HIBP just gained 16k records leaked from Troy Hunt’s himself - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: March 31, 2025, 09:28:40 am
content: Nobody is safe.Troy Hunt fallen to a simple phishing attack. 16 thousand records affected.Let it be a lesson to everybody.

author: Halcyon
author_rank: Unknown
timestamp: April 07, 2025, 04:33:01 am
content: I happen to know Troy and his message is spot on. Don't be complacent just because you're techy and you "know better". It can happen to the best, we're all human.

author: golden_labels
author_rank: Super Contributor
timestamp: April 07, 2025, 05:30:53 am
content: (Assuming that was a message to me)(edit: it was not)I am not? My post isn’t ridiculing Troy. “Let it be a lesson to everybody” is in the meaning of this happening even to the best. If that were to be any snide undertone in my comment, it would rather be towards some overconfident people. Their stance irks me. But I tried to keep the post neutral and avoid any unneeded notes.I of course find the situation ironical in the humorous way, but not holding that against him. That’s also why I linked Troy’s own explanation, instead of any of many not so pleasant reports on the incident.

author: tggzzz
author_rank: Super Contributor
timestamp: April 07, 2025, 09:57:37 am
content: Quote from: Halcyon on April 07, 2025, 04:33:01 amIndeed.Here's an example of it happening to another switched on and competent (and very pleasant!) person.videohttps://www.bbc.co.uk/news/av/business-27688173transcripthttps://downloads.bbc.co.uk/tv/watchdog/WebScript_CourierScam_040614.doc

author: Siwastaja
author_rank: Super Contributor
timestamp: April 07, 2025, 11:11:09 am
content: Data security seems like a lost battle since these three things happened:1) Best practices are getting more and more complex and harder to understand even to tech-y people, let alone laymen, and are fast-changing,2) Majority of companies and organizations, including banks, ignore all "best practices" and act like scammers in their usual communication, so that actual phishing attempts look no different at all3) Organizations like Google, Microsoft, Apple etc. do their best in their email/SMS client software design to aid scammers, e.g. by unnecessary and poorly implemented "threading of messages" functions (making fraudulent messages appear as part of legitimate conversation), or, as in this example, hiding crucial information like theemail addressI'm not a true security expert, but I'm pretty damn close to understanding most of the relevant concepts, and reasons why people are advised as they are. Yet, I'm also 100% confident that some day I will be a victim of a similar scam. Simply put, in today's world you either choose to completely withdraw from modern society (move into a cave, get some chickens...), or you participate in scam-like bullshit every day - and one day it's an actual scam, timing is good, you are tired and accidentally fall for it.For example, consider Finland. If you are ever going to buy anything online, you will be redirected to a third party website with an odd address, asking for your bank account information. Normal; you enter them. First time I encountered it I at least googled "what the fuck is this company with a weird name". That Google result could have been bogus or easily manipulated but I decided to trust it, did not get scammed. Yet what I find alarming is that absolutely no one else finds this alarming. I have seen zero discussion about it on media. Not even as an example how not to do it.Browsers are fine enough to seriously warn about unauthenticated connections. They prevent entering sites with certificate mismatch completely. Therefore, let's say my bank's name is OP, if I see URLhttps://op.fi, I can pretty much trust I am dealing with this bank. This whole premise falls completely apart by me having to enter the OP bank's credentials into a site with URL ofhttps://samlink.fi. What the fuck is Samlink, and why does its UI look like a crappy scammer copy of the real bank's UI, and why the fuck people are comfortable entering their credentials?Theroot issueis banks being technically inept and so fucking lazy that they fail to outsource their IT work to whatever Samlink as well-designed projects, including the part of running the banking backend on, say, OP bank's internet domain. Instead, they pick the easier route to redirect customer to their IT partner's, Samlink's website. And apparently no one frowns upon this, except me. Even if the data itself is managed between these two companies to required safety standard of the banking sector, this still gives the customers a lesson to trust any URL. When this Samlink bullshit appeared, we should have had a long and serious public discussion about why this is so fundamentally wrong, but nothing, just crickets.Then, it is normal for banks to send you email with links to their login pages and request to do something. This is just nuts. It's data security basics 101 to teach people to never click links like this. Yet banks themselves can't avoid sending real messages that look like phishing.People have been conditioned to trust Google's or Microsoft's autogenerated metadata like threading of messages, sender names etc., and their algorithms are so total and utter crap it is trivial for attackers to manipulate. People have been conditioned to click links and buttons in email.In reality, ALL that is needed to significantly reduce success of phishing is that companies themselves start respecting the "never click links in emails", and not put links in their emails. Then service provides like Google etc. can add a simple pop-up confirmation window asking "are you sure you want to open this third-party link? Normally you should navigate through your service provider's website. Contact their customer service for help". And because using such modern email clients is pain in the ass anyway, and because there very rarely is real need to click links on emails, this would be only a minor nuisance.This should be combined with some long-term stability (predictablity) of services: simple UI design, company names that do not change every other day. Outsourcing hidden from user. So that normal use is streamlined and easy. The problem nowadays is that services (Microsoft's one of the absolute worst offenders) are so freaking difficult to log in to and use, that people are completely accustomed to solving these puzzles by following any 3rd party step-by-step instruction lists, or clicking whatever buttons that just "make it work". And the services and their core safety principles are different every day. So all that is needed for successful phishing is correct timing. Even security experts will just enter their credentials into a slightly different site, in a slightly deviating process (password manager failing to autofill that) becausesuch changes are everyday. In a more stable, well-designed UI experience, any attempt to put the user in a different process would immediately ring the alarm bells, so user could make some checks.

