Troy Hunt
troyhunt.com · Personal blog · on HN since 2010
Troy Hunt is a security researcher and Microsoft MVP who writes about data breaches, HTTPS, passwords, and the Have I Been Pwned service.
What HN saysCommenters call him well-respected, say his blog is full of interesting security information, and credit him as the creator of Have I Been Pwned.
681HN people shared it
375linked it in comments
608stories submitted
43Kstory points
2 months agolast shared
2010people per year2026
Most-shared posts
- 1"Pwned Passwords" V2 With Half a Billion Passwords32 people · 861 points · first shared 2018 · 355 comments on HN
- 2Why Static Websites Need HTTPS28 people · 497 points · first shared 2018 · 253 comments on HN
- 3Homepage19 people · first shared 2013
- 4We're Baking ‘Have I Been Pwned’ into Firefox and 1Password14 people · 688 points · first shared 2018 · 191 comments on HN
- 5Doing Big Things for Small Dollars with Cloudflare Workers and Azure Functions13 people · 14 points · first shared 2018 · discussion on HN
- 6On the Perceived Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt12 people · 167 points · first shared 2017 · 83 comments on HN
- 7Beg Bounties11 people · 285 points · first shared 2021 · 103 comments on HN
- 8Extended Validation Certificates Are Really Dead10 people · 164 points · first shared 2019 · 149 comments on HN
- 9Ad blockers are part of the problem10 people · 73 points · first shared 2016 · 116 comments on HN
- 10The “Cobra Effect” that is disabling paste on password fields9 people · 913 points · first shared 2016 · 442 comments on HN
- 11Project Svalbard: The Future of Have I Been Pwned8 people · 703 points · first shared 2019 · 145 comments on HN
- 12Have I Been Pwned Is Now Partnering with 1Password8 people · 349 points · first shared 2018 · 128 comments on HN
- 13Personal Finance Lessons for Technology Professionals8 people · 195 points · first shared 2018 · 76 comments on HN
- 14Mmm, Pi-hole7 people · 850 points · first shared 2018 · 408 comments on HN
- 15Assessing a Publicly Observable Security Posture (India's Aadhaar System)7 people · 15 points · first shared 2018 · discussion on HN
What HN people wrote when they linked it
Lev1a · 2018-03-22
There ARE some types of non-intrusive ads (read: unnoticed unless specifically searched for) like little ribbons with text and maybe a link, like on [Troy Hunts blog](https://www.troyhunt.com/) or small non-animated banners like the ones on StackOverflow.
The ones everyone (except the ad networks) wants blocked by default are the intrusive ones, like video ads auto-playing loud BS or the ones where you scroll or move the cursor and some <div> or something pops up, darkens the rest of the site and annoys the reader with some pathetic bid to "subscribe to our page" etc.
jacquesm · 2018-02-26
Just let that number sink in a bit. 80M/2844 = ~30K accounts / breach.
And still, just about every service that you have to make use of (your HOA, your insurance company, your government and so on) wants you to trust them with your data secured by a userid and a password that they will administer on infrastructure that they are most likely not competent to secure.
One of the best things to come out of the GDPR is the reporting requirements for breaches. You can expect a lot more of these updates in the future.
Edit: interesting, the link now goes to 'https://ghost.org/fail/', a 404, so go to https://www.troyhunt.com/
toomanybeersies · 2017-03-12
Troy Hunt: https://www.troyhunt.com/
He writes great articles on security and is the man behind https://haveibeenpwned.com/
manigandham · 2016-03-14
This is a great (free) resource run by Troy Hunt, a well-respected Microsoft MVP and security researcher. His blog is full of interesting info: http://www.troyhunt.com/
SideburnsOfDoom · 2013-12-05
> Great job, op (if you're the one who wrote this service)
Looks like no.
