Troy Hunt
Security researcher; founded Have I Been Pwned, and writes and speaks about data breaches.
Troy Hunt did not write this page. ppll compiled it from their own words, each linked to the source. Is this you? · Report a mistake
Latest x.com
What they believe
-
A developer cannot be productive and competitive today without using AI
let's face it: you can't be a productive, competitive developer today without AI.
troyhunt.comSaid 19 Oct 2026This on korrents
-
The evidence to date does not support hyping AI as a data breach monster
I have much less understanding for why people infatuate with hyping AI as a data breach monster when the evidence to date is quite the opposite.
troyhunt.comSaid 13 Oct 2026This on korrents
The bold line is korrents’ wording; the quote is theirs. These 2: what they wrote before what they said aloud, one per source, newest first.
Feed
As its own page →Hiding
3 November
1 November
30 October
28 October
27 October
23 October
22 October
21 October
19 October
-
Their words
let's face it: you can't be a productive, competitive developer today without AI.
16 October
14 October
13 October
-
Their words
I have much less understanding for why people infatuate with hyping AI as a data breach monster when the evidence to date is quite the opposite.
9 October
4 October
- Mastodon
- BlogWeekly Update 524: Live From Copenhagen
- Mastodon
28 September
23 September
20 September
12 September
11 September
10 September
6 September
1 September
Nothing matches.
Beliefs
Korrents What they believe 9 beliefs — each backed by an exact quote.
Each is a — compiled by korrents.com, not by them: the one-line wordings are korrents', the quotes are theirs.
Recent
A developer cannot be productive and competitive today without using AI
let's face it: you can't be a productive, competitive developer today without AI.
Weekly Update 526: Building HIBP AI/SI First Said 19 Oct 2026
The evidence to date does not support hyping AI as a data breach monster
I have much less understanding for why people infatuate with hyping AI as a data breach monster when the evidence to date is quite the opposite.
Weekly Update 525: AI Data Breach Hyperbole Said 13 Oct 2026
A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too.
When I have conversations with breached companies, my messaging is crystal clear: be transparent and expeditious in your reporting of the incident and prioritise communicating with your customers.
A Sneaky Phish Just Grabbed my Mailchimp Mailing List Said 25 Mar 2025
Show 6 more
A modern phish is automated end to end: the stolen credentials are used and the data exported within moments of being entered.
This was obviously highly automated and designed to immediately export the list before the victim could take preventative measures.
A Sneaky Phish Just Grabbed my Mailchimp Mailing List Said 25 Mar 2025
Every website needs HTTPS, including a static site with no login and nothing sensitive on it.
So that's precisely what I've done - intercepted my own traffic passed over an insecure connection and put together a string of demos in a 24-minute video explaining why HTTPS is necessary on a static website.
Here's Why Your Static Website Needs HTTPS Said 13 Jul 2018
A password manager does not have to be perfect; it only has to be better than what people do without one.
password managers don't have to be perfect, they just have to be better than not having one.
Passwords Evolved: Authentication Guidance for the Modern Era Said 26 Jul 2017
Blocking paste on a password field makes passwords weaker, because people fall back to ones they can type.
When a website blocks the pasting of passwords in an attempt to improve security, they force some users to weaken their passwords to the point where they're dumbed down to easily typed versions.
Passwords Evolved: Authentication Guidance for the Modern Era Said 26 Jul 2017
Mandatory periodic password changes make passwords worse, because people just increment the number on the end.
If you're working in an environment that mandates regular password changes, you're very likely doing the same thing because it's an easy human control to deal with a technology requirement that's seen as an impediment.
Passwords Evolved: Authentication Guidance for the Modern Era Said 26 Jul 2017
Much of the received wisdom about passwords has been reversed, yet organisations still apply yesterday’s patterns to today’s threats.
In some cases, this has led to once-held "truths" about how we create and manage accounts to be totally flipped on their head, yet we still see modern organisations applying the patterns of yesterday to the threats of today.
Passwords Evolved: Authentication Guidance for the Modern Era Said 26 Jul 2017
Beliefs others hold too
Every website needs HTTPS, including a static site with no login and nothing sensitive on it. 2 hold this
So that's precisely what I've done - intercepted my own traffic passed over an insecure connection and put together a string of demos in a 24-minute video explaining why HTTPS is necessary on a static website.
