Top all-time · #29
Troy Hunt
Personal blog · troyhunt.comsecurityprogramming
Troy Hunt's personal blog at troyhunt.com covers security and programming. Since 2010, 682 different Hacker News readers have linked it 1,071 times, most often “Why Static Websites Need HTTPS”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Sometimes recommended · 6 of 40 sampled comments recommend it?
Why HN links it
Commenters cite his posts as references on web security, HTTPS, passwords and breaches, and on Have I Been Pwned's cloud costs and architecture, and call him a writer of great security articles.
- Recommended for · 6 comments
- Called a great bounties post, a good write-up, an excellent HTTPS explainer, great security articles, and pretty good.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals
Most-linked posts?
- Why Static Websites Need HTTPS28 people · 30 mentions · first linked 2018-07-12
- "Pwned Passwords" V2 With Half a Billion Passwords23 people · 24 mentions · first linked 2018-02-21
- Doing Big Things for Small Dollars with Cloudflare Workers and Azure Functions13 people · 13 mentions · first linked 2018-09-05
- Beg Bounties11 people · 14 mentions · first linked 2021-11-08
- Ad blockers are part of the problem10 people · 11 mentions · first linked 2016-11-21
- /10 people · 11 mentions · first linked 2017-01-30
- On the (Perceived) Value of EV Certs, Commercial CAs, Phishing and Let's Encrypt10 people · 10 mentions · first linked 2017-07-19
- Extended Validation Certificates Are Really Dead9 people · 10 mentions · first linked 2019-08-12
- We're Baking ‘Have I Been Pwned’ into Firefox and 1Password9 people · 10 mentions · first linked 2018-06-25
- The “Cobra Effect” that is disabling paste on password fields9 people · 9 mentions · first linked 2016-05-02
What Hacker News says?
From GP's link: I find that her email addresses have been included in that recent dump of 770 million accounts called "Collection#1". For background, see Troy Hunt's explanation for this data [0]. He certainly didn't add Ms. Sanchez's passwords to this. The MEGA uploader could have, one supposes, but that pushes the timeline back to early January. The idea that someone was sitting on all these creds ( 140M email add…
Comment linking /the-773-million-record-collection-1-data-reach/
on “No Thank You, Mr. Pecker”Submitted Thanks FedEx, this is why we keep getting phished as a story · 1723 points
HN discussionInteresting to see what Troy Hunt does next considering they send him free stuff[1] and he speaks highly of them. He's so far only said it's "obviously a really bad look"[2] 1. https://www.troyhunt.com/friends-dont-let-friends-use-dodgy-... 2. https://twitter.com/troyhunt/status/1376998711318863880
Comment linking /friends-dont-let-friends-use-dodgy-wifi-introducing-ubiquitis-dream-machine-and-flexhd/
on “Whistleblower: Ubiquiti Breach “Catastrophic””Submitted I got pwned by my cloud costs as a story · 1398 points
HN discussionI've always found Troy Hunt's tech stack of haveibeenpwned.com interesting. The API does 5M requests a day with Azure Functions and Cloudflare caching. Ultimately only costing him 2.6c per day. https://www.troyhunt.com/serverless-to-the-max-doing-big-thi...
Comment linking /serverless-to-the-max-doing-big-things-for-small-dollars-with-cloudflare-workers-and-azure-functions/
on “Serverless: slower and more expensive”Submitted The Dropbox hack is real as a story · 1313 points
HN discussion> you waste time with the constant spam of people begging for bounties A great blog post on the matter https://www.troyhunt.com/beg-bounties/
Comment linking /beg-bounties/
on “1 bug, $50k in bounties, a Zendesk backdoor”Submitted The “Cobra Effect” that is disabling paste on password fields as a story · 911 points
HN discussionYour email is public, there's no gain in keeping it secret. For further reading: https://www.troyhunt.com/im-sorry-but-your-email-address-is-...
Comment linking /im-sorry-but-your-email-address-is-not/
on “Start with a Website, Not a Mobile App”Submitted Cookie Warning Shenanigans Have Got to Stop as a story · 888 points
HN discussionTroy Hunt wrote about his experience with self-hosted ads a while ago [1]. Basically, he added a as-non-intrusive-as-possible "banner" (if you can even call it that) at the top of the content. Ad blockers blocked it. He changed the markup to avoid being caught by a false positive. Ad blockers (Adblock Plus with EasyList in this case) blocked it again. I made similar experiences in the past, to the point where our AP…
Comment linking /ad-blockers-are-part-of-the-problem/
on “We’re dropping Google Ads”Submitted Have I Been Pwned 2.0 as a story · 880 points
HN discussionI wonder if the disk on a $40 Hetzner server would be fast/big enough for him. All the searching and storing of massive password hash collections. He has a writeup here on how he gets costs down in a big way: https://www.troyhunt.com/serverless-to-the-max-doing-big-thi...
