jartine commited on
Commit
3a4e25b
1 Parent(s): dd3e444

Remove unintentional file used for testing

Browse files
Files changed (1) hide show
  1. boop +0 -536
boop DELETED
@@ -1,536 +0,0 @@
1
- [INST]Summarize the following article:
2
-
3
- Link: canonical
4
- Link: webmention
5
- Mastodon
6
- [ Submit ]
7
- * Home
8
- * Workshops
9
- * Speaking
10
- * Media
11
- * About
12
- * Contact
13
- * Sponsor
14
- * * * * * Sponsored by:
15
-
16
- A Decade of Have I Been Pwned
17
-
18
- * * * * * 04 December 2023
19
-
20
- A decade ago to the day, I published a tweet launching what would
21
- surely become yet another pet project that scratched an itch, was
22
- kinda useful to a few people but other than that, would shortly
23
- fade away into the same obscurity as all the other ones I'd
24
- launched over the previous couple of decades:
25
-
26
- It's alive! "Have I been pwned?" by @troyhunt is now up and
27
- running. Search for your account across multiple breaches
28
- http://t.co/U0QyHZxP6k
29
-
30
- — Have I Been Pwned (@haveibeenpwned) December 4, 2013
31
-
32
- And then, as they say, things kinda escalated quickly. The very
33
- next day I published a blog post about how I made it so fast to
34
- search through 154M records and thus began a now 185-post epic
35
- where I began detailing the minutiae of how I built this thing,
36
- the decisions I made about how to run it and commentary on all
37
- sorts of different breaches. And now, a 10th birthday blog post
38
- about what really sticks out a decade later. And that's precisely
39
- what this 185th blog post tagging HIBP is - the noteworthy things
40
- of the years past, including a few things I've never discussed
41
- publicly before.
42
-
43
- Pwned?
44
-
45
- You know why it's called "Have I Been Pwned"? Try coming up with
46
- almost any conceivable normal sounding English name and getting a
47
- .com domain for it. Good luck! That was certainly part of it, but
48
- another part of the name choice was simply that I honestly didn't
49
- expect this thing to go anywhere. It's like I said in the intro of
50
- this post where I fully expected this to be another failed
51
- project, so why does the name matter?
52
-
53
- But it's weird how "pwned" has stuck and increasingly, become
54
- synonymous with HIBP. For many people, the first time they ever
55
- hear the word is in the context of "Have I Been..." with an
56
- ensuing discussion often explaining the origins of the term as it
57
- relates to gaming culture. And if you do go and look for a
58
- definition of the term online, you'll come across resources such
59
- as How “PWNED” went from hacker slang to the internet’s favourite
60
- taunt:
61
-
62
- Then in 2013, when various web services and sites saw an uptick
63
- in personal data breaches, security expert Troy Hunt created the
64
- website “Have I Been Pwned?” Anyone can type in an email address
65
- into the site to check if their personal data has been
66
- compromised in a security breach.
67
-
68
- And somehow, this little project is now referenced in the
69
- definition of the name it emerged from. Weird.
70
-
71
- But, because it's such an odd name that has so frequently been
72
- mispronounced or mistyped, I've ended up with a whole raft of
73
- bizarre domain names including haveibeenpaened.com,
74
- haveibeenpwnded.com, haveibeenporned.com and my personal
75
- favourite, haveibeenprawned.com (because a journo literally
76
- pronounced it that way in a major news segment 🤦‍♂️). Not to
77
- mention all the other weird variations including
78
- haveibeenburned.com, haveigotpwned.com, haveibeenrekt.com and
79
- after someone made the suggestion following the revelation that
80
- PornHub follows me, haveibeenfucked.com 🤷‍♂️
81
-
82
- Press
83
-
84
- It's difficult to even know where to start here. How does the
85
- little site with the weird name end up in the press? Inevitably,
86
- "because data breaches", and it's nuts just how much exposure this
87
- project has had because of them. These are often mainstream news
88
- events and what reporters often want to impart to people is along
89
- the lines of "Here's what you should do if you've been impacted",
90
- which often boils down to checking HIBP.