Here's Why Your Static Website Needs HTTPS Said 13 Jul 2018
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
Recommends rcmnd
rcmnd What they recommend 6 things — each backed by an exact quote.
Compiled by rcmnd.app, not by them: the quotes are theirs, and each links to the post it was copied from.
Recent
Uses Eaton 5P 850VA / 600W Line Interactive Tower UPS
However, Eaton regularly floated to the top and I ended up with an Eaton 5P 850VA / 600W Line Interactive Tower UPS
troyhunt.com 24 Jul 2020
What others say about Eaton 5P 850VA / 600W Line Interactive Tower UPS →
Recommends Sony a6400 with 16mm Sigma f/1.4 lens
After much procrastination, I ultimately settled on a Sony a6400 with a 16mm Sigma f/1.4 lens . This was consistently the mix that rose to the top as I browsed around the web, asked on social and spoke to camera stores.
troyhunt.com 24 Jul 2020
What others say about Sony a6400 with 16mm Sigma f/1.4 lens →
Loved Surface Precision Mouse and Surface Ergonomic Keyboard
I know I'm waxing lyrical about otherwise pretty boring devices, but I just love these two units.
troyhunt.com 24 Jul 2020
What others say about Surface Precision Mouse and Surface Ergonomic Keyboard →
Show 3 more
Loved Verifi P5100 fingerprint reader
It's nicely built with a solid aluminium body and sits discretely off to my right, away from the main desk. It's a tad slow to read (the built-in ones on my Lenovo laptops are faster), but not as slow as the Brio was and more reliable too. I'm using this all the time not just to unlock my PC but to auth to 1Password as well. Highly recommended!
troyhunt.com 24 Jul 2020
Loved Ergotron HX and LX monitor arms
I hadn't originally planned to go down this path, but it's made a massive different to the cleanliness of my desk. Seriously, I can't overstate how nice it feels to have more clean, free space around me.
troyhunt.com 24 Jul 2020
Loved Herman Miller Aeron chair
I commented in the original post that a good chair was well worth the spend and I'm still sitting on the same Herman Miller Aeron as I type this. I've replaced some foam and that's it; this chair is probably the single best investment I've made in my workspace and if I write another post a decade from now, I expect I'll still be sitting on it.
troyhunt.com 24 Jul 2020
Where they publish
Blog troyhunt.com His blog on breaches, passwords and web security. Has a feed.
Recent
- Weekly Update 528: Reading AI-generated Code & the Economics of Solar 1 Nov 2026 By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of peo…
- Weekly Update 527: Cybergeddon News v. Reality 27 Oct 2026 As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In fact, it took days before I could…
- Weekly Update 526: Building HIBP AI/SI First 19 Oct 2026 I have this sense that we've passed the point where "vibe coding" is a derogatory term. I have no empirical evidence for this; it's more a feeling that those weaponising the term have now accepted the inevitability and…
Show 12 more
- Weekly Update 525: AI Data Breach Hyperbole 13 Oct 2026 I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist. I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was the polar-opposite opin…
- Weekly Update 524: Live From Copenhagen 4 Oct 2026 I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arrests in the news: Pep…
- Weekly Update 523: Live From a Norwegian Fjord 28 Sept 2026 How's that view?! With NDC Oslo now done, it's a little bit of sightseeing before heading to Denmark for GOTO in Copenhagen for Scott's and my "Cyber-broken" talk. In the meantime, this week is mostly about the ShinyHun…
- Weekly Update 522: Live From Oslo with Scott Helme 23 Sept 2026 Heads up: the first 7 mins is a bit quiet until we worked out the external mic was misbehaving - sorry! But get through that and have a listen to Scott's experiences with how Report URI is identifying malware-infected m…
- Weekly Update 521: Breach Perception v. Reality 11 Sept 2026 I think what really resonates with me this week is being able to completely turn the tables on perceptions around things like AI being the big bad hacking tool the news would have you believe. There's the stat I talk ab…
- Weekly Update 520: The Unscripted Edition 6 Sept 2026 I've started playing around with YouTube's "create video thumbnail", which hopefully will give me back a bit of time in my day (it used to be a manual job in Photoshop) and be a bit more interesting. And on that note, t…
- Weekly Update 519: Breaches & Data Integrity 1 Sept 2026 It does feel like I've bitten off too much and am now chewing like crazy this week. The 3D printing talk with Elle in Oslo, the "normal" NDC infosec talk, the cyber-broken talk with Scott in Copenhagen and then those ra…
