Troy Hunt Profile Banner
Troy Hunt Profile
Troy Hunt

@troyhunt

228,310
Followers
1,301
Following
10,101
Media
118,180
Statuses

Creator of @haveibeenpwned . Microsoft Regional Director. Pluralsight author. Online security, technology and “The Cloud”. Australian.

Australia
Joined April 2008
Don't wanna be here? Send us removal request.
Pinned Tweet
@troyhunt
Troy Hunt
1 year
Sometimes, life feels like a fairytale. This is now my favourite photo ever ❤️
Tweet media one
43
14
1K
@troyhunt
Troy Hunt
4 years
Someone just delivered me a massive data breach. It’s all there - names, addresses, phone numbers - huge!!!
Tweet media one
Tweet media two
202
1K
9K
@troyhunt
Troy Hunt
5 years
I’m a responsible parent so I use the controls on iOS to limit screen time on the old iPhone my 9-year old uses. A white-listed exception is iMessage; he’s worked out he can send someone a YouTube vid then watch it in iMessage to circumvent the control. So proud 😅
Tweet media one
Tweet media two
Tweet media three
174
1K
8K
@troyhunt
Troy Hunt
8 years
This car is white
Tweet media one
56
7K
7K
@troyhunt
Troy Hunt
4 years
I’d like to say a big “thank you” to @realDonaldTrump for providing me with material that’s going to feature in many, many presentations for years to come 🤣
116
972
6K
@troyhunt
Troy Hunt
2 years
I love that part of the Microsoft Security Score for Identity in Azure improves your score if you *don't* enforce password rotation, what a sign of the times! Who out there still works somewhere that forces rotation (because "reasons")?
Tweet media one
222
929
6K
@troyhunt
Troy Hunt
1 year
5 months to the day since @elonmusk took over Twitter. It still works just fine. There are new features. This isn’t the outcome many people were predicting.
422
239
5K
@troyhunt
Troy Hunt
26 days
Hmmm… now to find a 4-digit PIN that hasn’t been pwned 🧐
Tweet media one
47
63
4K
@troyhunt
Troy Hunt
11 months
This is so cool, thanks @FBI 😊
Tweet media one
Tweet media two
Tweet media three
152
96
4K
@troyhunt
Troy Hunt
1 year
Do not start your password with “0”. Because security.
@UK_Daniel_Card
mRr3b00t
1 year
These are ridiculous....
Tweet media one
91
40
582
182
221
4K
@troyhunt
Troy Hunt
8 years
How to identify a vehicle at risk of collisions:
Tweet media one
42
3K
3K
@troyhunt
Troy Hunt
5 years
It's time for @haveibeenpwned to grow up and go beyond what I can do as one person. This has taken a lot of thought over the course of this year; here's the factors driving it, the path forward and what it means for the future. Here's Project Svalbard:
123
1K
3K
@troyhunt
Troy Hunt
3 years
I do my best with @haveibeenpwned . It takes huge amounts of time and effort and sometimes, is a thankless pursuit. I don’t reply to messages like this, but I’m sharing it to give just a little bit of a sense of the stuff I have to deal with to make it happen.
Tweet media one
346
212
3K
@troyhunt
Troy Hunt
3 years
I don’t normally reply to these, but when someone is a big enough dickhead, I make an exception:
Tweet media one
Tweet media two
139
175
3K
@troyhunt
Troy Hunt
5 years
Should I update this elevator’s Java? I’m sure it’ll work out just fine...
Tweet media one
176
496
3K
@troyhunt
Troy Hunt
7 months
Yep, you read that correctly 🤦‍♂️
Tweet media one
Tweet media two
@haveibeenpwned
Have I Been Pwned
7 months
New breach: Horse Isle had 28k unique email addresses breached in 2020 - twice. Data included IP address, name, gender, purchases and plain text password, including failed password attempts, also in plain text. 77% were already in @haveibeenpwned . More:
10
126
710
103
441
3K
@troyhunt
Troy Hunt
1 year
Please change your DNA
@fawfulfan
Matthew Chapman
1 year
Millions of DNA tests leaked after hackers breach company's 'forgotten' database
11
122
227
83
680
3K
@troyhunt
Troy Hunt
5 years
I’m gonna need all these one day, right?