91
-
92
- Press is great for raising awareness of the project, but it has
93
- also quite literally DDoS'd the service with the Martin Lewis
94
- Money Show in the UK knocking it offline in 2016. Cool! No, for
95
- real, I learned some really valuable lessons from that experience
96
- which, of course, I shared in a blog post. And then ensured could
97
- never happen again.
98
-
99
- Back in 2018, Gizmodo reckoned HIBP was one of the top 100
100
- websites that shaped the internet as we knew it, alongside the
101
- likes of Wikipedia, Google, Amazon and Goatse (don't Google it).
102
- Only the year after it launched, TIME magazine reckon'd it was one
103
- of the 50 best websites of the year. And every time I do a Google
104
- search for a major news outlet, I find this little website. The
105
- Wall Street Journal. The Standard (nice headline!) USA Today.
106
- Toronto Star. De Telegraaf. VG. Le Monde. Corriere della Sera.
107
- It's wild - I just kept Googling for the largest newspapers in
108
- various parts of the world and kept getting hits!
109
-
110
- The point is that it's had impact, and nobody is more surprised
111
- about that than me.
112
-
113
- Congress
114
-
115
- How on earth did I end up here?!
116
-
117
- 6 years and a few days ago now, I found myself in a place I'd only
118
- ever seen before in the movies: Congress. American Congress.
119
- Saying "pwned"!
120
-
121
- For reasons I still struggle to completely grasp, the folks there
122
- thought it would be a good idea if I flew to the other side of the
123
- world and talked about the impact of data breaches on identity
124
- verification. "You know they're just trying to get you to DC so
125
- they can arrest you for all that stolen data you have, right?! 🤣",
126
- the internet quipped. But instead, I had one of the most memorable
127
- moments of my career as I read my testimony (these are public
128
- hearings so it's all recorded and available to watch), responded
129
- to questions from congressmen and congresswomen and rounded out
130
- the trip staring down at where they inaugurate presidents:
131
-
132
- Today, that photo adorns the wall outside my office and dozens of
133
- times a day I look at it and ask the same question - how did it
134
- all lead to this?!
135
-
136
- Svalbard
137
-
138
- The potential sale of HIBP was a very painful, very expensive
139
- chapter of life, announced in a blog post from June 2019. For the
140
- most part, I was as transparent and honest as I could be about the
141
- reasons behind the decision, including the stress:
142
-
143
- To be completely honest, it's been an enormously stressful year
144
- dealing with it all.
145
-
146
- More than one year later, I finally wrote about the source of so
147
- much of that stress: divorce. Relationship circumstances had put a
148
- huge amount of pressure on me and I needed a relief valve which at
149
- the time, I thought would be the sale of the project I loved so
150
- much but was becoming increasingly demanding. Ultimately, Project
151
- Svalbard (the code name for the sale of HIBP), had the opposite
152
- effect as years of bitter legal battles with my ex ensued, in part
153
- due to the perceived value that would have been realised had it
154
- been sold and some big tech company owned my arse for years to
155
- come. The project I built out of a passion to do community good
156
- was now being used as a tool to extract as much money out of me as
157
- possible. There's a wild story to be told there one day but whilst
158
- that saga is now well and truly behind me, the scars are still
159
- raw.
160
-
161
- There were many times throughout Project Svalbard where I felt
162
- like I was living out an episode of Silicon Valley, especially as
163
- I hopped between interviews at the who's-who of tech firms in San
164
- Francisco to meet potential acquirers. But there was one moment in
165
- particular that I knew at the time would form an indelible memory,
166
- so I took a photo of it:
167
-
168
- I'm sitting in a rental car in Yosemite whilst driving from the
169
- aforementioned meetings in SF and onto Vegas for the annual big
170
- cyber-events. I had a scheduled call with a big tech firm who was
171
- a potential acquirer and should that deal go through, the guy I
172
- was speaking to would be my new boss. I'd done that dozens of
173
- times by now and I don't know if it was because I was especially
174
- tired or emotional or if there was something in the way he phrased
175
- the question, but this triggered something deep inside me:
176
-
177
- So Troy, what would your perfect day in the office look like?