author: tggzzz
author_rank: Super Contributor
timestamp: April 07, 2025, 11:41:45 am
content: Quote from: Siwastaja on April 07, 2025, 11:11:09 amSecurity is a holistic continuous process.Most people think (I use that word loosely) it is a buy-and-forget bit of tech.Very few people can comprehend the whole, since there too many entities, layers and even concepts are involved.QuoteHiding email addresses from scrapers is necessary. But people should be able to see them before using them.Google is trying to "get rid of" URLs.Farcebook and similar neuter URLs behind gobs of JavaScript.

author: Nominal Animal
author_rank: Super Contributor
timestamp: April 08, 2025, 01:31:21 am
content: I've done security-sensitive web stuff for decades, but don't consider myself a security specialist. Just a paranoid developer suitable for some of the related work.There is absolutely nothing that a "page" can do to ensure users are not misled by fake pages, because everything on a page can be faked.This means the browser's own user interface is the only thing users can rely on being factually correct. The one single difficult to fake detail is the exact URI of the content being shown. Any attempts at obfuscating that are anti-security, and only makes it easier to steal from users.(I'd go even so far as to claim that merging the search bar and the URI bar was a mistake. Yes, it does save space, and yes, it works well, but thecognitiveeffect of merging search and site identification makes it harder for nontechnical humans to carefully keep track of the URI.)Instead of an abstraction, we should tell users to check that, and companies to use subdomains with partners instead of random domains. Just like Siwastaja described, the use of random/unrelated domains only makes stealing from users easier. It is no wonder banks are spending a lot of money on lobbyists trying to shift responsibility to end users; they themselves are actively making it easier to steal from users, and rather than fix that, it'd be more profitable to let it continue and just have somebody else pay for it.My elderly mom is a perfect example. She's 75 now, and till she was 65 or so, swore she would never touch a computer. Then, she discovered her grandkids were posting about their life on social media, and immediately got a tablet. (That's what grandmasdo, you see.) As non-technical as she is, it was trivial to explain to her to look at the browser address bar, explaining that the part immediately after the double slashes (//) was thedomain name, and to check that it was the exact correct one and not one with a typo or only similar. This alone stops over 99% of fake website attacks!E-mails are harder, but there, the advice of "never click on anything in an e-mail or message; always open your browser, and open the page using a bookmark or typing in the correct full domain" works.Firefox 136 has an useful address bar feature: the domain part, without the standard prefix, is slightly highlighted:(Click to embiggen)

author: Halcyon
author_rank: Unknown
timestamp: April 08, 2025, 04:02:46 am
content: Quote from: golden_labels on April 07, 2025, 05:30:53 amIt wasn't, I was just making a general comment to those following along at home. I know there will be many (not necessarily on this forum) pointing fingers at Troy, criticising him or attempting to make themselves out to be superior.

author: Halcyon
author_rank: Unknown
timestamp: April 08, 2025, 04:04:32 am
content: Quote from: tggzzz on April 07, 2025, 11:41:45 amI see this all the time at the executive level. I'm C-suite myself but one of those rare, technically competent leaders. I'm forever repeating myself and banging my head against the wall.

author: tggzzz
author_rank: Super Contributor
timestamp: April 08, 2025, 09:38:32 am
content: Quote from: Halcyon on April 08, 2025, 04:04:32 amWell, from one point of view buy-and-forgetissufficient. The PoV being "I've armour-plated my back" therefore deflecting the blame elsewhere.Bruce Schneier's "Security Theatre" is a useful concept.

author: golden_labels
author_rank: Super Contributor
timestamp: April 08, 2025, 10:08:37 am
content: “Armour-plating one’s back” better falls into the category described by Kelsey(1)and Schneier in last month’s essay onrational astrologies. Consider not parroting a new fancy term without reading, understanding, and throroughly thinking overWaldman’s original post.(1)Widely known as a co-author of Twofish.

author: Halcyon
author_rank: Unknown
timestamp: April 08, 2025, 10:20:43 am
content: Quote from: tggzzz on April 08, 2025, 09:38:32 amI'm one of these bosses who doesn't mind telling someone to "not be a dickhead" in a board meeting. It turns heads sometimes, but when I was a copper working general duties the "softly softly" approach didn't always work with the crooks either ("Sir, could you please put down that knife" doesn't have the same impact).Do shit right the first time is my mantra.