Have I Been Pwned?

on YouTube ↗50m

" summary

Have I Been Pwned describes processing over 11 billion breached records, running Pwned Passwords approaching a billion unique passwords and protecting sites with k-anonymity via first-five SHA1 prefix checks, served through Cloudflare with ~5 billion requests/month and a 99.9999% cache-hit ratio. Concrete incidents include LastPass vaults exfiltrated via stolen cloud keys, Optus leaking 11 million customer records through an insecure direct object reference, and Genesis Market takedown adding ~8 million victim records after ~120 arrests. The breach-fed API is operational and widely adopted.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 1:57LastPass breach
3. 5:50Netflix
4. 8:22True 2FA
5. 11:14Example: Bank
6. 14:36https://haveibeenpwned.com
7. 23:55"We Leak Info"
8. 25:30Leakedsource
9. 28:10Optus
10. 42:50Genesis Market
11. 48:56Outro

" related talks

• 01h 02mI’m Pwned. You’re Pwned. We’re All PwnedTroy Hunt · NDC Sydney 2018
• 48mLessons From Billions of Breached RecordsTroy Hunt · GOTO Copenhagen 2022
• 47mLessons From Billions of Breached RecordsTroy Hunt · Security Visionaries 2022
• 46mKeynote: Lessons From 11 Billion Breached RecordsTroy Hunt · Black Hat Asia 2021
• 37mHave I Been Pwned: Serving billions of requests and terabytes of data without going broke!Stefán Jökull Sigurðarson · NDC Oslo 2023
• 54mHave I Been Pwned - A Passkey JourneyStefán Jökull Sigurðarson · NDC Security 2026
• 40mFantastic Passwords and Where to Find ThemPhil Nash · NoRuKo 2020
• 46mRequiem for the PasswordSteven Kriby · BSides Huntsville 2021