178
-
179
- I didn't say it this directly, but I kid you not this is exactly
180
- what popped into my mind:
181
-
182
- I get on my jet ski and I do whatever the fuck I want
183
-
184
- My potential new overlord had somehow managed to find exactly the
185
- raw nerve to touch that made me realise how valuable independence
186
- had become to me. 6 months later, Project Svalbard was dead after
187
- a deal I'd struck fell through. I still can't talk about the
188
- precise circumstances due to being NDA'd up to wazoo, but the term
189
- we chose to use was "a change of business circumstances on behalf
190
- of the purchaser". With the benefit of hindsight, I've never been
191
- so happy to have lost so much 😊
192
-
193
- The FBI
194
-
195
- 10 years ago, I certainly didn't see this on the cards:
196
-
197
- This is so cool, thanks @FBI 😊 pic.twitter.com/aqMi3as91O
198
-
199
- — Troy Hunt (@troyhunt) June 28, 2023
200
-
201
- Nor did I expect them to be actively feeding data into HIBP. Or
202
- the UK's NCA to be feeding data in. Or various other law
203
- enforcement agencies the world over. And I never envisioned a time
204
- where dozens of national governments would be happy to talk about
205
- using the service.
206
-
207
- A couple of months ago, the ABC wrote a long piece on how this
208
- whole thing is, to use their term, a strange sign of the times.
209
-
210
- He’s just “a dude on the web”, but Troy Hunt has ended up
211
- playing an oddly central role in global cybersecurity.
212
-
213
- It's strange until you look at through the lens of aligned
214
- objectives: the whole idea of HIBP was "to do good things after
215
- bad things happen" which is well aligned with the mandates of law
216
- enforcement agencies. You could call it... common ground:
217
-
218
- IFrame
219
-
220
- This is something I suspect a lot of people don't understand -
221
- that law enforcement agencies often work in conjunction with
222
- private enterprise to further their goals of protecting people
223
- just like you and me. It's something I certainly didn't understand
224
- 10 years ago, and I still remember the initial surprise when
225
- agencies started reaching out. Many years on, these have become
226
- really productive relationships with a bunch of top notch people,
227
- a number of whom I now count as friends and make an effort to
228
- spend time with on my travels.
229
-
230
- Passwords
231
-
232
- This was never on the cards originally. In fact, I'd always been
233
- adamant that there should never be passwords in HIBP although in
234
- my defence, the sentiment was that they should never appear next
235
- to the username to which they originally accompanied. But looking
236
- at passwords through the lens of how breach data can be used to do
237
- good things, a list of known compromised passwords disassociated
238
- from any form of PII made a lot of sense. So, in 2017, Pwned
239
- Passwords was born. You know what I was saying earlier about
240
- things escalating quickly? Yeah:
241
-
242
- Setting all new records for Pwned Passwords this week: biggest
243
- day ever yesterday at 282M requests and biggest rolling 30 days
244
- ever, now passing the 6 *billion* requests mark!
245
- pic.twitter.com/dQiuQim3da
246
-
247
- — Troy Hunt (@troyhunt) September 12, 2023
248
-
249
- As if to make the point, I just checked the latest stats and last
250
- week we did 301.6M requests in a single day. 100% of those
251
- requests - and that's not a rounded number either, it's
252
- 100.0000000000% - were served from Cloudflare's cache 🤯
253
-
254
- There's so much I love about this service. I love that it's free,
255
- there's no auth, it's entirely open source (both code and data),
256
- the FBI feeds data into it and perhaps most importantly, it has
257
- real impact on security. It's such a simple thing, but every time
258
- you see a headline such as "Big online website hit with credential
259
- stuffing attack", a significant portion of the accounts being
260
- taken over have passwords that could easily have been blocked.