Tweet media one
301
198
3K
@troyhunt
Troy Hunt
7 years
Epic @united app review 😎
Tweet media one
28
2K
3K
@troyhunt
Troy Hunt
7 months
This will be a hugely unpopular thing, however... The premise of attaching a nominal cost to a previously free service in order to combat abuse is exactly what I did with the @haveibeenpwned API keys 4 years ago: This stopped abuse dead. Not a little…
@Support
Support
7 months
Starting today, we're testing a new program (Not A Bot) in New Zealand and the Philippines. New, unverified accounts will be required to sign up for a $1 annual subscription to be able to post & interact with other posts. Within this test, existing users are not affected. This…
11K
5K
21K
226
264
3K
@troyhunt
Troy Hunt
1 year
One day, I'm going to do a NSFW only conference talk on the weirdest data breaches I've ever processed. The one I just got sent is going to be right up there at the top of the list. HOLY. SHIT.
80
105
2K
@troyhunt
Troy Hunt
5 years
Call comes in: “Hi this is Telstra, we need to verify your identity” “Sure, can you verify your identity first?” “Uh, we’re Telstra” “Ah, but that’s not how this is going to work, can you verify my account information” “But we need to verify you first!” Yeah, nah, bye!
104
407
2K
@troyhunt
Troy Hunt
1 year
Screw this, I’ve got time 😎
Tweet media one
Tweet media two
Tweet media three
Tweet media four
51
245
2K
@troyhunt
Troy Hunt
6 years
I've wanted to do this post for ages & it's finally done - "Here's Why Your Static Website Needs HTTPS". It's a 24 min video showing a bunch of nasty stuff that can happen to *any* site served insecurely from crypto miners to credential phishing to Clippy:
25
1K
2K
@troyhunt
Troy Hunt
3 years
I’ve had a heap of queries about this. I’m looking into it and yes, if it’s legit and suitable for @haveibeenpwned it’ll be searchable there shortly.
66
762
2K
@troyhunt
Troy Hunt
4 years
So apparently a @haveibeenpwned email wiped an entire ticketing system due to the SQL injection pattern I put in the contents of it 🤣
63
504
2K
@troyhunt
Troy Hunt
4 years
New data breach now loading into @haveibeenpwned that'll push it *well* over 10,000,000,000 records. Wow. Insane, never thought I'd be here doing this with those numbers. It's been a fun little project 🙂
53
392
2K
@troyhunt
Troy Hunt
3 years
Just one more holiday photo... 💍 ❤️
Tweet media one
163
9
2K
@troyhunt
Troy Hunt
6 years
It's been a huge piece of work, but it's done: here's more than half a billion passwords for you to download for free and use to help protect your systems. Or use the online k-Anonymity API developed in conjunction with @Cloudflare . It rocks!
49
1K
2K
@troyhunt
Troy Hunt
1 year
Seen at my local post office yesterday:
Tweet media one
Tweet media two
152
164
2K
@troyhunt
Troy Hunt
3 years
Running a free service is bloody thankless at times, I've just got no patience of this sort of shit
Tweet media one
87
68
2K
@troyhunt
Troy Hunt
5 months
10 years ago today, I started a pet project with a stupid name. Like all my previous projects, I expected it to scratch an itch and then fail miserably. But @haveibeenpwned didn't do that, not by a long shot. A decade later here we are! 🎂
58
180
2K
@troyhunt
Troy Hunt
10 months
Felt really sad waking up and seeing “RIP Kevin” in my timeline. I doubt there is a more well known name in our industry but if he’s unfamiliar to you (or you haven’t read this book), go and grab “Ghost in the Wires” which is an exceptional read. Kevin started regularly coming…
Tweet media one
36
151
2K
@troyhunt
Troy Hunt
1 year
I’ve had a lot of people tweeting this at me so let me give you 2 thoughts on it: 1) Making 2FA a premium service sends a bad message 2) Putting a price on the weakest form of 2FA and keeping 2 much better alternatives free is good
Tweet media one
112
324
2K
@troyhunt
Troy Hunt
3 years
Complete step-by-step guide to hacking @GovParsonMO 's website: 1) Press F12
Tweet media one
@GovParsonMO
Governor Mike Parson
3 years
Through a multi-step process, an individual took the records of at least three educators, decoded the HTML source code, and viewed the SSN of those specific educators. We notified the Cole County prosecutor and the Highway Patrol’s Digital Forensic Unit will investigate.
Tweet media one
5K
335
1K
74
337
2K
@troyhunt
Troy Hunt
6 years
Your hacker name is your first pet’s name followed your mother’s maiden name and the town you were born in. What’s yours?
