch of cyber-things happened, more below &#x1F447;</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 278"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 278"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 278"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 278"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/qqOXW7vjAtg" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://twitter.com/troyhunt/status/1481556326094610433">You might not think it&apos;s spam, but when 94.4% of other people think it is, it&apos;s probably spam</a> (I&apos;m still pursing Avast for an answer on this)</li><li><a href="https://twitter.com/troyhunt/status/1476292622633226240">The Prusa MMU2S is a a <em>very</em> fickle beast</a> (since recording earlier today, I&apos;ve gotten reliability after tightening the idler screws on it <em>just</em> perfectly... and when the wind is blowing in the right direction on a waxing moon)</li><li><a href="https://l.kolide.co/3F4yIkB" rel="noopener">Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

I recorded this a week after Charlotte appeared with me, fresh out of isolation with a negative COVID test. However... 9 year old Elle had tested positive on Monday (albeit entirely symptomatic, so no idea how long she'd been positive) but hey, hopefully she'd be clear today. Yeah, nah and to top it off, 12 year old Ari was positive. Also entirely asymptomatic (and double-vaxed) so instead of ending today with our freedom, we're ending day 15 of our ongoing isolation in, well, more ongoing isolation. If only this family could grasp the concept of parallel processing rather than running the whole thing out in sequence... But hey, we're in a wonderful environment, everyone is well and it's near beer o'clock at the time of writing so life remains good 😎 🍺
Oh - and a bunch of cyber-things happened, more below 👇







References

You might not think it's spam, but when 94.4% of other people think it is, it's probably spam (I'm still pursing Avast for an answer on this)
The Prusa MMU2S is a a very fickle beast (since recording earlier today, I've gotten reliability after tightening the idler screws on it just perfectly... and when the wind is blowing in the right direction on a waxing moon)
Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
I recorded this a week after Charlotte appeared with me, fresh out of isolation with a negative COVID test. However... 9 year old Elle had tested positive on Monday (albeit entirely symptomatic, so no idea how long she'd been positive) but hey, hopefully she'd be clear

Weekly Update 278

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>Well that all changed very quickly. One week ago, I was like &quot;I&apos;m going to do this video from somewhere really epic next week&quot;. A few hours after that video, the host of the drinks we&apos;d gone to over the road the day before</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2022/01/Splash-Template.png" alt="Weekly Update 277"><p>Well that all changed very quickly. One week ago, I was like &quot;I&apos;m going to do this video from somewhere really epic next week&quot;. A few hours after that video, the host of the drinks we&apos;d gone to over the road the day before told us she had symptoms. Another few hours later and she&apos;s COVID positive. A few days after that and Charlotte is positive too. Then, after 5 days isolating in the master bedroom at home, she&apos;s negative. That was weird. It&apos;s all weird, not just for us but for everyone at the moment. But this experience did fundamentally change many of our views about the pandemic from the contagiousness of it (off the charts) to the health outcomes (relatively minor for those around us who caught it) to the availability and usefulness of tests (next to none, and minimal). That&apos;s all it is this week - our experiences of COVID and what we&apos;ve learned from it finally entering our house.</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 277"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 277"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 277"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 277"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/70o7EhCt7TE" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><p>References</p><ol><li><a href="https://l.kolide.co/3DPZQSS" rel="noopener">Sponsored by: Meet compliance objectives in a remote-first world without resorting to rigid device management. Try Kolide for 14-days free!</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Well that all changed very quickly. One week ago, I was like "I'm going to do this video from somewhere really epic next week". A few hours after that video, the host of the drinks we'd gone to over the road the day before told us she had symptoms. Another few hours later and she's COVID positive. A few days after that and Charlotte is positive too. Then, after 5 days isolating in the master bedroom at home, she's negative. That was weird. It's all weird, not just for us but for everyone at the moment. But this experience did fundamentally change many of our views about the pandemic from the contagiousness of it (off the charts) to the health outcomes (relatively minor for those around us who caught it) to the availability and usefulness of tests (next to none, and minimal). That's all it is this week - our experiences of COVID and what we've learned from it finally entering our house.







References

Sponsored by: Meet compliance objectives in a remote-first world without resorting to rigid device management. Try Kolide for 14-days free!

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
Well that all changed very quickly. One week ago, I was like "I'm going to do this video from somewhere really epic next week". A few hours after that video, the host of the drinks we'd gone to over the road the day before

Weekly Update 277

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>2021 Dumpster fire? Harsh, but fair and I shall keep this 3D-printed reminder handy and hope I don&apos;t end up needing to print a 2022 version! So many times throughout this week&apos;s video I came back to that theme... But hey, there was some positive stuff</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/Splash-Template-4.jpg" alt="Weekly Update 276"><p>2021 Dumpster fire? Harsh, but fair and I shall keep this 3D-printed reminder handy and hope I don&apos;t end up needing to print a 2022 version! So many times throughout this week&apos;s video I came back to that theme... But hey, there was some positive stuff too, not least the bits about some of the wonderful organisations I&apos;ve worked with this year, bought products from or otherwise just been a big part of my digital life in 2021. Thanks everyone for tuning in this year, back soon &#x1F60A;</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 276"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 276"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 276"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 276"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/QPZ_DRuHQh0" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h2 id="references">References</h2><ol><li><a href="https://twitter.com/crypto_bitlord7/status/1473231965927063553">Dildo-delivered malware - it&apos;s a great headline, but is it real?</a> (Poe&apos;s Law in action)</li><li><a href="https://blog.lastpass.com/2021/12/unusual-attempted-login-activity-how-lastpass-protects-you/">LastPass sent out a bunch of false positive &quot;someone has logged into your account&quot; messages</a> (which was much better than someone <em>actually </em>logging in to your account, as many understandably presumed)</li><li><a href="https://twitter.com/mayhemdayone/status/1474749233475596292?s=21">The RadLine Stealer malware left its ill-gotten gains publicly exposed and it&apos;s now in HIBP</a> (you really, <em>really</em> don&apos;t want to be in this one)</li><li><a href="https://l.kolide.co/3oKgrTM" rel="noopener">Sponsored by: Kolide enables cross-platform fleet visibility for your Linux, Mac, and Windows devices. Start your free 14-day trial today!</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

2021 Dumpster fire? Harsh, but fair and I shall keep this 3D-printed reminder handy and hope I don't end up needing to print a 2022 version! So many times throughout this week's video I came back to that theme... But hey, there was some positive stuff too, not least the bits about some of the wonderful organisations I've worked with this year, bought products from or otherwise just been a big part of my digital life in 2021. Thanks everyone for tuning in this year, back soon 😊







References

Dildo-delivered malware - it's a great headline, but is it real? (Poe's Law in action)
LastPass sent out a bunch of false positive "someone has logged into your account" messages (which was much better than someone actually logging in to your account, as many understandably presumed)
The RadLine Stealer malware left its ill-gotten gains publicly exposed and it's now in HIBP (you really, really don't want to be in this one)
Sponsored by: Kolide enables cross-platform fleet visibility for your Linux, Mac, and Windows devices. Start your free 14-day trial today!

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
2021 Dumpster fire? Harsh, but fair and I shall keep this 3D-printed reminder handy and hope I don't end up needing to print a 2022 version! So many times throughout this week's video I came back to that theme... But hey, there was some positive stuff

Weekly Update 276

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>I&apos;d say this is probably the most epic scene I&apos;ve ever done one of these videos from and equally, the main topic of the day around Pwned Passwords and the work done with the FBI and NCA is the most epic thing I&apos;ve done</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/Splash-Template-3.jpg" alt="Weekly Update 275"><p>I&apos;d say this is probably the most epic scene I&apos;ve ever done one of these videos from and equally, the main topic of the day around Pwned Passwords and the work done with the FBI and NCA is the most epic thing I&apos;ve done for a very long time. On reflection, I feel like this is the first major step towards HIBP growing up and becoming self-sufficient; that Pwned Passwords piece is now owned by the community, supported by the community, contributed to by 2 of the world&apos;s foremost law enforcement agencies and used somewhere <em>way </em>north of 1.26 <em>billion </em>times a month. So there&apos;s that, and a whole bunch of stuff about this absolutely amazing location right here in my home state. I hope you enjoy hearing about that as much as I enjoy talking about it &#x1F60A;</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 275"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 275"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 275"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 275"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/orLrexTMeOs" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live/">Pwned Passwords, FBI, NCA and a whole pile of awesome all dished up this week</a> (this whole piece of work makes me so happy &#x1F60A;)</li><li><a href="https://www.qualia.com.au/">Qualia is... out of this world</a> (one of my top 3 destinations every, without question)</li><li><a href="https://l.kolide.co/3oNfVV1" rel="noopener">Sponsored by: Kolide provides endpoint security for teams that value privacy, transparency, and employee productivity. Try Kolide for free today!</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

I'd say this is probably the most epic scene I've ever done one of these videos from and equally, the main topic of the day around Pwned Passwords and the work done with the FBI and NCA is the most epic thing I've done for a very long time. On reflection, I feel like this is the first major step towards HIBP growing up and becoming self-sufficient; that Pwned Passwords piece is now owned by the community, supported by the community, contributed to by 2 of the world's foremost law enforcement agencies and used somewhere way north of 1.26 billion times a month. So there's that, and a whole bunch of stuff about this absolutely amazing location right here in my home state. I hope you enjoy hearing about that as much as I enjoy talking about it 😊







References

Pwned Passwords, FBI, NCA and a whole pile of awesome all dished up this week (this whole piece of work makes me so happy 😊)
Qualia is... out of this world (one of my top 3 destinations every, without question)
Sponsored by: Kolide provides endpoint security for teams that value privacy, transparency, and employee productivity. Try Kolide for free today!

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
I'd say this is probably the most epic scene I've ever done one of these videos from and equally, the main topic of the day around Pwned Passwords and the work done with the FBI and NCA is the most epic thing I've done