261
-
262
- The Paradox of Handling Data Breaches
263
-
264
- On multiple occasions now, I've had conversations that can best be
265
- paraphrased as follows:
266
-
267
- Random Internet Person: I'm going to report you to the FBI for
268
- having all that stolen data
269
-
270
- Me: Maybe you should start by Googling "troy hunt fbi" first...
271
-
272
- But I understand where they're coming from and the paradox I refer
273
- to is the perceived conflict between handling what is usually the
274
- output of a crime whilst simultaneously trying to perform a
275
- community good. It's the same discussion I've often had with
276
- people citing privacy laws in their corner of the world (often the
277
- EU and GDPR) as the reason why HIBP shouldn't exist: "but you're
278
- processing data without informed consent!", they'll claim. The
279
- issue of there being other legal bases for processing aside,
280
- nobody consents to being in a data breach! The natural progression
281
- of that conversation is that being in a data breach is a parallel
282
- discussion to HIBP then indexing it and making it searchable,
283
- which is something I've devoted many words to addressing in the
284
- past.
285
-
286
- But for all the bluster the occasional random internet person can
287
- have (and honestly, I could count the number of annual instances
288
- of this on one hand), nothing has come of any complaints. And when
289
- I say "complaints", it's often nothing more than a polite
290
- conversation which may simply conclude with an acknowledgment of
291
- opposing views and that's it. There has been one exception in the
292
- entire decade of running this service where a complaint did come
293
- via a government privacy regulator, I responded to all the
294
- questions that were asked and that was the end of it.
295
-
296
- People
297
-
298
- When you have a pet project like HIBP was in the beginning, it's
299
- usually just you putting in the hours. That's fine, it's a hobby
300
- and you're scratching an itch, so what does it matter that there's
301
- nobody else involved? Like many similar passion projects, HIBP
302
- consumed a lot of hours from early on, everything from obviously
303
- building the service then sourcing data breaches, verifying and
304
- disclosing them, writing up descriptions and even editing every
305
- single one of those 700+ logos by hand to be just the right
306
- dimensions and file size. But in the beginning, if I'd just
307
- stopped one day, what would happen? Nothing. But today, a
308
- genuinely important part of the internet that a huge number of
309
- individuals, corporations and governments have built dependencies
310
- on would stop working if I lost interest.
311
-
312
- The dependency on just me was partly behind the possible sale in
313
- 2019, but clearly that didn't eventuate. There was always the
314
- option to employ people and build it out like most people would a
315
- normal company, but every time I gave that consideration it just
316
- didn't stack up for a whole bunch of reasons. It was certainly
317
- feasible from the perspective of building some sort of valuable
318
- commercial entity, but in just the same way as that question about
319
- my perfect day in the office sucked the soul from my body, so did
320
- the prospect of being responsible for other people. Employment
321
- contracts. Salary negotiations. Performance reviews. Sick leave
322
- and annual leave and all sorts of other people issues from
323
- strangers I'd need to entrust with "my baby". So, bringing in more
324
- people was a really unattractive idea, with 2 exceptions:
325
-
326
- In early 2021, my (soon to be at the time) wife Charlotte started
327
- working for HIBP.
328
-
329
- Charlotte had spent the last 8 years working with people just like
330
- me; software nerds. As a project manager for the NDC conferences
331
- based out of Norway, she'd dealt with hundreds of speakers
332
- (including me on many occasions), and thousands of attendees at
333
- the best conference I've ever been a part of. Plus, she spent a
334
- great deal of time coordinating sponsors, corporate attendees and
335
- all sorts of other folks that live in the tech world HIBP
336
- inhabited. For Charlotte, even though she's not a technical person
337
- (her qualifications are in PR and entrepreneurial studies), this
338
- was very familiar territory.
339
-
340
- So, for the last few years, Charlotte has done absolutely
341
- everything that she can to ensure that I can focus on the things
342
- that need my attention. She onboards new corporate subscribers,
343
- handles masses of tickets for API and domain subscribers and does
344
- all the accounting and tax work. And she does this tirelessly
345
- every single day at all sorts of hours whether we're at home or
346
- travelling. She is... amazing 🤩
347
-
348
- Earlier this year, Stefán Jökull Sigurðarson started working for
349
- us part time writing code, cleaning up code, migrating code and,
350
- well, doing lots of different code things.