271
539
2K
@troyhunt
Troy Hunt
5 years
WE DIDN’T EVEN MAKE IT THROUGH ONE DAY IN 2019!!!
@abcnews
ABC News
5 years
Victorian Government employees' details stolen in data breach
5
50
83
41
583
2K
@troyhunt
Troy Hunt
5 years
You know a data breach is big when...
Tweet media one
54
408
2K
@troyhunt
Troy Hunt
5 years
Me to my wife: “Uh, what brand is our new washing machine?” “Samsung” “Why the fuck is it broadcasting an SSID?!”
Tweet media one
80
414
2K
@troyhunt
Troy Hunt
5 years
Oh for fucks sake. I seriously did not know I had an account in this breach until this email from @haveibeenpwned just landed. Thanks @troyhunt 🤬
Tweet media one
61
166
2K
@troyhunt
Troy Hunt
6 years
Don't think I've seen someone store both a password hash *and* the plain text of it in a data breach! That's, uh... "special" 🤦‍♂️
Tweet media one
121
520
2K
@troyhunt
Troy Hunt
1 year
Every time I come back to Europe, I’m reminded of the absolute batshit insanity that cookie warnings are. Idiotic, poorly thought out, user experience-killing compliance garbage that can’t possibly do anything to improve privacy in any meaningful way whatsoever.
Tweet media one
109
273
2K
@troyhunt
Troy Hunt
2 years
I hate getting emails from this guy 😭
Tweet media one
64
67
2K
@troyhunt
Troy Hunt
6 years
This IoT shit is getting out of control
Tweet media one
48
378
2K
@troyhunt
Troy Hunt
4 years
I took the brief tweet thread I did earlier today on the alleged @MinneapolisPD hack and ran the emails and passwords through @haveibeenpwned . It's not a new breach, it's existing data that's falsely attributed and is causing disinformation to spread
31
743
2K
@troyhunt
Troy Hunt
4 years
Remember when the biggest worry we had about candles was the house burning down because *you* left one on? Get ready for other people to start sparking them up for you remotely with “smart” candles... with real fire!
123
599
1K
@troyhunt
Troy Hunt
4 years
When the pizza boy knows who you are 🍕
Tweet media one
26
33
1K
@troyhunt
Troy Hunt
4 years
New day, new beginning ❤️
Tweet media one
63
8
1K
@troyhunt
Troy Hunt
1 year
Alleged breach of 400M+ Twitter accounts. Legitimacy isn’t yet clear, but the aggressive, threatening wording is unmistakable. Of course Twitter will never pay, so let’s see what happens next.
Tweet media one
60
385
1K
@troyhunt
Troy Hunt
3 years
Yeah, nah...
Tweet media one
60
81
1K
@troyhunt
Troy Hunt
4 years
WTF?!
Tweet media one
78
131
1K
@troyhunt
Troy Hunt
3 years
I fucking hate beg bounties 😡
Tweet media one
86
137
1K
@troyhunt
Troy Hunt
2 years
Absolutely over the moon to formally make @Charlotte_Hunt_ a part of our family ❤️ 💍
Tweet media one
178
9
1K
@troyhunt
Troy Hunt
4 years
😍
147
71
1K
@troyhunt
Troy Hunt
6 years
Essential arachnid training for friends considering visiting Australia
Tweet media one
104
518
1K
@troyhunt
Troy Hunt
5 years
So I just managed to lock out the @haveibeenpwned Twitter account by putting the service's birthday in and falling afoul of minimum age requirements. I'll get it sorted in a jiffy, just a heads up in case anyone notices something is up and wonders what happened.
Tweet media one
98
157
1K
@troyhunt
Troy Hunt
4 years
I'm so sick of those bullshit "your article is really nice, I think your readers would find my article useful, please link to it" spam emails that I've decided to start featuring them all. Well, kinda, here's what I'm going to do:
85
158
1K
@troyhunt
Troy Hunt
6 years
I will never stop loving this vendor response to a security flaw: "the lock is invincible to people who do not have a screwdriver" 🤣
@LockPickingLwyr
LockPickingLawyer
6 years
The company that sent me the pictured fingerprint lock has provided the security quote of the year: “...the lock is invincible to the people who do not have a screwdriver.”
Tweet media one
Tweet media two
Tweet media three
395
11K
27K
40
396
1K
@troyhunt
Troy Hunt
3 years
ROAD TRIP!!! 🐬 🕷🦈 🐊 🦘🐍 🐨
Tweet media one
Tweet media two
94
25
1K
@troyhunt
Troy Hunt
4 years
Good one @Visa , absolutely no warning about truncating generated passwords from @1Password . The account gets created but then I can't login until I view the DOM and chop the end off my >32 char password. This doesn't need to be this hard...
