Subresource Integrity and Upgrade-Insecure-Requests Are Now Supported in Edge

The more time that goes by and the more deeply I give it thought, the more convinced I am that the web is held together with sticky tape. No - cyber-sticky tape! Because especially when it comes to security, there are fundamental and inherent shortcomings in everything from HTTP … | Continue reading


@troyhunt.com | 6 years ago

Is Enumerating Resources on a Website “Hacking”?

I saw a story pop up this week which made a bunch of headlines and upon sharing it, also sparked some vigorous debate. It all had to do with a 19-year-old bloke in Canada downloading some publicly accessible documents which, as it later turned out, shouldn't have been publicly ac … | Continue reading


@troyhunt.com | 6 years ago

IRL Analogies Explaining Digital Concepts Are Terrible

Remember the anti-piracy campaign from years back about "You Wouldn't Steal a Car"? This was the rather sensationalist piece put together by the Motion Picture Association of America in an attempt to draw parallels between digital piracy and what they viewed as IRL (&qu … | Continue reading


@troyhunt.com | 6 years ago

Enhancing Pwned Passwords Privacy by Exclusively Supporting Anonymity

When I launched Pwned Passwords in August, I honestly didn't know how much it would be used. I made 320M SHA-1 password hashes downloadable and also stood up an API to query the data "as a service" by either a plain text password or a SHA-1 hash. (Incidentally, | Continue reading


@troyhunt.com | 6 years ago