351
-
352
- Just today I asked Stefán what I should write about him, thinking
353
- he'd give me some bullet points I'd massage and then incorporate
354
- into this blog post. Instead, I reckon what he wrote was so spot
355
- on that I'm just going to quote the entire thing here:
356
-
357
- "Just" that having had my eye on the service since it was
358
- released and then developing one of the first big integrations
359
- with the PwnedPasswords v2 API in EVE, coinciding with us
360
- meeting for the first time at NDC Oslo in 2018 shortly after,
361
- HIBP has managed to take me on this awesome journey where it has
362
- been a part of launching my public speaking career, contributing
363
- to OSS with Pwned Passwords, becoming an MVP and helped me meet
364
- a bunch of awesome people and allowed me to contribute to a
365
- better and hopefully safer internet. I'm very happy and honoured
366
- to a be a part of this project which is full of awesome
367
- challenges and interesting problems to deal with. Having meeting
368
- invites from the FBI in my inbox a few years after doing a few
369
- experimental rest calls to the Pwned Passwords API in early 2018
370
- was definitely not something I was expecting 😅
371
-
372
- What really resonated with me in Stefán's message is that for him,
373
- this isn't just a job, it's a passion. His journey is my journey
374
- in that we freely devoted our time to do something we love and it
375
- led to many wonderful things, including MVP roles and speaking at
376
- "Charlotte's" conference, NDC. Stefán is based in Iceland, but
377
- we've still had many opportunities to share beers together and
378
- establish a relationship that transcends merely writing code. I
379
- can't think of anyone better to do what he does today.
380
-
381
- Breaches
382
-
383
- 731 breaches later, here we are. So, what stands out? Just going
384
- off the top of my head here:
385
-
386
- Ashley Madison. Every knows the name so it needs no introduction,
387
- but that incident in 2015 had a major impact on HIBP in terms of
388
- use of the service, and also a major impact on me in terms of the
389
- engagements I had with impacted parties. My blog post on Here’s
390
- what Ashley Madison members have told me still feels harrowing to
391
- read.
392
-
393
- Collection #1. This is the one that really contributed to my
394
- stress levels in early 2019 and had a profound impact on my
395
- decision to look at selling the service. Read about where those
396
- 773M records came from (still the largest breach in HIBP to date).
397
-
398
- Rosebutt. Don't make a joke about it, don't make a joke about it,
399
- don't... aw man, thanks The Register! (link to an archive.org
400
- version as they seem to have thought better of their image choice
401
- later on...) The point is that even serious data breaches can have
402
- their moments of levity.
403
-
404
- Shit Express. Sometimes, you just need a bit of hilarity in your
405
- data breach. Shit Express is literally a site to send other people
406
- pieces of that - anonymously - and they got breached, thus
407
- somewhat affecting their anonymity. The more serious point is that
408
- as I later wrote, claims of anonymity are often highly misleading.
409
-
410
- Future
411
-
412
- I often joke about my life being very much about getting up each
413
- morning, reading my emails and events from overnight and then just
414
- winging it from there. Of course there are the occasional
415
- scheduled things not to mention travel commitments, but for the
416
- most part it's very much just rolling with whatever is demanding
417
- attention on the day. This is also probably a significant part of
418
- why I don't really want to see this thing grow into a larger
419
- concern with more responsibilities, I just don't want to lose that
420
- freedom. Yet...
421
-
422
- We're gradually moving in a direction where things become more
423
- formalised. 3 years ago, I did 100% of everything myself. 1 year
424
- ago, I did everything technical myself. 6 months ago, we had no
425
- ticketing system for support. But these are small, incremental
426
- steps forward and that's what I'd like to see continuing. I want
427
- HIBP to outlive me, I just don't want it to become a burden I'm
428
- beholden to in the process. I'd like to have more people involved
429
- but as you can see from above, that's been a very slow process
430
- with only those very close to me playing a role.