Tweet media one
63
184
1K
@troyhunt
Troy Hunt
3 years
I’m marrying my dream girl 🍺 😍 🍺 (Oktoberfest, Munich, 2019)
Tweet media one
73
12
1K
@troyhunt
Troy Hunt
3 years
I’m very happy to announce that @haveibeenpwned ’s Pwned Passwords is now open source under the @dotnetfdn . Now we’ve got some work to do: building an ingestion pipeline for new passwords provided by the @FBI on an ongoing basis. This is super cool 😎
20
340
1K
@troyhunt
Troy Hunt
6 years
This is without doubt the most hilarious discussion I’ve had in a long time 😂
Tweet media one
Tweet media two
Tweet media three
Tweet media four
51
268
1K
@troyhunt
Troy Hunt
6 years
I’m astounded to see people still arguing “my site doesn’t need HTTPS” so I’ll put it simply: either spend a few mins putting it on your site now or continually explaining to your visitors why your site is not “not secure” until you end up doing it anyway. It’s not a negotiation.
60
438
1K
@troyhunt
Troy Hunt
5 years
New family car! I’m kinda a bit excited about this one!
Tweet media one
Tweet media two
Tweet media three
Tweet media four
170
28
1K
@troyhunt
Troy Hunt
2 years
It had to happen eventually - I made a mistake in "the cloud" that just cost me over $11k. Ouch! Here's what happened, and what I've done to make sure it never happens again:
53
269
1K
@troyhunt
Troy Hunt
6 years
And in the latest edition of “why you should HTTPS all the things”, I present to you Starbucks mining BTC in your customers’ browsers
@imnoah
Noah Dinkin
6 years
Hi @Starbucks @StarbucksAr did you know that your in-store wifi provider in Buenos Aires forces a 10 second delay when you first connect to the wifi so it can mine bitcoin using a customer's laptop? Feels a little off-brand.. cc @GMFlickinger
Tweet media one
123
3K
4K
24
947
1K
@troyhunt
Troy Hunt
2 years
You idiots 🤦‍♂️
Tweet media one
139
99
1K
@troyhunt
Troy Hunt
4 years
Love this sticker from @_sarahyo 😜
Tweet media one
19
276
1K
@troyhunt
Troy Hunt
6 months
I’m dying here 🤣
Tweet media one
Tweet media two
Tweet media three
20
66
1K
@troyhunt
Troy Hunt
5 years
I've had a blog post in draft for years that's been a bit of a pet project: "Fundamental Financial Lessons for Technology Professionals". Is this something you'd like to read? What would you like to see in it? I want to finally knock it out over the next few days.
110
31
1K
@troyhunt
Troy Hunt
6 years
Wow, surprised at how much positive feedback this is garnering so quickly, I'm pretty stoked :) "Firefox Will Warn Users When Visiting Sites That Suffered a Data Breach"
21
498
1K
@troyhunt
Troy Hunt
4 years
Super proud of Ari for building up a new website by hand-writing every line of HTML and FTP’ing it up to the cloud. Small steps, but every great website began here. The first version of is now live!
Tweet media one
60
38
1K
@troyhunt
Troy Hunt
2 years
Well this is going to be interesting - has @tiktok_us been breached?
15
425
1K
@troyhunt
Troy Hunt
1 year
Pwned Passwords just passed 4 ***BILLION*** requests a month for the first time 🎉 But here's the really cool bit: following the rollout of @Cloudflare Cache Reserve earlier this month, our cache hit ratio is now up to 99.999% 😲 So, if you made one of the 189M requests we saw…
Tweet media one
Tweet media two
Tweet media three
13
66
1K
@troyhunt
Troy Hunt
5 years
HSBC: “Customers can enter additional characters on their password and it be accepted as a successful logon. We don’t classify this as a security risk”
@BradleyAllen512
Allen
5 years
Urm this is rather shocking... Don't need to actually get your HSBC online banking password correct... Shocking @troyhunt
Tweet media one
121
588
1K
110
679
1K
@troyhunt
Troy Hunt
7 years
How I know I have job security in this industry:
@rwmorris
Richard Morris
7 years
Great password, NBC.