Weekly Update 275

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>In the last month, there were 1,260,000,000 occasions where a service somewhere checked a password against Have I Been Pwned&apos;s (HIBP&apos;s) <a href="https://haveibeenpwned.com/Passwords">Pwned Password API</a>. 99.7% of the time, that check went no further than one of <a href="https://www.cloudflare.com/network/">hundreds of Cloudflare edge nodes</a> spread</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/2021-12-15_14-42-56.png" alt="Open Source Pwned Passwords with FBI Feed and 225M New NCA Passwords is Now Live!"><p>In the last month, there were 1,260,000,000 occasions where a service somewhere checked a password against Have I Been Pwned&apos;s (HIBP&apos;s) <a href="https://haveibeenpwned.com/Passwords">Pwned Password API</a>. 99.7% of the time, that check went no further than one of <a href="https://www.cloudflare.com/network/">hundreds of Cloudflare edge nodes</a> spread around the world (95% of the world&apos;s population is within 50ms of one). It looks like this:</p><p><img src="https://www.troyhunt.com/content/images/2021/12/2021-12-15_14-42-56.png" alt="Open Source Pwned Passwords with FBI Feed and 225M New NCA Passwords is Now Live!" loading="lazy"></p>
<p>There are all sorts of amazing Pwned Passwords use cases out there. For example, the <a href="https://www.forhims.com/">Hims personal wellness website</a>:</p><figure class="kg-card kg-image-card kg-width-full"><img src="https://www.troyhunt.com/content/images/2021/12/image-8.png" class="kg-image" alt="Open Source Pwned Passwords with FBI Feed and 225M New NCA Passwords is Now Live!" loading="lazy" width="1234" height="529" srcset="https://www.troyhunt.com/content/images/size/w600/2021/12/image-8.png 600w, https://www.troyhunt.com/content/images/size/w1000/2021/12/image-8.png 1000w, https://www.troyhunt.com/content/images/2021/12/image-8.png 1234w"></figure><p>Or literally thousands of other services doing everything from providing their own password checker through to checking their customers&apos; passwords on every registration, login or password change to see if it&apos;s previously been breached. And per the network request in the above image, every single password check is done using <a href="https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/">the k-anonymity model I launched back in 2018</a> to ensure that privacy is maintained and passwords can safely be checked without risk of disclosure. Oh - and it&apos;s all 100% free from top to bottom &#x1F60A;</p><p>Today, I&apos;m really excited to mark a major milestone in the project thanks to the support of two of the world&apos;s foremost law enforcement agencies, the FBI and the NCA.</p><h3 id="open-source-code-and-fbi-ingestion-pipeline">Open Source Code and FBI Ingestion Pipeline</h3><p>This has been a long time coming, and it&apos;s finally here. Today. Now. I mean it&apos;s literally live and working as you read this &#x1F60E;</p><p>Last year I wrote about my intention to begin open sourcing parts of HIBP. I&apos;m only able to run this project due to support from the community, so I wanted to start giving it back to the public in a bid to make it more open, more sustainable and in turn, more valuable to every single one of you using it. I made the decision to begin with Pwned Passwords and <a href="https://www.troyhunt.com/pwned-passwords-open-source-in-the-dot-net-foundation-and-working-with-the-fbi/">in May, I transitioned it into the .NET Foundation and announced we&apos;d be building an ingestion pipeline</a>. This pipeline enables the ingestion of passwords from law enforcement agencies, like the FBI. The premise is simple: during the course of their investigations, they come across a lot of compromised passwords and if they were able to continuously feed those into HIBP, all the other services out there using Pwned Passwords would be able to better protect their customers from account takeover attacks.</p><p>Fast forward to now and that ingestion pipeline is finally live. If you&apos;re using the Pwned Passwords API to check passwords, you&apos;re already benefiting; every new password added to the service will automatically be checked each time you call that API. Further, passwords already in the service are having their prevalence value updated to ensure you know just how bad those passwords really are.</p><p>I want to acknowledge <a href="https://www.troyhunt.com/expanding-the-have-i-been-pwned-volunteer-community/">Stef&#xE1;n J&#xF6;kull Sigur&#xF0;arson&apos;s role in making this possible</a>. He stepped up and coordinated the community, worked with our FBI contacts, upgraded the tech stack to the latest and greatest versions and brought this whole thing to reality. He volunteered his time to make this possible and I&apos;m enormously grateful for that, thanks mate &#x1F64F;</p><p>All of this alone would be awesome in and of itself, but as they say, there&apos;s just one more thing...</p><h3 id="225m-more-passwords-from-the-nca">225M More Passwords From the NCA</h3><p>The UK&apos;s National Crime Agency has done some wonderful work over the years to combat cybercrime. Back when I could travel, I&apos;d often catch up with NCA folks in London and it was always fascinating to get just a little glimpse into how they were tackling things in that corner of the world. I used to show a short video of theirs at the beginning of many of my talks; it&apos;s titled <a href="https://www.youtube.com/watch?v=DjYrxzSe3DU">Teenage Cybercrime: Help your child make the right choices</a> and it formed part of their #CyberChoices campaign. I&apos;d run it up front whilst people were filtering into the room because it was fun and light-hearted, but it told a serious story. There are a bunch of really smart kids out there and they find themselves at a crossroads where they could easily go down the wrong path with computer crimes but equally, easily be steered in a direction which may produce a wonderful career for them. The NCA wanted to help parents identify when kids may be at that crossroad and steer them in the right direction.</p><p>But let&apos;s get back to passwords: A little while back I was having a chat with some NCCU folks (the NCA&apos;s National Cyber Crime Unit), and talk turned to passwords. Turns out that like the FBI, they come across rather a lot of them and they had a very large corpus (as in hundreds of millions) they believed weren&apos;t already in HIBP. Now, keep in mind that before today&apos;s announcement, there were already 613M of them in the live Pwned Passwords service (and many millions more in my local working copy waiting for the next release), so the NCA&apos;s corpus represented a significant increase in size. Working in collaboration with the NCA, I imported and parsed out the data set against the existing passwords, I found <strong>225,665,425</strong> completely new instances out of a total set of <strong>585,570,857</strong>. As such, this whole set (along with other sources I&apos;d been accumulating since November last year) has all been rolled into a final version of the manually released Pwned Passwords data.</p><p>So, what does this mean mechanically? Two things: firstly, every single one of those NCA passwords is now searchable in <a href="https://haveibeenpwned.com/API/v3#PwnedPasswords">the live API</a>. Want to check? Here are some <em>new</em> passwords in the data set:</p><ol><li>flamingo228</li><li>Alexei2005</li><li>91177700</li><li>123Tests</li><li>aganesq</li></ol><p>Secondly, as with the previous 7 releases, version 8 is downloadable as both SHA-1 and NTLM hashes (read back to <a href="https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/">the original release blog post</a> if you&apos;re wondering why passwords for this service are stored in a fashion we&apos;d never do with normal user credentials). You can download these, query them offline or build your own private Pwned Passwords which is now easier than ever as all the code is open source &#x1F60A;</p><h3 id="in-the-ncas-words">In The NCA&apos;s Words</h3><p>I asked the NCA if there&apos;s anything they&apos;d like to add here, and they were kind enough to provide me with the following:</p><p><em>The UK National Crime Agency&#x2019;s (NCA) mission is to protect the public by leading the UK&#x2019;s fight to cut serious and organised crime. Within the cyber arena, their National Cyber Crime Unit (NCCU) works proactively to identify members of the public who could be at risk of harm, whether through the fraudulent use of personal details stolen via cyber offences, or through cyber-attacks enabled by credentials held by criminal groups.</em></p><p><em>The NCCU&apos;s Mitigation@Scale team have, over the last few years, been engaging with companies who they identified as having had user account details compromised or stolen, to help them secure these accounts and protect members of the public from further victimisation.</em></p><p><em>During recent NCA operational activity, the NCCU&#x2019;s Mitigation@Scale team were able to identify a huge amount of potentially compromised credentials (emails and associated passwords) in a compromised cloud storage facility. Through analysis, it became clear that these credentials were an accumulation of breached datasets known and unknown.</em></p><p><em>The fact that they had been placed on a UK business&#x2019;s cloud storage facility by unknown criminal actors meant the credentials now existed in the public domain, and could be accessed by other 3rd parties to commit further fraud or cyber offences.</em></p><p><em>Because the credentials identified could not be attributed to any one company or platform, the NCCU engaged with Troy Hunt, the CEO and creator of the &#x2018;Have I Been Pwned&#x2019; (HIBP) website. The NCCU&#x2019;s Mitigation@Scale team conducted a comparison of the compromised data against the HIBP password repository to identify any previously unseen passwords now in the public domain.</em></p><p><em>As a result of this activity, over 225 million compromised passwords previously unseen by HIBP were provided by the NCA to HIBP for incorporation into their password repository, allowing them to be checked by individuals and companies worldwide seeking to verify the security risk of a password before usage, supporting the NCA&#x2019;s mission to protect the public from cyber criminality.</em></p><h3 id="k-anonymity-api-vs-downloadable-corpus">K-anonymity API vs. Downloadable Corpus</h3><p>The k-anonymity API is the fastest possible way of getting up and running with Pwned Passwords. Not just in terms of upfront effort, but because of the nature of Cloudflare and the proximity of their edge nodes to major data centres, it&apos;s blisteringly fast. The k-anonymity model was already awesome for privacy and I made it even better again last year with <a href="https://www.troyhunt.com/enhancing-pwned-passwords-privacy-with-padding/">the introduction of padding</a> which protects against an MitM drawing conclusions based on TLS packet sizes. But perhaps most importantly, what the API gives you is the best way to identify newly identified compromised passwords <em>because you don&apos;t have to do anything to get access to them!</em></p><p>The downloadable corpus, on the other hand, is... substantial. If you want the latest set in SHA-1 format ordered by prevalence, that&apos;s a 17.2GB zip file that expands out to more than double that. Part of the reason it&apos;s so large is that it&apos;s <em>all</em> passwords I&apos;ve seen; short ones, long ones, sequential ones - whatever - the point is it&apos;s not filtered down at all. I&apos;ve had many requests from people asking me to bundle everything up into separate zips such that they only contain passwords longer than [insert your own personal preference here]. It&apos;s not going to happen and it&apos;s not a problem anyway if you use the k-anonymity API. However, if you really want to download them and process them in a more optimised fashion, check out <a href="https://scotthelme.co.uk/sketchy-pwned-passwords/">Scott Helme&apos;s recent blog post on how he used Count-Min Sketchon Pwned Passwords</a>.</p><p>Lastly, as of right now, the code to take the ingestion pipeline and dump all passwords into a downloadable corpus is yet to be written. We want to do this - we have every intention of doing this - but given how long it frequently was between releases, we don&apos;t feel the need to rush. The priority has been building the ingestion pipeline and providing new passwords via the k-anonymity API and as of now, that&apos;s working beautifully.</p><h3 id="summary">Summary</h3><p>Today&apos;s release brings the total Pwned Passwords count to <strong>847,223,402</strong>, a <strong>38%</strong> increase over the last version. More significantly, if we take the prevalence counts into consideration that&apos;s <strong>5,579,399,834</strong> occurrences of a compromised password represented in this corpus.</p><p>But more importantly, today&apos;s release is about turning on the firehose of new passwords and making them immediately available to everyone for free. Having this open to the community, <em>owned</em> by the community and supported by the FBI and NCA is an enormously pleasing result, and I couldn&apos;t be happier than to end the year on this note &#x1F60A;</p>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

In the last month, there were 1,260,000,000 occasions where a service somewhere checked a password against Have I Been Pwned's (HIBP's) Pwned Password API. 99.7% of the time, that check went no further than one of hundreds of Cloudflare edge nodes spread around the world (95% of the world's population is within 50ms of one). It looks like this:


There are all sorts of amazing Pwned Passwords use cases out there. For example, the Hims personal wellness website:

Or literally thousands of other services doing everything from providing their own password checker through to checking their customers' passwords on every registration, login or password change to see if it's previously been breached. And per the network request in the above image, every single password check is done using the k-anonymity model I launched back in 2018 to ensure that privacy is maintained and passwords can safely be checked without risk of disclosure. Oh - and it's all 100% free from top to bottom 😊
Today, I'm really excited to mark a major milestone in the project thanks to the support of two of the world's foremost law enforcement agencies, the FBI and the NCA.
Open Source Code and FBI Ingestion Pipeline
This has been a long time coming, and it's finally here. Today. Now. I mean it's literally live and working as you read this 😎
Last year I wrote about my intention to begin open sourcing parts of HIBP. I'm only able to run this project due to support from the community, so I wanted to start giving it back to the public in a bid to make it more open, more sustainable and in turn, more valuable to every single one of you using it. I made the decision to begin with Pwned Passwords and in May, I transitioned it into the .NET Foundation and announced we'd be building an ingestion pipeline. This pipeline enables the ingestion of passwords from law enforcement agencies, like the FBI. The premise is simple: during the course of their investigations, they come across a lot of compromised passwords and if they were able to continuously feed those into HIBP, all the other services out there using Pwned Passwords would be able to better protect their customers from account takeover attacks.
Fast forward to now and that ingestion pipeline is finally live. If you're using the Pwned Passwords API to check passwords, you're already benefiting; every new password added to the service will automatically be checked each time you call that API. Further, passwords already in the service are having their prevalence value updated to ensure you know just how bad those passwords really are.
I want to acknowledge Stefán Jökull Sigurðarson's role in making this possible. He stepped up and coordinated the community, worked with our FBI contacts, upgraded the tech stack to the latest and greatest versions and brought this whole thing to reality. He volunteered his time to make this possible and I'm enormously grateful for that, thanks mate 🙏
All of this alone would be awesome in and of itself, but as they say, there's just one more thing...
225M More Passwords From the NCA
The UK's National Crime Agency has done some wonderful work over the years to combat cybercrime. Back when I could travel, I'd often catch up with NCA folks in London and it was always fascinating to get just a little glimpse into how they were tackling things in that corner of the world. I used to show a short video of theirs at the beginning of many of my talks; it's titled Teenage Cybercrime: Help your child make the right choices and it formed part of their #CyberChoices campaign. I'd run it up front whilst people were filtering into the room because it was fun and light-hearted, but it told a serious story. There are a bunch of really smart kids out there and they find themselves at a crossroads where they could easily go down the wrong path with computer crimes but equally, easily be steered in a direction which may produce a wonderful career for them. The NCA wanted to help parents identify when kids may be at that crossroad and steer them in the right direction.
But let's get back to passwords: A little while back I was having a chat with some NCCU folks (the NCA's National Cyber Crime Unit), and talk turned to passwords. Turns out that like the FBI, they come across rather a lot of them and they had a very large corpus (as in hundreds of millions) they believed weren't already in HIBP. Now, keep in mind that before today's announcement, there were already 613M of them in the live Pwned Passwords service (and many millions more in my local working copy waiting for the next release), so the NCA's corpus represented a significant increase in size. Working in collaboration with the NCA, I imported and parsed out the data set against the existing passwords, I found 225,665,425 completely new instances out of a total set of 585,570,857. As such, this whole set (along with other sources I'd been accumulating since November last year) has all been rolled into a final version of the manually released Pwned Passwords data.
So, what does this mean mechanically? Two things: firstly, every single one of those NCA passwords is now searchable in the live API. Want to check? Here are some new passwords in the data set:

flamingo228
Alexei2005
91177700
123Tests
aganesq

Secondly, as with the previous 7 releases, version 8 is downloadable as both SHA-1 and NTLM hashes (read back to the original release blog post if you're wondering why passwords for this service are stored in a fashion we'd never do with normal user credentials). You can download these, query them offline or build your own private Pwned Passwords which is now easier than ever as all the code is open source 😊
In The NCA's Words
I asked the NCA if there's anything they'd like to add here, and they were kind enough to provide me with the following:
The UK National Crime Agency’s (NCA) mission is to protect the public by leading the UK’s fight to cut serious and organised crime. Within the cyber arena, their National Cyber Crime Unit (NCCU) works proactively to identify members of the public who could be at risk of harm, whether through the fraudulent use of personal details stolen via cyber offences, or through cyber-attacks enabled by credentials held by criminal groups.
The NCCU's Mitigation@Scale team have, over the last few years, been engaging with companies who they identified as having had user account details compromised or stolen, to help them secure these accounts and protect members of the public from further victimisation.
During recent NCA operational activity, the NCCU’s Mitigation@Scale team were able to identify a huge amount of potentially compromised credentials (emails and associated passwords) in a compromised cloud storage facility. Through analysis, it became clear that these credentials were an accumulation of breached datasets known and unknown.
The fact that they had been placed on a UK business’s cloud storage facility by unknown criminal actors meant the credentials now existed in the public domain, and could be accessed by other 3rd parties to commit further fraud or cyber offences.
Because the credentials identified could not be attributed to any one company or platform, the NCCU engaged with Troy Hunt, the CEO and creator of the ‘Have I Been Pwned’ (HIBP) website. The NCCU’s Mitigation@Scale team conducted a comparison of the compromised data against the HIBP password repository to identify any previously unseen passwords now in the public domain.
As a result of this activity, over 225 million compromised passwords previously unseen by HIBP were provided by the NCA to HIBP for incorporation into their password repository, allowing them to be checked by individuals and companies worldwide seeking to verify the security risk of a password before usage, supporting the NCA’s mission to protect the public from cyber criminality.
K-anonymity API vs. Downloadable Corpus
The k-anonymity API is the fastest possible way of getting up and running with Pwned Passwords. Not just in terms of upfront effort, but because of the nature of Cloudflare and the proximity of their edge nodes to major data centres, it's blisteringly fast. The k-anonymity model was already awesome for privacy and I made it even better again last year with the introduction of padding which protects against an MitM drawing conclusions based on TLS packet sizes. But perhaps most importantly, what the API gives you is the best way to identify newly identified compromised passwords because you don't have to do anything to get access to them!
The downloadable corpus, on the other hand, is... substantial. If you want the latest set in SHA-1 format ordered by prevalence, that's a 17.2GB zip file that expands out to more than double that. Part of the reason it's so large is that it's all passwords I've seen; short ones, long ones, sequential ones - whatever - the point is it's not filtered down at all. I've had many requests from people asking me to bundle everything up into separate zips such that they only contain passwords longer than [insert your own personal preference here]. It's not going to happen and it's not a problem anyway if you use the k-anonymity API. However, if you really want to download them and process them in a more optimised fashion, check out Scott Helme's recent blog post on how he used Count-Min Sketchon Pwned Passwords.
Lastly, as of right now, the code to take the ingestion pipeline and dump all passwords into a downloadable corpus is yet to be written. We want to do this - we have every intention of doing this - but given how long it frequently was between releases, we don't feel the need to rush. The priority has been building the ingestion pipeline and providing new passwords via the k-anonymity API and as of now, that's working beautifully.
Summary
Today's release brings the total Pwned Passwords count to 847,223,402, a 38% increase over the last version. More significantly, if we take the prevalence counts into consideration that's 5,579,399,834 occurrences of a compromised password represented in this corpus.
But more importantly, today's release is about turning on the firehose of new passwords and making them immediately available to everyone for free. Having this open to the community, owned by the community and supported by the FBI and NCA is an enormously pleasing result, and I couldn't be happier than to end the year on this note 😊

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
In the last month, there were 1,260,000,000 occasions where a service somewhere checked a password against Have I Been Pwned's (HIBP's) Pwned Password API. 99.7% of the time, that check went no further than one of hundreds of Cloudflare edge nodes spread

Open Source Pwned Passwords with FBI Feed and 225M New NCA Passwords is Now Live!

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>As I start out by saying this week&apos;s video, it&apos;s <em>very</em> summer here and not a day goes by without multiple pool visits. Next week&apos;s video is going to be from somewhere epically amazing out of this world that I&apos;ve wanted to</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/Splash-Template-2.jpg" alt="Weekly Update 274"><p>As I start out by saying this week&apos;s video, it&apos;s <em>very</em> summer here and not a day goes by without multiple pool visits. Next week&apos;s video is going to be from somewhere epically amazing out of this world that I&apos;ve wanted to go to for a long time now so stay tuned for that one as I go mobile again. Somehow, today&apos;s video stretched out beyond an hour with what felt like a list of pretty minor discussion points, but plenty of good questions and commentary along the way. I hope you enjoy these more conversational episodes and will join me live for a really unique one next week &#x1F60A;</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 274"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 274"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 274"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 274"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/_rP_dpa0HdE" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://www.prusaprinters.org/prints/93222-2021-dumpster-fire-christmas-ornament">2021 was a dumpster fire, so here&apos;s the 3D Christmas ornament to print</a> (I need this, it shall be printed)</li><li><a href="https://amplifi.com/alien">Here&apos;s the correct link to the AmplFi Alien by Ubiquiti</a> (this is just such a cool looking device, I&apos;m a bit jealous now)</li><li><a href="https://www.troyhunt.com/when-is-a-scrape-a-breach/">Scrape? Breach? Does it even matter? I don&apos;t think so, and I propose an alternate definition</a> (IMHO, the impact is more important than wordsmithing)</li><li><a href="https://l.kolide.co/3F4yIkB" rel="noopener">Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

As I start out by saying this week's video, it's very summer here and not a day goes by without multiple pool visits. Next week's video is going to be from somewhere epically amazing out of this world that I've wanted to go to for a long time now so stay tuned for that one as I go mobile again. Somehow, today's video stretched out beyond an hour with what felt like a list of pretty minor discussion points, but plenty of good questions and commentary along the way. I hope you enjoy these more conversational episodes and will join me live for a really unique one next week 😊







References

2021 was a dumpster fire, so here's the 3D Christmas ornament to print (I need this, it shall be printed)
Here's the correct link to the AmplFi Alien by Ubiquiti (this is just such a cool looking device, I'm a bit jealous now)
Scrape? Breach? Does it even matter? I don't think so, and I propose an alternate definition (IMHO, the impact is more important than wordsmithing)
Sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
As I start out by saying this week's video, it's very summer here and not a day goes by without multiple pool visits. Next week's video is going to be from somewhere epically amazing out of this world that I've wanted to

Weekly Update 274

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>A decade and a bit ago during my tenure at Pfizer, a colleague&apos;s laptop containing information about customers, healthcare providers and other vendors <a href="https://www.doj.nh.gov/consumer/security-breaches/documents/pfizer-20110610.pdf">was stolen from their car</a>. The machine had full disk encryption and it&apos;s not known whether the thief was ever actually able to</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/image-3-1.png" alt="When is a Scrape a Breach?"><p>A decade and a bit ago during my tenure at Pfizer, a colleague&apos;s laptop containing information about customers, healthcare providers and other vendors <a href="https://www.doj.nh.gov/consumer/security-breaches/documents/pfizer-20110610.pdf">was stolen from their car</a>. The machine had full disk encryption and it&apos;s not known whether the thief was ever actually able to access the data. It&apos;s not clear if the car was locked or not. Is this a data breach?</p><p>Some years later, <a href="https://www.troyhunt.com/the-red-cross-blood-service-australias-largest-ever-leak-of-personal-data/">an outsourcing provider of the Australian Red Cross Blood Service copied a database from production and backed it up to a web server facing the world</a>. Someone stumbled across it, downloaded it and then sent it to me. It was the largest incident of it&apos;s kind in Australia and it included my own personal data. No security controls were breached by the person who downloaded it, they simply accessed a publicly available file. Same question again - breach or not?</p><p>The whole discussion around what constitutes a breach came up again last week after I loaded email addresses scraped off Gravatar into <a href="https://haveibeenpwned.com/">Have I Been Pwned</a> (HIBP). This incident <a href="https://www.bleepingcomputer.com/news/security/online-avatar-service-gravatar-allows-mass-collection-of-user-info/">was originally in the news back in October last year</a> when a security researcher found this one neat trick to access a Gravatar profile:</p><pre><code>http://en.gravatar.com/1428.json</code></pre><p>Had you changed that number in the URL to 7888985, you would have seen this record:</p><pre>{
   &quot;entry&quot; : [
      {
         &quot;id&quot; : &quot;7888985&quot;,
         &quot;hash&quot; : &quot;4f2269dfd9414dc2b982f828e9574b57&quot;,
         &quot;requestHash&quot; : &quot;troyhunt&quot;,
         &quot;profileUrl&quot; : &quot;http : //gravatar.com/troyhunt&quot;,
         &quot;preferredUsername&quot; : &quot;troyhunt&quot;,
         &quot;thumbnailUrl&quot; : &quot;http : //1.gravatar.com/avatar/4f2269dfd9414dc2b982f828e9574b57&quot;,
         &quot;photos&quot; : [
            {
               &quot;value&quot; : &quot;http : //1.gravatar.com/avatar/4f2269dfd9414dc2b982f828e9574b57&quot;,
               &quot;type&quot; : &quot;thumbnail&quot;
            }
         ],
         &quot;name&quot; : {
            &quot;givenName&quot; : &quot;Troy&quot;,
            &quot;familyName&quot; : &quot;Hunt&quot;,
            &quot;formatted&quot; : &quot;Troy Hunt&quot;
         },
         &quot;displayName&quot; : &quot;troyhunt&quot;,
         &quot;currentLocation&quot; : &quot;Australia&quot;,
         &quot;urls&quot; : [
            