- A Cautionary Tale About Data Breach Claims, Verification and Carhartt 25 Aug 2026 You're not going to believe this, but turns out you can't always take criminals at their word. Actually, I'll walk that back a bit as it may not even be the cybercrime guys who got this wrong, but it all starts here: 🚨…
- Weekly Update 518: IoT Doorlock Nirvana with UniFi 24 Aug 2026 I genuinely think I've nailed the IoT door lock situation! Well, Ubiquiti has, but I think I've worked out how to put it all into a residential house and have it make sense. There are a few basic tenets: Main power (nev…
- Welcoming the Sri Lankan Government to Have I Been Pwned 23 Aug 2026 Today, we welcome the 48th government onboarded to Have I Been Pwned’s free gov service: Sri Lanka. Sri Lanka CERT now has access to monitor Sri Lankan government domains against the data in HIBP, helping identify expos…
- Weekly Update 517: Cyber Ransoms 18 Aug 2026 The current ransomware situation is a bit of a kludge (deep breath): a lot of ransomware (which often doesn't even involve "ware", it's just extortion) is carried out by kids who successfully make a truckload of money b…
- Weekly Update 516: Live From Vietnam 12 Aug 2026 A little wind noise, a little connectivity flakiness, and a little lip-sync issues from YouTube, but look at that view! 🤩 Back to business, it's the Brinks Home FAQ I found most interesting this week. I mean, how do yo…
Link verified 20 Sept 2026. Recent items update automatically from the channel.
x.com @troyhunt Posts.
Recent
- I've got a real issue with reporting like this, where journos trawl through data breaches then publish a whole bunch of PII "in the public interest". It's a massive privacy violation and that alone should be enough to stop it. 3 Nov 2026
- If you’ve got a couple of spare moments and would like to vote 😇 1 Nov 2026
- Weekly update is up! Reading AI-generated Code & the Economics of Solar: 1 Nov 2026 troyhunt.com
Show 17 more
- Going live with my weekly vid in 10 mins! Reading AI-generated Code & the Economics of Solar 30 Oct 2026 youtube.com
- Well, that’s one way of doing it! 30 Oct 2026
- Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra cases *actually* led to any breaches? 27 Oct 2026 troyhunt.com
- Going live with my weekly vid in 5 mins! Cybergeddon News v. Reality: 23 Oct 2026 youtube.com
- Big thanks to @originhq for sponsoring my blog this week! After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome. 23 Oct 2026 originhq.com
- The "social media amplification" is because this is, without doubt, one of the dumbest security flaws we've ever seen in this industry. Frankly, the criticism has been pretty proportionate to the potential impact of this, and I find that statement hugely tone deaf. 22 Oct 2026
- Have we seen any documented breaches / exploitation traced back to either PHP2Shell or the eMudhra debacle? Massive headlines this week, what’s the impact so far (other than all the scrambling to patch etc)? 22 Oct 2026
- Nice 😎 “The agent gets the task done, but it doesn’t get your passwords” 22 Oct 2026
- The important thing with incidents like @eMudhra is to proceed openly and by engaging with the communit… ah crap 21 Oct 2026
- Weekly update is up! Building HIBP AI/SI First: The way we build and manage HIBP is fundamentally different today than it was a year ago, here's how it looks now 19 Oct 2026 troyhunt.com
- This never gets old 🤣 19 Oct 2026
- Going live with my weekly vid in 5 mins! Building HIBP AI/SI First: The way we build and manage HIBP is fundamentally different today than it was a year ago, here's how it looks now: 16 Oct 2026 youtube.com
- Big thanks to @originhq for sponsoring my blog this week! Where are your AI agents? Origin's sensor finds every install on your fleet, grouped by owner, including the ones your MDM never sees. 16 Oct 2026 originhq.com
- I really wanted to like this, but the launch was awkward and centred around a car you'll never be able to drive on road *or* track. Which is a shame, because the Perf model looks great (cues from T.50 / McMurtry), but it ain't ever doing a sub-1 sec to 100, let alone flying. 16 Oct 2026
- Looks like the ASOS notifications are going out: 15 Oct 2026
- You know how they say "never read the comments"? You should see the Hacker News ones in response to @Scott_Helme's post, strap yourself in, here are some highlights: 14 Oct 2026
- Weekly update is up! AI Data Breach Hyperbole: For all the attention on AI-powered hacking, we keep seeing companies lose millions of customer records because someone picked up the phone, impersonated IT support and talked their way in 13 Oct 2026 troyhunt.com
Link verified 20 Sept 2026. Recent items update automatically from the channel.