"Have I been pwned?" is by Troy Hunt http://www.troyhunt.com/
The OP's bio indicates that they are someone else. https://news.ycombinator.com/user?id=mountaineer
btown · 2025-12-09
To be fair, for a CEO in 2022, EV certificates had only lost their special visualizations since September/October 2019 with Chrome 77 and Firefox 70 - and with all that would happen in the following months, one could be forgiven for not adapting to new browser best practices!
https://www.troyhunt.com/extended-validation-certificates-are-really-r…
richbell · 2024-10-12
> you waste time with the constant spam of people begging for bounties
A great blog post on the matter https://www.troyhunt.com/beg-bounties/
gnyman · 2023-12-04
The k-anonymity is such a clever trick, I remember being impressed by the simplicity and efficacy of it back when I read about it also.
I'd also like to call out the one who Troy says suggested him [1], Junade Ali who goes into more details about this in his post about it [2]
Not because Junade would have invented it (apparently that was Pierangela Samarati, Latanya Sweeney and Tore Dalenius. [3]) but because his blog post on it is a really great explainer of it using concepts software developers are familiar with.
[1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
[2] https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymi…
[3] https://en.wikipedia.org/wiki/K-anonymity
VerifiedJoseph · 2023-09-28
Depending on your interests there are a lot of blogs out there.
Beautiful Public Data (https://www.beautifulpublicdata.com/) is one of my best finds.
Others I read via RSS include:
Wladimir Palant's blog 'Almost Secure' https://palant.info/articles/
Ctrl.blog https://www.ctrl.blog/
Troy Hunt's blog https://www.troyhunt.com/
Molly White's newsletter https://newsletter.mollywhite.net
mastazi · 2023-01-29
I love Autohotkey because, in addition to its productivity benefits, it's a defensive tool against dark patterns imposed by user-hostile companies.
For example, I've been using it for years to enter my Runescape password [1] due to Jagex being clueless about security [2]
[1] https://reddit.com/r/runescape/comments/gxapao/how_to_paste_to_the_pas…
[2] https://www.troyhunt.com/the-cobra-effect-that-is-disabling/
okhudeira · 2022-11-29
All the discussions around header vs. path versioning reminds me of this post by Troy Hunt of Have I been Pwned.
> In the end, I decided the fairest, most balanced way was to piss everyone off equally. Of course I’m talking about API versioning and not since the great “tabs versus spaces” debate have I seen so many strong beliefs in entirely different camps.
https://www.troyhunt.com/your-api-versioning-is-wrong-which-is/
mpalfrey · 2022-09-08
oittaa · 2022-08-06
That's just wrong on so many levels. Troy Hunt has an excellent explanation: https://www.troyhunt.com/heres-why-your-static-website-needs-https/
password4321 · 2022-05-19
This is probably the best option for anyone actually trying to fix the problem.
https://haveibeenpwned.com/FAQs#SubmitBreach
> If you've come across a data breach which you'd like to submit, get in touch with me. https://www.troyhunt.com/contact
Good luck on your OPSEC, should not have used your 7 year old account... might hit up dang to change the account so you don't get kidnapped.
troyhunt · 2022-04-03
Not at all, I continued writing a lot on Twitter and still love the product. I don’t like the way they’re handling this situation though, more in this vid from a few days ago: https://www.troyhunt.com/weekly-update-289/
emmelaich · 2022-03-31
For example, Troy Hunt was a major fan, but then just stopped writing about them.
I took that as an un-recommend.
https://www.troyhunt.com/tag/ubiquiti/
oyagci · 2021-10-06
Troy Hunt gives great argument about why every website needs to be HTTPS: https://www.troyhunt.com/heres-why-your-static-website-needs-https/
rkagerer · 2021-08-12
More recently, he also joined their board of advisors last year[1].
Have a TON of respect for the man, just a little surprised/disappointed these recent moves happened under his watch and would love to hear his unedited take on it all.
[1] https://www.troyhunt.com/ive-joined-the-1password-board-of-advisers/
enzanki_ars · 2021-05-14
For a good discussion into why _all_ websites should use HTTPS, I'd highly recommend this article.
https://www.troyhunt.com/heres-why-your-static-website-needs-https/
Not having your site as HTTPS puts all of your readers at risk. Even US ISPs like that of Comcast use this very same practice to inject warnings into insecure web traffic[0]. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant.