         ]
      }
   ]
}</pre><p>Yep, oldest trick in the book, &quot;insecure direct object references&quot; where you simply change a part of the URL to a predictable value and get back a different record. So, someone did that 167 million times, dumped the data and shared it on a popular hacking forum. But this is public profile information - stuff I consciously added to Gravatar knowing it would be publicly accessible - so is it a breach? Let&apos;s explore that idea further.</p><h3 id="defining-breach">Defining &quot;Breach&quot;</h3><p>So, which - if any - of the 3 examples above constitutes a breach? The first one resulted in Pfizer reporting the incident to the state&apos;s Attorney General so clearly they treated it as such. As for the second one, 3 days after I reported it to them the CEO did a press conference where she reported the incident so obviously, they also treated it as a breach. Gravatar? Not hacked:</p><blockquote class="twitter-tweet" data-conversation="none"><p lang="en" dir="ltr">Gravatar was not hacked. Our service gives you control over the data you want to share online. The data you choose to share publicly is made available via our API. Users can choose to share their full name, display name, location, email address, and a short biography.<br>(2/4)</p>&#x2014; Gravatar.com (@gravatar) <a href="https://twitter.com/gravatar/status/1467769312064815105?ref_src=twsrc%5Etfw">December 6, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>But... the Red Cross wasn&apos;t hacked either and <em>that </em>was clearly a data breach. The problem I have with this statement is that it conflates <em>the activity that granted access to the data</em> with <em>the privacy impact of the data falling into the wrong hands</em>. <a href="https://en.gravatar.com/support/data-privacy">The FAQ they published after I loaded the data into HIBP</a> uses the same &quot;hack&quot; term:</p><blockquote>While this incident was a misuse of our service, it was not a hack. No security protocols were breached.</blockquote><p>I mostly agree with this, at least the second sentence (the first sentence deserves a blog post of it&apos;s own about &quot;When is a Hack a Hack?&quot;) This incident didn&apos;t involve breaching a security protocol, at least not in your classic SQL injection style where a coding flaw allowed someone to <em>literally</em> hack the system and breach the data. But again, the means of access can&apos;t be the determining factor as to whether or not a breach has occurred.</p><p><a href="https://en.wikipedia.org/wiki/Data_breach">Here&apos;s Wikipedia&apos;s view</a>:</p><blockquote>A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.</blockquote><p>But that wouldn&apos;t fit the Red Cross scenario. It also doesn&apos;t work for the 24 million Lumin PDF accounts that <a href="https://www.zdnet.com/article/data-of-24-3-million-lumin-pdf-users-shared-on-hacking-forum/">were taken from a MongoDB instance</a> &quot;left exposed online without a password&quot; as no security was violated. It doesn&apos;t work for the <a href="https://news.softpedia.com/news/hacker-steals-58-million-user-records-from-data-storage-provider-509190.shtml">59 million Modern Business Solutions records</a> &quot;left exposed online&quot;. I could go on, but you get the idea.</p><p><strong>Edit (the next day):</strong> In response to this post, someone pointed me to <a href="https://about.fb.com/news/2021/12/expanding-bug-bounty-program-to-address-scraping/">Meta including scraping vectors within their bug bounty program</a>. This is really interesting as it elevates the significance of scraping up into the realms of what we&apos;d consider more traditional attacks that would qualify for a bounty (such as SQL injection). It&apos;s also interesting given Facebook&apos;s scraping incident earlier in the year and their defence of it...</p><h3 id="but-is-it-notifiable">But is it <em>Notifiable?</em></h3><p>Gravatar didn&apos;t notify impacted parties of this incident. Then again, neither did LinkedIn earlier this year or Facebook before them. All of them stuck with the line that scraping != breach therefore there&apos;s nothing to notify anyone about. Facebook actually stated in <a href="https://www.facebook.com/help/463983701520800">their writeup on scraping</a> that it was &quot;in violation of our terms of service&quot;, which immediately made me think of this zinger:</p><blockquote class="twitter-tweet"><p lang="en" dir="ltr">Posting it to you is secure, as it&apos;s illegal to open someone else&apos;s mail. ^JGS</p>&#x2014; Virgin Media (@virginmedia) <a href="https://twitter.com/virginmedia/status/1162756227132198914?ref_src=twsrc%5Etfw">August 17, 2019</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>Ah, that one will never get old!</p><p>Let&apos;s look at it this way: Facebook published that piece after I loaded the scraped data into HIBP and a whole bunch of people got pissed. Gravatar posted their FAQ <em>well over a year after initial reporting of the incident</em>, but only just after I loaded it into HIBP where many people responded in an equally pissed fashion.</p><p>Here&apos;s the important truth about scraping: public data or not, most people don&apos;t expect it to be used in that fashion and they&apos;re upset when it happens. They want answers. It shouldn&apos;t be <em>my</em> job as one guy sitting here running a free data breach service in his spare time to tell people their data has been inappropriately accessed, redistributed and in all likelihood, abused.</p><p>And while I&apos;m here debunking the relevancy of the notifiability of a breach, <a href="https://www.oaic.gov.au/privacy/guidance-and-advice/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme">check out the criteria for a breach down here in Australia to qualify as &quot;notifiable&quot;</a>:</p><blockquote>The NDB scheme requires regulated entities to notify particular individuals and the Commissioner about &#x2018;eligible data breaches&#x2019;. A data breach is eligible if it is likely to result in serious harm to any of the individuals to whom the information relates.</blockquote><p>So... let&apos;s say catforum.com.au gets dumped and all the plain text passwords spread around the internet alongside email addresses and usernames. But hey, it&apos;s just cats, who cares, right? No serious harm? Well if you work to the definition of being guided by &quot;the viewpoint of a reasonable person&quot;, no. But if you understand how data breaches, users and hackers all work, there&apos;s the keys to a bunch of cat lovers digital lives due to the prevalence of password reuse. This is just the ultimate Aussie &quot;she&apos;ll be right mate&quot; approach to respecting personal data.</p><p>The point is that just because you don&apos;t notify impacted individuals or even don&apos;t <em>have to</em>, doesn&apos;t mean it&apos;s not a breach and that people want to know about it.</p><h3 id="does-it-even-matter">Does it Even Matter?</h3><p>In researching the Gravatar incident before I published the email addresses to HIBP, I found this piece on a popular hacking forum:</p><p><img src="https://www.troyhunt.com/content/images/2021/12/image-3-1.png" alt="When is a Scrape a Breach?" loading="lazy"></p>
<p>So, to the title of this section, does it matter if you call it a breach or not? People have taken this data and are exchanging with others. Why? Well it&apos;s not to send them Christmas cards, I&apos;ll tell you that for sure! Another thread appeared on the same forum once the incident got press after going into HIBP, this time with someone selling the data. The first response in the thread is this one:</p><figure class="kg-card kg-image-card"><img src="https://www.troyhunt.com/content/images/2021/12/image-4.png" class="kg-image" alt="When is a Scrape a Breach?" loading="lazy" width="731" height="218" srcset="https://www.troyhunt.com/content/images/size/w600/2021/12/image-4.png 600w, https://www.troyhunt.com/content/images/2021/12/image-4.png 731w" sizes="(min-width: 720px) 720px"></figure><p>Uh, maybe they&apos;re sending <em>localised </em>Christmas cards?! Or perhaps the username on that account gives you a more accurate sense of what they intend to do with the addresses. That particular thread continues with the buyer seeking out Bulgarian email addresses, to which the seller advises there are over 100k addresses on .bg TLDs.</p><p>And per the previous point about whether or not this is a notifiable breach, most people want to know when their data has been exposed in a fashion it wasn&apos;t intended to be and then abused for purposes like those in the forum above obviously intend to use it. Breach, not a breach, I don&apos;t care - <em>it doesn&apos;t matter</em> - it&apos;s my data and I want to know about it.</p><h3 id="a-modern-breach-definition">A Modern Breach Definition</h3><p>Enough talking about all the problems, let me propose a solution. In fact, let me propose a much more modern definition of the word &quot;breach&quot; consistent with the real world impact of unintentionally exposed data:</p><blockquote>A data breach occurs when information is obtained by an unauthorised party in a fashion in which it was not intended to be made available.</blockquote><p>On this basis, the Gravatar situation was a data breach. The data <em>wasn&apos;t meant to be accessible in this fashion </em>(&quot;we did not intend for the API to be used in this way&quot;), that&apos;s why they changed the behaviour of the API once they discovered how it was being used. If everything worked as intended and data was only accessible to the right people in the right way, they wouldn&apos;t have had to &quot;fix&quot; anything. The reason they changed the way the service works is because - and I&apos;m going to quote myself here - &quot;information was obtained by an unauthorised party in a fashion in which it was not intended to be made available&quot;. And that&apos;s a breach.</p>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

A decade and a bit ago during my tenure at Pfizer, a colleague's laptop containing information about customers, healthcare providers and other vendors was stolen from their car. The machine had full disk encryption and it's not known whether the thief was ever actually able to access the data. It's not clear if the car was locked or not. Is this a data breach?
Some years later, an outsourcing provider of the Australian Red Cross Blood Service copied a database from production and backed it up to a web server facing the world. Someone stumbled across it, downloaded it and then sent it to me. It was the largest incident of it's kind in Australia and it included my own personal data. No security controls were breached by the person who downloaded it, they simply accessed a publicly available file. Same question again - breach or not?
The whole discussion around what constitutes a breach came up again last week after I loaded email addresses scraped off Gravatar into Have I Been Pwned (HIBP). This incident was originally in the news back in October last year when a security researcher found this one neat trick to access a Gravatar profile:

http://en.gravatar.com/1428.json

Had you changed that number in the URL to 7888985, you would have seen this record:

{
   "entry" : [
      {
         "id" : "7888985",
         "hash" : "4f2269dfd9414dc2b982f828e9574b57",
         "requestHash" : "troyhunt",
         "profileUrl" : "http : //gravatar.com/troyhunt",
         "preferredUsername" : "troyhunt",
         "thumbnailUrl" : "http : //1.gravatar.com/avatar/4f2269dfd9414dc2b982f828e9574b57",
         "photos" : [
            {
               "value" : "http : //1.gravatar.com/avatar/4f2269dfd9414dc2b982f828e9574b57",
               "type" : "thumbnail"
            }
         ],
         "name" : {
            "givenName" : "Troy",
            "familyName" : "Hunt",
            "formatted" : "Troy Hunt"
         },
         "displayName" : "troyhunt",
         "currentLocation" : "Australia",
         "urls" : [
            
         ]
      }
   ]
}

Yep, oldest trick in the book, "insecure direct object references" where you simply change a part of the URL to a predictable value and get back a different record. So, someone did that 167 million times, dumped the data and shared it on a popular hacking forum. But this is public profile information - stuff I consciously added to Gravatar knowing it would be publicly accessible - so is it a breach? Let's explore that idea further.
Defining "Breach"
So, which - if any - of the 3 examples above constitutes a breach? The first one resulted in Pfizer reporting the incident to the state's Attorney General so clearly they treated it as such. As for the second one, 3 days after I reported it to them the CEO did a press conference where she reported the incident so obviously, they also treated it as a breach. Gravatar? Not hacked:

Gravatar was not hacked. Our service gives you control over the data you want to share online. The data you choose to share publicly is made available via our API. Users can choose to share their full name, display name, location, email address, and a short biography.
(2/4)
— Gravatar.com (@gravatar) December 6, 2021
 
But... the Red Cross wasn't hacked either and that was clearly a data breach. The problem I have with this statement is that it conflates the activity that granted access to the data with the privacy impact of the data falling into the wrong hands. The FAQ they published after I loaded the data into HIBP uses the same "hack" term:
While this incident was a misuse of our service, it was not a hack. No security protocols were breached.
I mostly agree with this, at least the second sentence (the first sentence deserves a blog post of it's own about "When is a Hack a Hack?") This incident didn't involve breaching a security protocol, at least not in your classic SQL injection style where a coding flaw allowed someone to literally hack the system and breach the data. But again, the means of access can't be the determining factor as to whether or not a breach has occurred.
Here's Wikipedia's view:
A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.
But that wouldn't fit the Red Cross scenario. It also doesn't work for the 24 million Lumin PDF accounts that were taken from a MongoDB instance "left exposed online without a password" as no security was violated. It doesn't work for the 59 million Modern Business Solutions records "left exposed online". I could go on, but you get the idea.
Edit (the next day): In response to this post, someone pointed me to Meta including scraping vectors within their bug bounty program. This is really interesting as it elevates the significance of scraping up into the realms of what we'd consider more traditional attacks that would qualify for a bounty (such as SQL injection). It's also interesting given Facebook's scraping incident earlier in the year and their defence of it...
But is it Notifiable?
Gravatar didn't notify impacted parties of this incident. Then again, neither did LinkedIn earlier this year or Facebook before them. All of them stuck with the line that scraping != breach therefore there's nothing to notify anyone about. Facebook actually stated in their writeup on scraping that it was "in violation of our terms of service", which immediately made me think of this zinger:

Posting it to you is secure, as it's illegal to open someone else's mail. ^JGS
— Virgin Media (@virginmedia) August 17, 2019
 
