I’m digging into the vault for a classic interview – a blast from the past! I’ve done 460 episodes over the last nearly 9 years, and some of the best old episodes still hold up well today. I first interviewed Troy Hunt, creator of Have I Been Pwned, in February of 2019. It was Episode 102 and it was entitled “You Must Stop Reusing Passwords”. In this episode we talk a little about the origins of HIBP, password security, data breaches and brokers, and how to keep our accounts secure. I’ve added some new commentary, but the original episode is preserved in all of its glory!

Interview Notes

• Have I Been Pwned? https://haveibeenpwned.com/ 
• NIST updated password guidelines:  https://pages.nist.gov/800-63-4/sp800-63c.html 
• Proton summary of NIST changes: https://proton.me/blog/nist-password-guidelines 
• Password haystacks: https://firewallsdontstopdragons.com/need-a-bigger-password-haystack/ 
• Choosing a strong PIN: https://firewallsdontstopdragons.com/how-to-choose-a-pin/ 
• Using passphrases: https://podcast.firewallsdontstopdragons.com/2021/05/24/how-when-to-use-a-passphrase/ 
• On passkeys: https://podcast.firewallsdontstopdragons.com/2023/05/22/problems-with-passkeys/ 

Further Info

• My book: https://fdsd.me/book 
• My newsletter: https://fdsd.me/newsletter 
• Support the mission: https://fdsd.me/support 
• Give the gift of privacy and security: https://fdsd.me/coupons 
• Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

• 0:00:07: Intro
• 0:00:32: Interview setup
• 0:02:52: What is Have I Been Pwned?
• 0:05:37: What is a data breach?
• 0:06:42: Where do you get data breach records?
• 0:08:18: What is the “dark web”?
• 0:10:35: How do YOU get breach data?
• 0:11:43: What were some of the worst data breaches?
• 0:15:09: Who is behind these breaches?
• 0:17:03: How often are data brokers hacked?
• 0:19:47: Is it that hard to protect our data?
• 0:21:22: Is there no liability for not protecting data?
• 0:24:16: What about breach disclosure laws?
• 0:26:00: Do class action lawsuits provide accountability?
• 0:29:00: How can consumers evaluate a company’s data security?
• 0:32:35: Is data collection inherently bad?
• 0:34:43: How can we best use HIBP?
• 0:36:59: Should sites be rejecting known-bad passwords?
• 0:39:37: Why do some sites limit the use of special characters?
• 0:41:50: How up-to-date is HIBP data?
• 0:44:25: What does registering for notifications do?
• 0:45:39: What is your “opt out” feature?
• 0:46:25: Can hackers use HIBP for nefarious purposes?
• 0:48:16: Any other password advice?
• 0:50:27: Which services integrate with HIBP?
• 0:52:19: Wrap-up
• 0:54:52: New password guidelines
• 1:01:45: Patron podcast preview
• 1:02:12: Looking ahead