[0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secretly-inject…
lifeisstillgood · 2021-04-06
Well worth looking at Troy Hunt's views on this (from 2017)
https://www.troyhunt.com/data-breach-disclosure-101-how-to-succeed-aft…
anon9001 · 2020-09-21
Obligatory security blogs:
* https://www.schneier.com/
* https://www.troyhunt.com/
* https://krebsonsecurity.com/
* https://threatpost.com/
Rebelgecko · 2020-03-03
I had the opposite problem. Knowing the importance of offsite backups I had the brilliant idea of backing up my wallet.dat on Dropbox without any additional encryption. My bitcoin were only worth a few bucks, who'd bother stealing them, right? Years later, I saw that BTC had gone up in price a few orders of magnitude so I tried to load my wallet.dat and cash out. Except when I opened my wallet file, the balance was zeroed out. Oops: https://www.troyhunt.com/the-dropbox-hack-is-real/
simonw · 2020-03-01
This is a really informative write-up and an excellent learning exercise.
It's worth noting that haveibeenpwned's API has a really clever design for allowing people to look up their passwords without transmitting them to the site.
It's explained here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
The short version is that you can take the first 5 characters of a SHA-1 hash and hit this endpoint:
https://api.pwnedpasswords.com/range/21BD1
The endpoint returns (right now) a list of 528 full hashes along with counts. You can compare your full calculated SHA-1 hash to that list to see if the password is present in the dump.
The trick here is called k-Anonymity - I think it's a really elegant solution. This technique is written up in more detail here: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymi…
jakub_g · 2020-02-18
Came here to write that. Either Krebs or https://www.troyhunt.com
nkrisc · 2019-12-13
Troy Hunt has a great write-up about one such product from easily this year: https://www.troyhunt.com/how-to-track-your-kids-and-other-peoples-kids…
vorpalhex · 2019-08-12
Congrats!
Diversify the income stream. If you make most of your money freelancing, consider doing some pluralsight courses or writing a book. I highly recommend reading this article [1] from Troy Hunt (creator of HaveIBeenPwned) on some of the finance lessons he's learned.
You might also look at working part time with a regular client at a cheaper rate, or modifying your contract to ensure more regularity, especially if you can manage to get benefits.
[1] - https://www.troyhunt.com/10-personal-finance-lessons-for-technology-pr…
MattConfluence · 2019-07-18
Frankly, USD3.50/month for API access is still an incredible bargain for a service of this quality. Normal users can still use the webpage form to look themselves up for free, API users pay a nominal fee that should cover the cost of the resources they consume.
The only concern I can think of is that this opens the gate to raising the fee in the future to profit from it, considering that Troy is "selling out" soon [1] and will not be in control of the service for ever. HIBP is the kind of service I think ought to be provided by a non-profit entity. But Troy's record is good, so I have faith that he will do his best to pick a good new home for HIBP.
[1] https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pw…
Deimorz · 2019-07-17
Probably worth noting that Have I Been Pwned is now up for sale: https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pw…
I've always been a huge fan of the project (and Troy) and understand that it's gotten to a point where he can't keep running it as a spare-time project, but I'm still not very happy about seeing it being shopped around. I can't see how this type of service needing to find a way to become a business will be a good thing overall, especially when it keeps getting integrated into other programs and services like this. Troy pledges that nothing will change, but every company getting acquired does that, and then things change anyway.
The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing.
vikingcaffiene · 2019-06-09
You’d be hard pressed to find a better recommendation than Troy Hunt. [0]
TLDR; Freedome VPN is really good and located in a country with strong privacy laws.
[0]https://www.troyhunt.com/the-importance-of-trust-and-integrity-in-a-vp…
skelin · 2019-04-05
1password it seems:
https://news.ycombinator.com/item?id=14777726
I’ve also seen it recommended by Troy Hunt (haveibeenpwned creator):
https://www.troyhunt.com/password-managers-dont-have-to-be-perfect-the…
(I’m using bitwarden myself, couldn’t justify the subscription cost for my usage)