Ah, that one will never get old!
Let's look at it this way: Facebook published that piece after I loaded the scraped data into HIBP and a whole bunch of people got pissed. Gravatar posted their FAQ well over a year after initial reporting of the incident, but only just after I loaded it into HIBP where many people responded in an equally pissed fashion.
Here's the important truth about scraping: public data or not, most people don't expect it to be used in that fashion and they're upset when it happens. They want answers. It shouldn't be my job as one guy sitting here running a free data breach service in his spare time to tell people their data has been inappropriately accessed, redistributed and in all likelihood, abused.
And while I'm here debunking the relevancy of the notifiability of a breach, check out the criteria for a breach down here in Australia to qualify as "notifiable":
The NDB scheme requires regulated entities to notify particular individuals and the Commissioner about ‘eligible data breaches’. A data breach is eligible if it is likely to result in serious harm to any of the individuals to whom the information relates.
So... let's say catforum.com.au gets dumped and all the plain text passwords spread around the internet alongside email addresses and usernames. But hey, it's just cats, who cares, right? No serious harm? Well if you work to the definition of being guided by "the viewpoint of a reasonable person", no. But if you understand how data breaches, users and hackers all work, there's the keys to a bunch of cat lovers digital lives due to the prevalence of password reuse. This is just the ultimate Aussie "she'll be right mate" approach to respecting personal data.
The point is that just because you don't notify impacted individuals or even don't have to, doesn't mean it's not a breach and that people want to know about it.
Does it Even Matter?
In researching the Gravatar incident before I published the email addresses to HIBP, I found this piece on a popular hacking forum:


So, to the title of this section, does it matter if you call it a breach or not? People have taken this data and are exchanging with others. Why? Well it's not to send them Christmas cards, I'll tell you that for sure! Another thread appeared on the same forum once the incident got press after going into HIBP, this time with someone selling the data. The first response in the thread is this one:

Uh, maybe they're sending localised Christmas cards?! Or perhaps the username on that account gives you a more accurate sense of what they intend to do with the addresses. That particular thread continues with the buyer seeking out Bulgarian email addresses, to which the seller advises there are over 100k addresses on .bg TLDs.
And per the previous point about whether or not this is a notifiable breach, most people want to know when their data has been exposed in a fashion it wasn't intended to be and then abused for purposes like those in the forum above obviously intend to use it. Breach, not a breach, I don't care - it doesn't matter - it's my data and I want to know about it.
A Modern Breach Definition
Enough talking about all the problems, let me propose a solution. In fact, let me propose a much more modern definition of the word "breach" consistent with the real world impact of unintentionally exposed data:
A data breach occurs when information is obtained by an unauthorised party in a fashion in which it was not intended to be made available.
On this basis, the Gravatar situation was a data breach. The data wasn't meant to be accessible in this fashion ("we did not intend for the API to be used in this way"), that's why they changed the behaviour of the API once they discovered how it was being used. If everything worked as intended and data was only accessible to the right people in the right way, they wouldn't have had to "fix" anything. The reason they changed the way the service works is because - and I'm going to quote myself here - "information was obtained by an unauthorised party in a fashion in which it was not intended to be made available". And that's a breach.

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
A decade and a bit ago during my tenure at Pfizer, a colleague's laptop containing information about customers, healthcare providers and other vendors was stolen from their car. The machine had full disk encryption and it's not known whether the thief was ever actually able to

When is a Scrape a Breach?

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>Geez, I&apos;m a bit orange today! I think mucking around with the (excepti0nally cool!) moon lamp towards the beginning of this video threw the colours off a bit. In the past, I&apos;d turn on the auto white balance lock and things would stay steady, but since</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/Splash-Template-1.jpg" alt="Weekly Update 273"><p>Geez, I&apos;m a bit orange today! I think mucking around with the (excepti0nally cool!) moon lamp towards the beginning of this video threw the colours off a bit. In the past, I&apos;d turn on the auto white balance lock and things would stay steady, but since I put up the Elgato key lamps and the colour has been so steady, I&apos;ve kind of just let it go. Lesson learned. Plenty of other good things this week though, next week I&apos;ll aim to live stream this at the beginning of the day and catch audiences on the US time zones as well.</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 273"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 273"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 273"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 273"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/TVn8OhL1TZI" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><p>References</p><ol><li><a href="https://twitter.com/troyhunt/status/1469222243200745472">The 3D printed moon light is soooo nice!</a> (it now looks like this will become a repeatable Xmas present for friends)</li><li><a href="https://twitter.com/troyhunt/status/1469770277340938240">I didn&apos;t hit 200k Twitter followers by this video...</a> (but I did a day and a half later!)</li><li><a href="https://twitter.com/troyhunt/status/1468801235427889153">After more than 11 years, it was finally time for a new profile photo</a> (I really like this one &#x1F60A;)</li><li><a href="https://twitter.com/troyhunt/status/1468055446099353600">You know what&apos;s not weird at all? A toy surveillance camera to watch your kids</a> (I feel like people are making more of this than what it actually deserves, but it&apos;s still weird)</li><li><a href="https://twitter.com/troyhunt/status/1467654621619388416">Gravatar got scraped and 114M email addresses are circulating</a> (stay tuned for next week&apos;s blog post on whether this was a breach or not)</li><li><a href="https://www.troyhunt.com/a-password-manager-isnt-just-for-christmas-its-for-life-so-heres-50-percent-off/">Here&apos;s the best value, most useful Xmas present you&apos;ll find</a> (50% off my favourite password manager!)</li><li><a href="https://1password.com/" rel="noopener">Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Geez, I'm a bit orange today! I think mucking around with the (excepti0nally cool!) moon lamp towards the beginning of this video threw the colours off a bit. In the past, I'd turn on the auto white balance lock and things would stay steady, but since I put up the Elgato key lamps and the colour has been so steady, I've kind of just let it go. Lesson learned. Plenty of other good things this week though, next week I'll aim to live stream this at the beginning of the day and catch audiences on the US time zones as well.







References

The 3D printed moon light is soooo nice! (it now looks like this will become a repeatable Xmas present for friends)
I didn't hit 200k Twitter followers by this video... (but I did a day and a half later!)
After more than 11 years, it was finally time for a new profile photo (I really like this one 😊)
You know what's not weird at all? A toy surveillance camera to watch your kids (I feel like people are making more of this than what it actually deserves, but it's still weird)
Gravatar got scraped and 114M email addresses are circulating (stay tuned for next week's blog post on whether this was a breach or not)
Here's the best value, most useful Xmas present you'll find (50% off my favourite password manager!)
Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
Geez, I'm a bit orange today! I think mucking around with the (excepti0nally cool!) moon lamp towards the beginning of this video threw the colours off a bit. In the past, I'd turn on the auto white balance lock and things would stay steady, but since

Weekly Update 273

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>I was having a coffee with a good mate the other day. He&apos;s not a techie (he runs a pizza restaurant), but somehow, we ended up talking about passwords. Because he&apos;s a normal person, he has the same 1 or 2 or 3 he uses everywhere</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/Troy-Hunt-announcement-2.png" alt="A Password Manager Isn&apos;t Just for Christmas, It&apos;s for Life (So Here&apos;s 50% Off!)"><p>I was having a coffee with a good mate the other day. He&apos;s not a techie (he runs a pizza restaurant), but somehow, we ended up talking about passwords. Because he&apos;s a normal person, he has the same 1 or 2 or 3 he uses everywhere and even without telling me what they were, I knew they were terrible. Actually, I&apos;ll rephrase that: because he <em>was</em> a normal guy; he&apos;s not normal anymore because yesterday I carved out some time to give him an early Christmas present:</p><blockquote class="twitter-tweet"><p lang="en" dir="ltr">Today I spent an hour getting a mate into <a href="https://twitter.com/1Password?ref_src=twsrc%5Etfw">@1Password</a>. I bought him a year&apos;s worth at $4.99 per month for him, his wife and 3 kids and within an hour, had him going across devices and enabling 2FA on his things. Make this your Xmas present when you visit friends and family &#x1F60E;</p>&#x2014; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1467758661913038854?ref_src=twsrc%5Etfw">December 6, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>This tweet got a heap of love with many people chiming in about what a good idea it is to use the Christmas period to transform the security posture of our loved ones. So, a few hours after tweeting this I pinged the folks at 1Password:</p><p><strong>Me:</strong> Hey, people love this idea, what can we do?</p><p><strong>1Password:</strong> Here&apos;s a link to get 50% off for the next 1,000 people that sign up for a families subscription.</p><p>Well that was easy &#x1F642; Also, where were you guys a few hours ago when I shelled out for a year at full price?! Not upset, that was still a great value Christmas present, but this is, well, literally twice as great value! All you need to do is follow this link:</p><p><a href="https://start.1password.com/sign-up/family?c=TROY-MXIEYXAH">Yes, I&apos;d like to be a good daughter / son / niece / nephew / grand-daughter / grand-son / cousin / next door neighbour / mate / well-wisher / whatever and give someone a 1Password subscription at 50% off <em>and help them learn how to use it!</em></a></p><p>That last point is really important: had I not spent that hour with my mate, he would have had to find his own way through a tool he&apos;d never seen before then attempt to change life-long practices all in one go. Just to make it <em>really</em> easy for anyone who wants to take up this offer and help get a mate up and running, here&apos;s the basics of what we did:</p><ol><li>I explained the importance of password uniqueness and how <a href="https://www.troyhunt.com/only-secure-password-is-one-you-cant/">your brain will never allow you to achieve this across all the services you use</a></li><li>We signed him for an account on the website and added his family members as part of the process (remember, use the link above for the 50% off!)</li><li>He created a master password he hadn&apos;t used anywhere before</li><li>We printed <a href="https://support.1password.com/emergency-kit/">the Emergency Kit</a> and wrote his master password on it by hand (it&apos;ll now go into a safe)</li><li>We turned on 2FA (he had an existing soft token authenticator)</li><li>He installed the client on his Mac (including the browser extension) and then on his iPhone</li><li>We took a very small handful of accounts and went through the following process:<br>	a. Login and have 1Password store the credentials<br>	b. Change the password to one 1Password automatically generates<br>	c. Turn on 2FA and <a href="https://support.1password.com/one-time-passwords/">store the token in 1Password</a></li></ol><p>And that was it. Obviously, he still has a heap of accounts to set decent passwords on, but now he knows the pattern and he can repeat that over and over again. Starting with the most important services makes sense (email, banking, social media) and then helping his own family members will be a breeze after that.</p><p>What I really enjoyed about this process was watching how painful it was for him to type in banking info manually (account number then password) compared to how fast it was once 1Password just started auto-filling it for him. And speaking of banking info, remember that 1Password isn&apos;t just about storing passwords, I put credit cards in there too so they can easily be auto-filled into websites on check-out. In fact, there&apos;s a whole heap of different classes of &quot;secrets&quot; you can store (screen cap from the latest v8 for Windows):</p><figure class="kg-card kg-image-card"><img src="https://www.troyhunt.com/content/images/2021/12/image-1.png" class="kg-image" alt="A Password Manager Isn&apos;t Just for Christmas, It&apos;s for Life (So Here&apos;s 50% Off!)" loading="lazy" width="549" height="771"></figure><p>Most people reading this are techie enough to easily get their loved ones up and running in an hour and I genuinely reckon that&apos;s one of the best Christmas presents you can give them. Per the title, this is a gift that will keep on giving for the long term as it permanently changes people&apos;s behaviour. And now it&apos;s cheaper than ever &#x1F642;</p><p>For full disclosure, <a href="https://www.troyhunt.com/ive-joined-the-1password-board-of-advisers/">I&apos;m on 1Password&apos;sBoard of Advisors</a>. The link for 50% off <em>is not</em> a referral link and other than giving me warm fuzzies, I get nothing from people signing up via it. Also, I only get the aforementioned warm fuzzies if people let me know they&apos;ve actually helped out a mate so please comment here or tweet me if you take this up, I&apos;d love to know it&apos;s helped people.</p>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

I was having a coffee with a good mate the other day. He's not a techie (he runs a pizza restaurant), but somehow, we ended up talking about passwords. Because he's a normal person, he has the same 1 or 2 or 3 he uses everywhere and even without telling me what they were, I knew they were terrible. Actually, I'll rephrase that: because he was a normal guy; he's not normal anymore because yesterday I carved out some time to give him an early Christmas present:

Today I spent an hour getting a mate into @1Password. I bought him a year's worth at $4.99 per month for him, his wife and 3 kids and within an hour, had him going across devices and enabling 2FA on his things. Make this your Xmas present when you visit friends and family 😎
— Troy Hunt (@troyhunt) December 6, 2021
 