Comment linking /serverless-to-the-max-doing-big-things-for-small-dollars-with-cloudflare-workers-and-azure-functions/
on “I got pwned by my cloud costs”Submitted Mmm, Pi-hole as a story · 849 points
HN discussion>Can somebody explain to me why I wouldn't just rent a 40 EUR dedicated server from Hetzner [...] , I just don't understand why people use cloud services. This recurring question of "why AWS/Azure instead of Hetzner/OVH ?" keeps happening because people are incorrectly comparing higher-level PaaS to lower-level IaaS without realizing it. PaaS != IaaS are not equivalent. IaaS is not a direct drop-in replacement for P…
Comment linking /serverless-to-the-max-doing-big-things-for-small-dollars-with-cloudflare-workers-and-azure-functions/
on “I got pwned by my cloud costs”Submitted "Pwned Passwords" V2 With Half a Billion Passwords as a story · 842 points
HN discussionI was quoting you. But I'm sure you could figure out the meaning anyway: what's the source for that information that you claim he keeps a secret. Partially it even works the other way - FBI and others are feeding data into hibp https://www.troyhunt.com/open-source-pwned-passwords-with-fb...
Comment linking /open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live/
on “I got pwned by my cloud costs”Submitted I'm Open Sourcing the Have I Been Pwned Code Base as a story · 722 points
HN discussionhttps://www.troyhunt.com/banks-arbitrary-password-restrictio...
Comment linking /banks-arbitrary-password-restrictions-and-why-they-dont-matter/
on “I just lost my wallet on the way home from work”Submitted Project Svalbard: The Future of Have I Been Pwned as a story · 700 points
HN discussion>Autofill is your primary defense against phishing, The autofill feature is not 100% reliable for various reasons: (1) some companies use different domains that are legitimate but don't exactly match the url in the password manager. Troy Hunt, the security expert who runs https://haveibeenpwned.com/ got tricked because he knew autofill is often blank because of legit different domains [1]. His sophisticated knowledg…
Comment linking /a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/
on “NPM debug and chalk packages compromised”Submitted We're Baking ‘Have I Been Pwned’ into Firefox and 1Password as a story · 688 points
HN discussionThe browsers mostly did away with EV certs[1], against sustained pushback from CAs, because of research invariably showing that the feeling of security is mostly unfounded. (Both because users are garbage at reading security indicators—and unscrupulous companies are eager to take advantage of that, see Cloudflare’s “security of your connection”—and because the legal-name namespace is much more Byzantine and locale-d…
Comment linking /extended-validation-certificates-are-really-really-dead/
on “NPM debug and chalk packages compromised”Submitted HTTPS on Your Landing Page Is Important as a story · 639 points
HN discussionJust FYI, that's not really true. Adblocker use mostly all the same filter lists and those do regularly block ads that just are regular images, and even text notes. https://www.troyhunt.com/ad-blockers-are-part-of-the-problem... is an example, even if that specific one got resolved Adblock Plus has the ability to not block ads that conform to a certain standard, but in addition to conform to standards ad publishers…
Comment linking /ad-blockers-are-part-of-the-problem/
on “All extensions disabled due to expiration of intermediate signing cert”Submitted I'm Testifying to Congress about Data Breaches – What Should I Say? as a story · 637 points
HN discussionThe reason I'd advocate in more public settings is that things ought to be secure-by-default, and that adopting security only upon realizing its necessity is a hazard-prone policy that constantly backfires. But for a specific example of something that could go wrong: someone could inject malicious content into a non-secure page. The original content might be plain-text, but a man-in-the-middle can still inject whate…
Comment linking /heres-why-your-static-website-needs-https/
on “How to Work Hard”Submitted Two billion email addresses were exposed as a story · 634 points
HN discussionI had the opposite problem. Knowing the importance of offsite backups I had the brilliant idea of backing up my wallet.dat on Dropbox without any additional encryption. My bitcoin were only worth a few bucks, who'd bother stealing them, right? Years later, I saw that BTC had gone up in price a few orders of magnitude so I tried to load my wallet.dat and cash out. Except when I opened my wallet file, the balance was…
Comment linking /the-dropbox-hack-is-real/
on “SETI@home shuts down after 21 years”Submitted Face ID, Touch ID, No ID, PINs and Pragmatic Security as a story · 612 points
HN discussion