Tweet media one
167
5K
17K
19
385
1K
@troyhunt
Troy Hunt
4 years
I know people often berate physical password books, but they’re a big improvement in how 99% of people are currently managing their passwords:
@funkysi1701
Simon Foster
4 years
A friend of mine has found the ultimate gift for @troyhunt
Tweet media one
10
10
85
55
219
1K
@troyhunt
Troy Hunt
6 years
Friendly reminder as a fellow parent: never ever ever ever install spyware on your kid's phone. Seriously, do some "offline parenting" and talk to your kids about online risks, *never* resort to deliberately weakening their personal security
@troyhunt
Troy Hunt
6 years
I’m a parent with young kids now coming online. I’m also a guy who sees a lot of data breaches and no-way no-how will I ever resort to installing this sort of product on either of my kids’ devices.
17
78
287
41
473
1K
@troyhunt
Troy Hunt
7 years
My 5 year old daughter came up to my office earlier today: “Daddy, can we do some coding?”. Yes! Absolutely yes! A few mins later and she’s on which is just awesome 😎
Tweet media one
26
113
1K
@troyhunt
Troy Hunt
6 months
TIL - when security gets in the way, just turn it off!
14
100
1K
@troyhunt
Troy Hunt
6 years
Hey, you know what would be cool? If @1Password was to integrate with my newly released Pwned Passwords k-Anonymity model so you could securely check your exposure against the service (it'd have to be opt in, of course). Oh wow - look at this!
33
393
1K
@troyhunt
Troy Hunt
10 months
👋 @Cloudflare just taking care of everything while I slept 😊
Tweet media one
Tweet media two
Tweet media three
Tweet media four
17
48
1K
@troyhunt
Troy Hunt
8 months
Seriously WTF @jpmorgan ?!
@peterejhamilton
Pete Hamilton
8 months
This is a real life honest to god password prompt for our company internet banking account with @jpmorgan . I really wasn't ready for an IQ test today. JFC.
Tweet media one
84
70
554
142
93
1K
@troyhunt
Troy Hunt
6 years
So here's the hard facts - I'm dipping into my pocket every week to the tune of... $7.40 for you guys to do 54M searches against a repository of half a billion passwords 🙂
Tweet media one
53
265
1K
@troyhunt
Troy Hunt
6 months
There goes my day 🤦‍♂️
@DarkWebInformer
Dark Web Informer
6 months
The same threat actor has leaked larger amounts of data from LinkedIn dated 2023. They claim this new data contains 35M lines and is 12 GB uncompressed. They also issue an apology to @troyhunt . #Breach #Clearnet #DarkWeb #DarkWebInformer #Database #Leaks #Leaked #LinkedIn
Tweet media one
10
50
223
30
77
1K
@troyhunt
Troy Hunt
6 years
Dear Americans, I know you like to do that MM/DD thing, but it confuses the hell out of the rest of the world so how about we all just use letters for the month instead? I have no idea if 2/3/18 is Feb or Mar and the fix is so easy... (and yes, I always use DD/MMM/YY)
169
236
1K
@troyhunt
Troy Hunt
5 years
I started writing this post years ago, adding to it as my own personal journey progressed. Today, on New Year's Eve when people are thinking more about goals, I'm very happy to finally share it: "10 Personal Finance Lessons for Technology Professionals":
42
295
1K
@troyhunt
Troy Hunt
4 years
Whoa - wait - what - why?!
@immunda
P H
4 years
Hey @BarclaysUK ; maybe don't use @internetarchive as a CDN for your JS assets? ¯\_(ツ)_/¯
Tweet media one
164
2K
6K
41
181
1K
@troyhunt
Troy Hunt
6 years
There has never been a truer Dilbert than this one
14
472
1K
@troyhunt
Troy Hunt
7 years
Looked at a house for sale today, is it weird to be super excited by this? 🤓
Tweet media one
79
64
1K
@troyhunt
Troy Hunt
3 years
Artificial inflation of page popularity through the posing of inane questions that in turn artificially inflate the respondents’ sense of intelligence thus gaining massive levels of engagement as otherwise smart people fall for that one simple trick give me the shits 💩
Tweet media one
75
139
1K
@troyhunt
Troy Hunt
5 years
As of an hour ago, there are now more records in @haveibeenpwned than there are people on earth. Whoa.
@krohlas
Sven Krohlas📯 @skrohlas.bsky.social
5 years
World population: 7.674.575.000 Pwned accounts on : 6.931.949.148 Let's start the party planning, we will be there soon! /cc @troyhunt
2
20
95
21
421
1K