This tweet got a heap of love with many people chiming in about what a good idea it is to use the Christmas period to transform the security posture of our loved ones. So, a few hours after tweeting this I pinged the folks at 1Password:
Me: Hey, people love this idea, what can we do?
1Password: Here's a link to get 50% off for the next 1,000 people that sign up for a families subscription.
Well that was easy 🙂 Also, where were you guys a few hours ago when I shelled out for a year at full price?! Not upset, that was still a great value Christmas present, but this is, well, literally twice as great value! All you need to do is follow this link:
Yes, I'd like to be a good daughter / son / niece / nephew / grand-daughter / grand-son / cousin / next door neighbour / mate / well-wisher / whatever and give someone a 1Password subscription at 50% off and help them learn how to use it!
That last point is really important: had I not spent that hour with my mate, he would have had to find his own way through a tool he'd never seen before then attempt to change life-long practices all in one go. Just to make it really easy for anyone who wants to take up this offer and help get a mate up and running, here's the basics of what we did:

I explained the importance of password uniqueness and how your brain will never allow you to achieve this across all the services you use
We signed him for an account on the website and added his family members as part of the process (remember, use the link above for the 50% off!)
He created a master password he hadn't used anywhere before
We printed the Emergency Kit and wrote his master password on it by hand (it'll now go into a safe)
We turned on 2FA (he had an existing soft token authenticator)
He installed the client on his Mac (including the browser extension) and then on his iPhone
We took a very small handful of accounts and went through the following process:
	a. Login and have 1Password store the credentials
	b. Change the password to one 1Password automatically generates
	c. Turn on 2FA and store the token in 1Password

And that was it. Obviously, he still has a heap of accounts to set decent passwords on, but now he knows the pattern and he can repeat that over and over again. Starting with the most important services makes sense (email, banking, social media) and then helping his own family members will be a breeze after that.
What I really enjoyed about this process was watching how painful it was for him to type in banking info manually (account number then password) compared to how fast it was once 1Password just started auto-filling it for him. And speaking of banking info, remember that 1Password isn't just about storing passwords, I put credit cards in there too so they can easily be auto-filled into websites on check-out. In fact, there's a whole heap of different classes of "secrets" you can store (screen cap from the latest v8 for Windows):

Most people reading this are techie enough to easily get their loved ones up and running in an hour and I genuinely reckon that's one of the best Christmas presents you can give them. Per the title, this is a gift that will keep on giving for the long term as it permanently changes people's behaviour. And now it's cheaper than ever 🙂
For full disclosure, I'm on 1Password'sBoard of Advisors. The link for 50% off is not a referral link and other than giving me warm fuzzies, I get nothing from people signing up via it. Also, I only get the aforementioned warm fuzzies if people let me know they've actually helped out a mate so please comment here or tweet me if you take this up, I'd love to know it's helped people.

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
I was having a coffee with a good mate the other day. He's not a techie (he runs a pizza restaurant), but somehow, we ended up talking about passwords. Because he's a normal person, he has the same 1 or 2 or 3 he uses everywhere

A Password Manager Isn't Just for Christmas, It's for Life (So Here's 50% Off!)

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>Check out that lighting! The Elgato Key Lights have made a massive difference and they&apos;re easily controlled via their Stream Deck or the Home Assistant integration. I&apos;m just super, super happy with these and after posting this video, I&apos;ve fixed them directly to the</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/12/Splash-Template.jpg" alt="Weekly Update 272"><p>Check out that lighting! The Elgato Key Lights have made a massive difference and they&apos;re easily controlled via their Stream Deck or the Home Assistant integration. I&apos;m just super, super happy with these and after posting this video, I&apos;ve fixed them directly to the wall using their Multi Mount System so it&apos;s now clean desk and clean line of sight between that and the screens. More tweaking to be done and more work to be done on the office, but it&apos;s all coming together very nicely now &#x1F60E;</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 272"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 272"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 272"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 272"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/Y6a6F5A9Swo" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://twitter.com/troyhunt/status/1465109338096164869">My new Elgato Key Lights are now up and running</a> (beautifully made product and a <em>massive</em> improvement on before)</li><li><a href="https://twitter.com/troyhunt/status/1466662969698254848">I may have underestimated how much it costs to ship books around the world for #pwnedmas</a> (but hey, it&apos;s worth it, I&apos;m sure they&apos;ll be well loved)</li><li><a href="https://twitter.com/troyhunt/status/1466211715582873600">The Ubiquiti breach that came from inside</a> (this news goes a long way to explaining their reaction)</li><li><a href="https://www.google.com/search?q=the+register+rosebutt+data+breach&amp;sxsrf=AOaemvK0sU045y-fqSAq-45yzlGLGWH4Hw:1638653402998&amp;source=lnms&amp;tbm=isch&amp;sa=X&amp;sqi=2&amp;ved=2ahUKEwjCjvvPi8v0AhWcwTgGHewJBTsQ_AUoAnoECAEQBA&amp;biw=2560&amp;bih=1329&amp;dpr=1">The Register&apos;s piece on the Rosebutt data breach</a> (Google images search, first result &#x1F632;)</li><li><a href="https://1password.com/" rel="noopener">Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Check out that lighting! The Elgato Key Lights have made a massive difference and they're easily controlled via their Stream Deck or the Home Assistant integration. I'm just super, super happy with these and after posting this video, I've fixed them directly to the wall using their Multi Mount System so it's now clean desk and clean line of sight between that and the screens. More tweaking to be done and more work to be done on the office, but it's all coming together very nicely now 😎







References

My new Elgato Key Lights are now up and running (beautifully made product and a massive improvement on before)
I may have underestimated how much it costs to ship books around the world for #pwnedmas (but hey, it's worth it, I'm sure they'll be well loved)
The Ubiquiti breach that came from inside (this news goes a long way to explaining their reaction)
The Register's piece on the Rosebutt data breach (Google images search, first result 😲)
Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
Check out that lighting! The Elgato Key Lights have made a massive difference and they're easily controlled via their Stream Deck or the Home Assistant integration. I'm just super, super happy with these and after posting this video, I've fixed them directly to the

Weekly Update 272

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>It&apos;s been a busy week with lots of little bits and pieces demanding my attention. Coding, IoT&apos;ing, 3D printing and a milestone academic event for Ari:</p><blockquote class="twitter-tweet"><p lang="en" dir="ltr">Primary school - done! <a href="https://t.co/IvUt6lBJRr">pic.twitter.com/IvUt6lBJRr</a></p>&#x2014; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1463600036042870787?ref_src=twsrc%5Etfw">November 24, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>No major things in this</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/11/Splash-Template-3.jpg" alt="Weekly Update 271"><p>It&apos;s been a busy week with lots of little bits and pieces demanding my attention. Coding, IoT&apos;ing, 3D printing and a milestone academic event for Ari:</p><blockquote class="twitter-tweet"><p lang="en" dir="ltr">Primary school - done! <a href="https://t.co/IvUt6lBJRr">pic.twitter.com/IvUt6lBJRr</a></p>&#x2014; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1463600036042870787?ref_src=twsrc%5Etfw">November 24, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>No major things in this weeks update, but plenty of things on all the above topics and more. Next week we&apos;re taking a short holiday then I&apos;ll be back in time to talk about that and more next Friday. For now, here&apos;s edition 271 (crikey, that&apos;s a lot), enjoy!</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 271"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 271"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 271"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 271"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/QPx7e6kPldE" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://twitter.com/troyhunt/status/1458533426730975233">Still powering ahead with my 3D printed map of Oslo</a> (I&apos;ll keep updating that thread until it&apos;s done)</li><li><a href="https://twitter.com/troyhunt/status/1463639444079079425">I got 3D scanned by a VECTRA M3</a> (it sounds more exciting than it was, but it&apos;s still a pretty cool machine)</li><li><a href="https://twitter.com/troyhunt/status/1464130074123268098">Played around with Polycam 3D to make a map of the house</a> (need an iPhone Pro for the LiDAR)</li><li><a href="https://twitter.com/troyhunt/status/1464794721658695680">New profile pic inbound!</a> (I got 11 years out of the old one, but... I&apos;ve aged)</li><li><a href="https://twitter.com/troyhunt/status/1464154037012492290">I&apos;m sending out the #pwnedmas swag and there&apos;s still plenty of time to enter</a> (just sign up for the free preview of my book and you&apos;re in)</li><li><a href="https://1password.com/" rel="noopener">Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

It's been a busy week with lots of little bits and pieces demanding my attention. Coding, IoT'ing, 3D printing and a milestone academic event for Ari:

Primary school - done! pic.twitter.com/IvUt6lBJRr
— Troy Hunt (@troyhunt) November 24, 2021
 
No major things in this weeks update, but plenty of things on all the above topics and more. Next week we're taking a short holiday then I'll be back in time to talk about that and more next Friday. For now, here's edition 271 (crikey, that's a lot), enjoy!







References

Still powering ahead with my 3D printed map of Oslo (I'll keep updating that thread until it's done)
I got 3D scanned by a VECTRA M3 (it sounds more exciting than it was, but it's still a pretty cool machine)
Played around with Polycam 3D to make a map of the house (need an iPhone Pro for the LiDAR)
New profile pic inbound! (I got 11 years out of the old one, but... I've aged)
I'm sending out the #pwnedmas swag and there's still plenty of time to enter (just sign up for the free preview of my book and you're in)
Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
It's been a busy week with lots of little bits and pieces demanding my attention. Coding, IoT'ing, 3D printing and a milestone academic event for Ari:

Primary school - done! pic.twitter.com/IvUt6lBJRr
— Troy Hunt (@troyhunt) November 24, 2021
 
No major things in this

Weekly Update 271

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>I&apos;m outdoors! I&apos;ve really wanted to get my mobile recording setup slick for some time now and after a bunch of mucking around with various mics (and a bit of &quot;debugging in production&quot; during this video), I&apos;m finally really happy with it.</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/11/Splash-Template-2.jpg" alt="Weekly Update 270"><p>I&apos;m outdoors! I&apos;ve really wanted to get my mobile recording setup slick for some time now and after a bunch of mucking around with various mics (and a bit of &quot;debugging in production&quot; during this video), I&apos;m finally really happy with it. I&apos;ve just watched this back and other than mucking around with the gain in the first part of the video, I reckon it&apos;s great. The one thing I&apos;ll change in the future (and I don&apos;t know when I&apos;ll next do this outdoors, TBH) is to plug the R&#xD8;DE lapel mic into the wireless unit. So, enjoy the absolutely amazing Gold Coast weather and hear some cyber things while you&apos;re at it &#x1F60E;</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 270"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 270"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 270"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 270"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/yHT7JGoUvec" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://twitter.com/troyhunt/status/1460464512537006087">I&apos;ve given up; the R&#xD8;DE &#xA0;VideoMic Me-L just isn&apos;t going to work on <em>my</em> iPhone 13 Pro Max</a> (I suspect this is more likely Apple&apos;s fault than R&#xD8;DE&apos;s)</li><li><a href="https://twitter.com/troyhunt/status/1460146136514134021">I&apos;ve finalised the filaments for my 3D map printing</a> (matte white for the top, matte black for the bottom)</li><li><a href="https://twitter.com/troyhunt/status/1460766837348585473?s=21">I have to find a better way to do disclosure</a> (I didn&apos;t expect to solve it with that thread, but it did give me a lot of food for thought)</li><li><a href="https://www.troyhunt.com/today-marks-two-important-milestones/">I spoke about &quot;The Evolution of the Employee&quot;</a> (that&apos;s in my &lt;/pfizer&gt; blog post from 2015)</li><li><a href="https://www.troyhunt.com/merry-pwnedmas/">It&apos;s #pwnedmas!</a> (I&apos;m giving away stickers and 3D printed logos every day to a rando who has signed up for my free book preview)</li><li><a href="https://www.red-gate.com/products/dba/sql-monitor/?utm_source=Troy-Hunt.com&amp;utm_medium=commad&amp;utm_campaign=sqlmonitor" rel="noopener">Sponsored by: Redgate&#x2019;s SQL Monitor: always understand the health of your SQL Server estate and avoid potential issues before they impact your business.</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

I'm outdoors! I've really wanted to get my mobile recording setup slick for some time now and after a bunch of mucking around with various mics (and a bit of "debugging in production" during this video), I'm finally really happy with it. I've just watched this back and other than mucking around with the gain in the first part of the video, I reckon it's great. The one thing I'll change in the future (and I don't know when I'll next do this outdoors, TBH) is to plug the RØDE lapel mic into the wireless unit. So, enjoy the absolutely amazing Gold Coast weather and hear some cyber things while you're at it 😎







References

I've given up; the RØDE  VideoMic Me-L just isn't going to work on my iPhone 13 Pro Max (I suspect this is more likely Apple's fault than RØDE's)
I've finalised the filaments for my 3D map printing (matte white for the top, matte black for the bottom)
I have to find a better way to do disclosure (I didn't expect to solve it with that thread, but it did give me a lot of food for thought)
I spoke about "The Evolution of the Employee" (that's in my </pfizer> blog post from 2015)
It's #pwnedmas! (I'm giving away stickers and 3D printed logos every day to a rando who has signed up for my free book preview)
Sponsored by: Redgate’s SQL Monitor: always understand the health of your SQL Server estate and avoid potential issues before they impact your business.