431
-
432
- The only thing I have real certainty on at the moment is that
433
- there will be more breaches. I've commented many times recently
434
- that the scourge that is ransomware feels like it's really
435
- accelerated lately, I wonder how many of the people in the emails
436
- and documents and all sorts of other data that get dumped there
437
- ever learn of their exposure? It's a non-trivial exercise to index
438
- that (for all sorts of reasons), but it also seems like an
439
- increasingly worthy exercise. Who knows, let's see how I feel when
440
- I get up tomorrow morning 🙂
441
-
442
- Finally, for this week's regular video, I'm going to make a
443
- birthday special and do it live with Charlotte. Please come and
444
- join us, I'm not entirely sure what we'll cover (I'll work it out
445
- on the morning!) but let's make a virtual 10th birthday party out
446
- of it 🎂
447
-
448
- IFrame
449
- Have I Been Pwned Tweet Post Update Email RSS
450
- Troy Hunt's Picture
451
-
452
- Troy Hunt
453
-
454
- Hi, I'm Troy Hunt, I write this blog, create courses for
455
- Pluralsight and am a Microsoft Regional Director and MVP who
456
- travels the world speaking at events and training technology
457
- professionals
458
-
459
- Please enable JavaScript to view the comments powered by Disqus.
460
-
461
- Troy Hunt
462
-
463
- Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and
464
- am a Microsoft Regional Director and MVP who travels the world
465
- speaking at events and training technology professionals
466
-
467
- Upcoming Events
468
-
469
- I often run private workshops around these, here's upcoming events
470
- I'll be at:
471
-
472
- Must Read
473
-
474
- * Data breach disclosure 101: How to succeed after you've failed
475
- * Data from connected CloudPets teddy bears leaked and ransomed,
476
- exposing kids' voice messages
477
- * Here's how I verify data breaches
478
- * When a nation is hacked: Understanding the ginormous
479
- Philippines data breach
480
- * How I optimised my life to make my job redundant
481
-
482
- Don't have Pluralsight already? How about a 10 day free trial?
483
- That'll get you access to thousands of courses amongst which are
484
- dozens of my own including:
485
-
486
- 1. OWASP Top 10 Web Application Security Risks for ASP.NET
487
- 2. What Every Developer Must Know About HTTPS
488
- 3. Hack Yourself First: How to go on the Cyber-Offense
489
- 4. The Information Security Big Picture
490
- 5. Ethical Hacking: Social Engineering
491
- 6. Modernizing Your Websites with Azure Platform as a Service
492
- 7. Introduction to Browser Security Headers
493
- 8. Ethical Hacking: SQL Injection
494
- 9. Web Security and the OWASP Top 10: The Big Picture
495
- 10. Ethical Hacking: Hacking Web Applications
496
-
497
- This is already the newest post!
498
-
499
- Weekly Update 376
500
-
501
- Subscribe
502
-
503
- Subscribe Now!
504
-
505
- Send new blog posts:
506
- [ ] daily
507
- [ ] weekly
508
-
509
- _____________________ [ go! ]
510
-
511
- Hey, just quickly confirm you're not a robot:
512
-
513
- Submitting...
514
-
515
- Got it! Check your email, click the confirmation link I just sent
516
- you and we're done.
517
-
518
- Copyright 2023, Troy Hunt
519
-
520
- This work is licensed under a Creative Commons Attribution 4.0
521
- International License. In other words, share generously but
522
- provide attribution.
523
-
524
- Disclaimer
525
-
526
- Opinions expressed here are my own and may not reflect those of
527
- others. Unless I'm quoting someone, they're just my own views.
528
-
529
- Published with Ghost
530
-
531
- This site runs entirely on Ghost and is made possible thanks to
532
- their kind support. Read more about why I chose to use Ghost.
533
-
534
- * * * * *
535
-
536
- [/INST]