Mastodon @troyhunt@infosec.exchange Posts.
Recent
- Weekly update is up! Reading AI-generated Code & the Economics of Solar: 1 Nov 2026 troyhunt.com
- Going live with my weekly vid in 10 mins! Reading AI-generated Code & the Economics of Solar 30 Oct 2026 youtube.com
- Weekly update is up! Cybergeddon News v. Reality: Have the PHP2Shell and eMudhra cases *actually* led to any breaches? 28 Oct 2026 troyhunt.com
Show 17 more
- Going live with my weekly vid in 5 mins! Cybergeddon News v. Reality: 23 Oct 2026 youtube.com
- Weekly update is up! Building HIBP AI/SI First: The way we build and manage HIBP is fundamentally different today than it was a year ago, here's how it looks now 19 Oct 2026 troyhunt.com
- Going live with my weekly vid in 5 mins! Building HIBP AI/SI First: The way we build and manage HIBP is fundamentally different today than it was a year ago, here's how it looks now: 16 Oct 2026 youtube.com
- Weekly update is up! AI Data Breach Hyperbole: For all the attention on AI-powered hacking, we keep seeing companies lose millions of customer records because someone picked up the phone, impersonated IT support and talked their way in 14 Oct 2026 troyhunt.com
- Going live with a BIG weekly vid in half an hour! Weekly Update 525: AI Data Breach Hyperbole: 9 Oct 2026 youtube.com
- Weekly update is up! I'm live in Copenhagen and talking about the GOTO event here, the two ShinyHunters arrests this week, and beginning the long trip home to Aus: 4 Oct 2026 troyhunt.com
- I’m live from Copenhagen! 4 Oct 2026 youtube.com
- Weekly update is up! Live from a Norwegian fjord, this week takes a look at the recent ShinyHunters targeting of both Cl0p and the FBI, and what that escalation may mean for them 28 Sept 2026 troyhunt.com
- Weekly update is up! We're live from Oslo with @ScottHelme talking about the UniFi Travel Router, email signatures, malicious browser extensions and recent conference talks: 23 Sept 2026 troyhunt.com
- We’re live from Oslo! Weekly update 522 with Scott Helme: 20 Sept 2026 youtube.com
- Weekly update is up! Breach Perception v. Reality: AI, Vishing, Odido, Manchester Airports Group, Sophistication, Published Keys, etc: 12 Sept 2026 troyhunt.com
- Going live with my weekly vid in 10 mins! Breach Perception v. Reality: AI, Vishing, Odido, Manchester Airports Group, Sophistication, Published Keys, etc 10 Sept 2026 youtube.com
- RE: https://infosec.exchange/@ScottHelme/117229017209894413 Four years of exposure 😮 7 Sept 2026
- Weekly update is up! The Unscripted Edition: No agenda, all impromptu, here's what I'm up to, AMA, etc: 7 Sept 2026 troyhunt.com
- I'm live! Weekly Update 520: The Unscripted Edition: No agenda, all impromptu, here's what I'm up to, AMA, etc: 4 Sept 2026 youtube.com
- Weekly update is up! Breaches & Data Integrity: Synthetic Data in Breaches; Email Address != Person; Ridiculous Security for “Cyber Broken” Copenhagen: 2 Sept 2026 troyhunt.com
- Going live with my weekly vid in 10 mins! Breaches & Data Integrity: Synthetic Data in Breaches; Email Address != Person; Ridiculous Security for “Cyber Broken” Copenhagen 31 Aug 2026 youtube.com
Link verified 20 Sept 2026. Recent items update automatically from the channel.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.