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
I'm outdoors! I've really wanted to get my mobile recording setup slick for some time now and after a bunch of mucking around with various mics (and a bit of "debugging in production" during this video), I'm finally really happy with it.

Weekly Update 270

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>Like most of my good ideas, this one came completely by accident. The other day I was packaging up some swag to send to the winner of <a href="https://twitter.com/troyhunt/status/1455137628370575362">my impromptu best &quot;Anonymous&quot; meme competition</a> and I decided to share the following tweet:</p><blockquote class="twitter-tweet" data-conversation="none"><p lang="en" dir="ltr">Time to ramp up the 3D <a href="https://twitter.com/haveibeenpwned?ref_src=twsrc%5Etfw">@haveibeenpwned</a></p></blockquote>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/11/2021-11-17_23-12-28.png" alt="Merry #pwnedmas!"><p>Like most of my good ideas, this one came completely by accident. The other day I was packaging up some swag to send to the winner of <a href="https://twitter.com/troyhunt/status/1455137628370575362">my impromptu best &quot;Anonymous&quot; meme competition</a> and I decided to share the following tweet:</p><blockquote class="twitter-tweet" data-conversation="none"><p lang="en" dir="ltr">Time to ramp up the 3D <a href="https://twitter.com/haveibeenpwned?ref_src=twsrc%5Etfw">@haveibeenpwned</a> printing too, been giving away a heap of these! <a href="https://t.co/ffZpM5aZtx">pic.twitter.com/ffZpM5aZtx</a></p>&#x2014; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1460032210187153410?ref_src=twsrc%5Etfw">November 14, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>And I was promptly hit by many, many requests for 3D printed HIBP logos. That was kinda the point of buying the 3D printer in the first place (to print cool swag), and I really love that people are excited by my handiwork. However, I can&apos;t just give this stuff to everyone that asks for it, I mean there&apos;s gotta be some gamification to the whole thing. So, to make things interesting, I&apos;ve come up with #pwnedmas:</p><p><strong>Each day between now and Christmas day, I&apos;m going to send a swag pack to one random person who downloads the preview of my book &quot;Pwned&quot;.</strong></p><p>This is super easy, just head on over to <a href="https://book.troyhunt.com/">book.troyhunt.com</a> and chuck in your name and email address. You&apos;ll immediately get the preview (which is pretty cool in and of itself), then each day I&apos;ll also pick out a random name and they&apos;ll get a lovingly hand-crafted 3D HIBP logo, a big stash of HIBP stickers and I might even slip in a few <a href="https://twitter.com/Scott_Helme/status/1110253165071470598">cheeky Scott Helme stickers</a> too &#x1F60E; I want to post these out as fast as I can and if you get one, I&apos;d love you to tweet it out with the hashtag #pwnedmas and I&apos;ll give it a share.</p><p>I don&apos;t get to go places and give these out anymore so this is the next best thing. Get on over to <a href="https://book.troyhunt.com/">book.troyhunt.com</a> and enter to win, I&apos;ll go fire up the 3D printer!</p>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Like most of my good ideas, this one came completely by accident. The other day I was packaging up some swag to send to the winner of my impromptu best "Anonymous" meme competition and I decided to share the following tweet:

Time to ramp up the 3D @haveibeenpwned printing too, been giving away a heap of these! pic.twitter.com/ffZpM5aZtx
— Troy Hunt (@troyhunt) November 14, 2021
 
And I was promptly hit by many, many requests for 3D printed HIBP logos. That was kinda the point of buying the 3D printer in the first place (to print cool swag), and I really love that people are excited by my handiwork. However, I can't just give this stuff to everyone that asks for it, I mean there's gotta be some gamification to the whole thing. So, to make things interesting, I've come up with #pwnedmas:
Each day between now and Christmas day, I'm going to send a swag pack to one random person who downloads the preview of my book "Pwned".
This is super easy, just head on over to book.troyhunt.com and chuck in your name and email address. You'll immediately get the preview (which is pretty cool in and of itself), then each day I'll also pick out a random name and they'll get a lovingly hand-crafted 3D HIBP logo, a big stash of HIBP stickers and I might even slip in a few cheeky Scott Helme stickers too 😎 I want to post these out as fast as I can and if you get one, I'd love you to tweet it out with the hashtag #pwnedmas and I'll give it a share.
I don't get to go places and give these out anymore so this is the next best thing. Get on over to book.troyhunt.com and enter to win, I'll go fire up the 3D printer!

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
Like most of my good ideas, this one came completely by accident. The other day I was packaging up some swag to send to the winner of my impromptu best "Anonymous" meme competition and I decided to share the following tweet:

Time to ramp up the 3D @haveibeenpwned

Merry #pwnedmas!

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p>Where does the time go? The video is an hour and 35 mins today, I suspect in part because I&apos;ve done it on a Saturday morning with a bit more time to spare and, well, there was just a lot of stuff happening. I did make up for</p>

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><img src="https://www.troyhunt.com/content/images/2021/11/Splash-Template-1.jpg" alt="Weekly Update 269"><p>Where does the time go? The video is an hour and 35 mins today, I suspect in part because I&apos;ve done it on a Saturday morning with a bit more time to spare and, well, there was just a lot of stuff happening. I did make up for working on a Saturday by then heading straight down to the beach and it was perfect!</p><blockquote class="twitter-tweet"><p lang="en" dir="ltr">Everything here is perfect &#x1F60E; &#x1F334; &#x1F40B; <a href="https://t.co/0FqfSFanns">https://t.co/0FqfSFanns</a></p>&#x2014; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1459301071411499011?ref_src=twsrc%5Etfw">November 12, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>The water looked so perfect that true to my word, we then had to go jet skiing &#x1F60E;</p><blockquote class="twitter-tweet"><p lang="en" dir="ltr">Epic jet ski ride! Offshore winds, so flat and calm by the beach. Crystal clear water, heaps of dolphins and a nice steak sandwich topped off by a chill out in the hot tub &#x1F42C; &#x1F96A; &#x1F334; &#x1F60E; <a href="https://t.co/qNqqeBdyP5">pic.twitter.com/qNqqeBdyP5</a></p>&#x2014; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1459445741194153984?ref_src=twsrc%5Etfw">November 13, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><p>But yeah - back to cyber - here&apos;s this week&apos;s video. Enjoy!</p><div><div style="width: 170px; display: inline-block; margin-right: 3px;"><a href="https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699"><img src="https://www.troyhunt.com/content/images/2018/05/Listen-on-Apple-Podcasts.svg" alt="Weekly Update 269"></a></div><div style="width: 146px; display: inline-block; margin-right: 3px;"><a href="https://playmusic.app.goo.gl/?ibi=com.google.PlayMusic&amp;isi=691797987&amp;ius=googleplaymusic&amp;apn=com.google.android.music&amp;link=https://play.google.com/music/m/If3tw7npymckucxq4q76762ncny?t%3DTroy_Hunt&apos;s_Weekly_Update_Podcast%26pcampaignid%3DMKT-na-all-co-pr-mu-pod-16"><img src="https://www.troyhunt.com/content/images/2018/05/Get-it-on-Google-Play.svg" alt="Weekly Update 269"></a></div><div style="width: 118px; display: inline-block; margin-right: 3px;"><a href="https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit"><img src="https://www.troyhunt.com/content/images/2019/10/spotify.svg" class="kg-image" alt="Weekly Update 269"></a></div><div style="width: 120px; display: inline-block;"><a href="https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss"><img src="https://www.troyhunt.com/content/images/2018/07/Download-via-RSS.svg" alt="Weekly Update 269"></a></div><iframe width="100%" height="480" src="https://www.youtube.com/embed/NDkqZFcBwY4" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe></div><h3 id="references">References</h3><ol><li><a href="https://twitter.com/troyhunt/status/1459059503194730499">The home office upgrades are coming along nicely</a> (thread there with the wall-mounted screen and camera along with a sample of the sound absorbing material that&apos;ll cover the wall and ceiling)</li><li><a href="https://twitter.com/troyhunt/status/1458533426730975233">I&apos;m 3D printing some pretty epic city maps</a> (Oslo and Sydney will adorn the wall on &quot;The 3D Printing Room&quot;)</li><li><a href="https://twitter.com/troyhunt/status/1396710480727531521">Here&apos;s the thread on the Google Nest Protect smoke alarms I installed in May</a> (still really happy with these, does precisely what you&apos;d expect them to)</li><li><a href="https://www.comparitech.com/blog/information-security/vpn-database-leak/">ActMobile was <em>probably</em> breached, but they&apos;re denying it and have threatened Bob Diachenko</a> (given the circumstances, I&apos;ve flagged this one as &quot;unverified&quot;)</li><li><a href="https://techcrunch.com/2021/11/09/robinhood-data-breach/">Robinhood was definitely breached</a> (5M+ subscribers, apparently)</li><li><a href="https://www.bbc.com/news/technology-59209493">Angling Direct in the UK was also definitely breached, with visitors to their site being presented with an entirely different kind of tackle</a> (and that&apos;s one of the less bad jokes I&apos;ve seen about this incident!)</li><li><a href="https://www.troyhunt.com/beg-bounties/">Beg bounties are a terrible practice that should die a fiery death</a> (although I&apos;m a little tempted to mess with them a little more... &#x1F642;)</li><li><a href="https://1password.com/" rel="noopener">Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online</a></li></ol>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

Where does the time go? The video is an hour and 35 mins today, I suspect in part because I've done it on a Saturday morning with a bit more time to spare and, well, there was just a lot of stuff happening. I did make up for working on a Saturday by then heading straight down to the beach and it was perfect!

Everything here is perfect 😎 🌴 🐋 https://t.co/0FqfSFanns
— Troy Hunt (@troyhunt) November 12, 2021
 
The water looked so perfect that true to my word, we then had to go jet skiing 😎

Epic jet ski ride! Offshore winds, so flat and calm by the beach. Crystal clear water, heaps of dolphins and a nice steak sandwich topped off by a chill out in the hot tub 🐬 🥪 🌴 😎 pic.twitter.com/qNqqeBdyP5
— Troy Hunt (@troyhunt) November 13, 2021
 
But yeah - back to cyber - here's this week's video. Enjoy!







References

The home office upgrades are coming along nicely (thread there with the wall-mounted screen and camera along with a sample of the sound absorbing material that'll cover the wall and ceiling)
I'm 3D printing some pretty epic city maps (Oslo and Sydney will adorn the wall on "The 3D Printing Room")
Here's the thread on the Google Nest Protect smoke alarms I installed in May (still really happy with these, does precisely what you'd expect them to)
ActMobile was probably breached, but they're denying it and have threatened Bob Diachenko (given the circumstances, I've flagged this one as "unverified")
Robinhood was definitely breached (5M+ subscribers, apparently)
Angling Direct in the UK was also definitely breached, with visitors to their site being presented with an entirely different kind of tackle (and that's one of the less bad jokes I've seen about this incident!)
Beg bounties are a terrible practice that should die a fiery death (although I'm a little tempted to mess with them a little more... 🙂)
Sponsored by: 1Password is a secure password manager and digital wallet that keeps you safe online

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
Where does the time go? The video is an hour and 35 mins today, I suspect in part because I've done it on a Saturday morning with a bit more time to spare and, well, there was just a lot of stuff happening. I did make up for

Weekly Update 269

<p><a href="https://l.kolide.co/3F4yIkB"><strong>Presently sponsored by:</strong> Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!</a></p><p><a href="https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/">When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago</a>, I had a nightmare of a time getting in touch with the company. They&apos;d left a MongoDB instance exposed to the public without a password and someone had snagged all</p>

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!

When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago, I had a nightmare of a time getting in touch with the company. They'd left a MongoDB instance exposed to the public without a password and someone had snagged all their data. Within the data were references that granted access to voice recordings made by children, stored in an S3 bucket that also had no auth. So, why didn't CloudPets respond to attempts to contact them? Their CEO later explained it very succinctly:

"We did have a reporter, try to contact us multiple times last week, you don't respond to some random person about a data breach.
— Michael Kan (@Michael_Kan) February 28, 2017
 
Problem is, random people are precisely the sorts of people that find data breaches. I mean, who wouldn't be random in this situation?!
A little later and I'm attempting disclosure to Adult-FanFiction:

I always try to provide enough information to independently verify the incident thus making it easy to establish the legitimacy of my message. I'd done this so many times by then that I was very conscious of how scammy these messages can look. Alas, all reasonable measures were exhausted without response, I loaded the data into Have I Been Pwned (HIBP) and then they took notice:

In order of sentences: Yes there is, that's bullshit, that's true, that's also bullshit, no they won't, they never did. That public forum post was later removed, but I always back these things up because you just never know when common sense may prevail 🙂
Why are companies so skittish about responding to disclosure notices like these? In part, because there are those amongst us who attempt to run what amounts to a digital protection racket in order to make some quick bucks. Here's an example:

Ooh, sounds nasty! Here's the attachment (shout out to Mr Robot):

He's sent it to the email address I have published in my security.txt file which I put out there because I genuinely want to know if someone finds a security vulnerability in any of my things. And that's a real possibility; I've created dozens of courses on infosec (including one that includes a module on clickjacking!), I've written hundreds of blog posts on the topic, I've travelled the world running my Hack Yourself First workshop (over 100 times now), I've somehow even ended up in US Congress talking about cybersecurity! But I can make mistakes. Coding mistakes. Configuration mistakes. Or someone else makes one in a library or platform I'm dependent on and wammo! It is I who is pwned. But not this time:

That link Mayank shared leads to a page that literally has this at the bottom of it (conveniently cropped off the earlier image he attached):

This is why my email above says "beg bounty" and it's exactly what it sounds like - someone begging for a bounty. Sophos wrote up a bunch of good examples earlier this year and they typically amount to easily discoverable configurations that are publicly observable and minor in nature. DMARC records. A missing CSP. Anything that as Sophos puts it, is "scaremongering for profit". And just to be crystal clear, these are "reports" submitted to website operators who do not have a published bug bounty. I love bug bounties (2 of my Pluralsight courses are on them with friend and Bugcrowd founder Casey Ellis), but we're not talking about organisations with the resources to invest in formal programs that pay money (which, incidentally, Pluralsight also runs). No, we're talking about resources like my blog and free community projects like HIBP. Hence the "beg" component of the bounty.
.post_header {background-position-y: 100%;}

Feel free to use this as often as you’d like. pic.twitter.com/1kVSqjLeut
— Steve Edwards (@sedward5) October 23, 2020
 
Want to be a bounty beggar? It's dead simple, you just use tools like Qualys' SSL Labs, dmarcian or Scott Helme's Security Headers, among others. Easy point and shoot magic and you don't need to have any idea whatsoever what you're doing! But hold on, why does that HIBP report on Scott's site only score a "B"? Where's the CSP? And the referrer-policy? They're on HIBP (go and check for yourself in your browser), but they're not there on the interstitial page Cloudflare is serving up to Scott's crawler as part of the anti-automation defences I've put in place. But hey, that takes knowledge and understanding to establish which is why I've received beg bounty requests for precisely this in the past.
I was finally prompted to write this after yet another run-in with someone seeking a beg bounty. Here's the thread:

I fucking hate beg bounties 😡 pic.twitter.com/Giv4JRRaty
— Troy Hunt (@troyhunt) November 6, 2021


It was immediately clear that Hammad was going to beg for a bounty, but it was a quiet Saturday night here and I thought it would be entertaining to see just how far down the rabbit hole he wanted to go. So, I responded, positively:

pic.twitter.com/1OEkJDHHcH
— Troy Hunt (@troyhunt) November 6, 2021
 
I took my usual signature off the email (the one you can see in an earlier screen grab), just to ensure Hammad held onto the glimmer of hope that he may successfully extract some hard-earned money from me. Of course, he took the bait:

pic.twitter.com/epM9YTSz1L
— Troy Hunt (@troyhunt) November 6, 2021
 
It's like dealing with scam phone calls: if you want to see where they lead, you need to play the game and not come on too strong too early. Hammad continued a few minutes later:

pic.twitter.com/uoaGstoASH
— Troy Hunt (@troyhunt) November 6, 2021
 
And there we have it. The beg. It was always going to come, he just neglected to mention it in the first message. Maybe he forgot? Or maybe he's done this enough times now (which subsequent replies to this thread with his previous attempts suggest) that he's learned enough social engineering to know not to go too hard on the first approach. This dismayed me:

pic.twitter.com/yfVR8UkXBv
— Troy Hunt (@troyhunt) November 6, 2021
 
On a (slightly) more serious note for a moment, this is what specifically pisses me off: I don't know how many disclosures I've done of both serious security vulnerabilities and complete breaches of data (100+, surely), but I have never, ever - not even once - asked for money. But Hammad isn't me:

pic.twitter.com/hhBpyBQG6y
— Troy Hunt (@troyhunt) November 6, 2021
 
Now, as many people subsequently pointed out in the thread, the irony is that Hammad did actually already do the "work" for free and whether I paid him or not, the effort had already been invested. Ok, patience exhausted, time to put the signature back in and take Hammad to school:

pic.twitter.com/We6F17ZOZY
— Troy Hunt (@troyhunt) November 6, 2021
 
I did genuinely have this blog post in draft and had been adding bits to it as the Hammads of the world popped their begs into my inbox. If he stopped responding here, then that would have been the end of it; I might have just added a couple more notes and come back to this post in the distant future. However, after this next reply I knew where my Sunday afternoon was going:

pic.twitter.com/1KtYck2WEF
— Troy Hunt (@troyhunt) November 6, 2021
 
I bet it was clickjacking! Maybe on hack-yourself-first.com 🤣
Clearly, I didn't forget and I also didn't forgive and he probably should have expected me (sorry, couldn't help myself!) If I'm honest, I was surprised at how much traction this thread got and I woke up on Sunday morning to hundreds of mentions and thousands of likes across the tweet thread. It struck a chord. Many of you fucking hate beg bounties and shared my lack of sympathy for Muhammad Kamran (the full name will help SEO the next time someone he targets starts searching for him 🙂). However, there was a very small single-digit number of people that disagreed, and I want to address those arguments here:

I'm not happy with this approach either. If he is a scammer with no vuln found then go ahead and waste his time. I wouldn't call people trying to make money as a begger. He sounds kind and sincere to me. I don't public humiliate a person asking to wash my windows for a dollar
— JohnΞ (@j3g) November 6, 2021
 
First sentence - good! Onto the "scammer" comment and it raises an interesting question: is this a scam? I agree with this use of the term in that this behaviour amounts to "a dishonest scheme" and, depending on the definition you read, the intent is to "deceive and defraud". Attempting to scare people with an alleged vulnerability then withholding information about it until a financial commitment is made all whilst claiming to be a "white hat" is dishonest, deceptive, and fraudulent. As for the rest, firstly, "beg bounty" is becoming a pretty broadly adopted term as you saw from the Sophos article. A quick nod also to Michael Argast and Chester Wisniewski (who, incidentally, wrote the earlier mentioned Sophos article) for their role in coining the phrase:

I love the fact a term I coined with @chetwisniewski after running into a bunch of these a couple of years ago is getting tweeted by @troyhunt, one of my infosec heros. 😆 https://t.co/heOQjWgySz
— Michael Argast 💉💉🤗 (@michaelargast) November 6, 2021
 
As for Hammad having a "kind and sincere" demeanour, you get more flies with honey than vinegar. Of course he's going to be nice! Have you ever had someone try to scam you who started out being obnoxious? No, you'd hang up on them right away. Gaining someone's trust by coming across as approachable and building rapport is scamming 101. It's also no excuse whatsoever for this behaviour. As for the "wash my windows for a dollar" remark, firstly, IRL analogies explaining digital concepts are terrible. Secondly, if we really want to go down that path then the correct analogy is a random stranger telling you there's something important wrong with your car, but they won't tell you what it is unless you give them money. A lot less nice, that example, isn't it?

sorry Troy, but I don't think that your answers were appropriate. While these people obviously want some free money, you don't need to lower yourself to that level, you could have handled it better. Remember that this could have been an example which people would follow
— opsxcq (@opsxcq) November 6, 2021
 
The responses to that tweet speak for themselves (Hammad, is that you?) but the last sentence hit a nerve. This is exactly the example I would like people to follow! I'd like them to waste the time of the beg bounty hunter, give them a stern talking to and shame them publicly. Look, if you really want to inject some warm fuzzies into your own messaging then suggest the likes of Hammad go and get involved as a genuine security researcher at Bugcrowd or HackerOne. There has never been a better time for actual security researchers to get involved in this industry and there is no shortage of opportunities that don't involve shaking down unsuspecting victims for cash. And people have been actively sharing their own experiences with the same guy:

One must simply love these "White Hat Hackers"... pic.twitter.com/xfxgVuuX4t
— Ondřej Surý (@oerdnj) November 3, 2021
 
That name is familiar… I found this back in 2019 pic.twitter.com/7rxcZl0Tms
— Parrilla (@nubeblog) November 6, 2021
 
muhammad hammad loves @elhackernet too 😂 pic.twitter.com/JJ9q9uqUTu
— elhacker.NET (@elhackernet) November 7, 2021
 
Yea he has been floating around begging for a while. pic.twitter.com/yRAuUQMvQ6
— (╯°□°）╯︵ zɔɹʎp ʎpuɐ (@adyrcz) November 6, 2021
 
This illustrates why on balance, I'm comfortable using the name Muhammad Kamran or Muhammad Hammad in this post as others have done in their tweets; I'd like for the next person he tries to scare into coughing up cash to search for his name, find this post and understand the principle of the beg bounty and why it can be safely ignored. Equally, I'd be perfectly happy if someone used my name to highlight my approach to disclosure, because this is what it looks like:

I picked this example because it's very recent and if you read my tweet thread about the Thingiverse breach, a very frustrating experience. But it's the right way to go about it! Open. Honest. Transparent. But above all, bereft of ulterior motives. I only wanted one thing out of the Thingiverse disclosure and that was simply for them to be aware of the breach and to inform their customers accordingly.
Getting back to my original point, is it any wonder companies are standoff-ish when someone like myself attempts to report a genuine serious security issue? Just look at a Twitter search for me asking for security contacts at a company. It shouldn't be this way and shady approaches by bounty beggars makes it all the harder. I'm sitting on literally billions of records from undisclosed data breaches because the burden of disclosure is so high. 
Finally, I'm a massive supporter of the security.txt standard and have been for many years now, and I just hate hearing stories from people about how it's being abused for beg bounties. This is literally one of the barriers to entry: as soon as security contacts are published, organisations have to deal with garbage reports that create noise and cause genuine, legitimate reports to sink amongst all the crap they're dealing with.
This is why I have no patience for beg bounties and no hesitation exposing those who partake in them to the detriment of absolutely everyone other than themselves. If you receive this garbage, respond with a stern word and a link to this post... and perhaps a tweet thread of your own 🙂

From now on, I won't ignore this kind of emails. This is going to be my answer, thanks @troyhunt !
— Our Code World (@ourcodeworld) November 7, 2021

Presently sponsored by: Got Slack? Got Macs? Get Kolide: Device security that fixes challenging problems by messaging your users on Slack. Try Kolide Today!
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago, I had a nightmare of a time getting in touch with the company. They'd left a MongoDB instance exposed to the public without a password and someone had snagged all