Stefán Jökull Sigurðarson

Code Wrangler @haveibeenpwned, former Microsoft MVP, @dotnetfdn member, @[email protected].

[Stefán Jökull Sigurðarson @stebets]

It’s official now. I’ll be joining @troyhunt and @Charlotte_Hunt_ later this summer, working full time for @haveibeenpwned!Really excited about this awesome opportunity and I’m very much looking forward to it! 🥳

[Troy Hunt @troyhunt]

Massive day for @Charlotte_Hunt_ and I today as we welcome our first ever *proper* @haveibeenpwned employee: @stebets https://t.co/h9A3gnLYO2

[Scott Helme @Scott_Helme]

This Microsoft 364 outage is pretty rough!

[Have I Been Pwned @haveibeenpwned]

New breach: Europol and partners dismantled infrastructure supporting the CastleRAT remote access trojan this week, providing HIBP with 180k email addresses and 893k unique passwords seen 3M times. 41% of addresses were already in @haveibeenpwned. More: https://t.co/bP4WuhRAxM

[James Jackson-South @James_M_South]

I think I must have posted this at the wrong time. This is #dotnet with C# beating everyone. AGAIN.

[FinkTheArtist @crtvTeknologist]

Password strength indicator. Made with Fable 5.2

[Stefán Jökull Sigurðarson @stebets]

@crtvTeknologist Please tell me you are using @haveibeenpwned for the checks! 😅

[Scott Helme @Scott_Helme]

We've found 15,579 websites serving malicious JavaScript, with an estimated 135 MILLION visits every month. 🤯

We know they're infected, and we have the evidence, but how on Earth do we notify them all?!

We need help from the security community 👇

https://t.co/RRSEhO3tEh

[James Jackson-South @James_M_South]

Current @SixLabors ImageSharp (C#) JPEXL decoder benchmarks vs libjxl (C) and jxl-rs (Rust).

Faster for 3/4 benchmarks and uses less memory for 4/4. BenchmarkDotNet sees native memory pooling as a leak but it's not (obvs cos pooling).

#dotnet FTW

[Stefán Jökull Sigurðarson @stebets]

OMG! 🤣🤣🤣

[The Guvnor @The_Guv]

Binance: Hackers stole $6.3 BILLION in crypto!

Meanwhile, in North Korea...

[Jen Gentleman 🌺 @JenMsft]

I don't know who needs to hear this, but you can open a volume mixer in Windows 11 by pressing WIN + CTRL + V

[Stefán Jökull Sigurðarson @stebets]

@dinodaizovi Having used a “black box” HSM with limited documentation on a few occasions I think you’d have to make an effort or not know what you are doing to have a proper HSM generate bad keys like this. So either this is deliberate misuse or incompetence, both not fit for a proper CA

[Stefán Jökull Sigurðarson @stebets]

Ok, I'm a former MS MVP and a pretty big fan of a lot of stuff Microsoft does, but this is just silly at this point. Can we ease up on the Bing upselling and not just make up BS reasons for the average user to use Bing instead of something else they prefer.

[Scott Helme @Scott_Helme]

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

😬

[Scott Helme @Scott_Helme]

Here's everything we've done so far for @reporturi in response to php2shell.

Feedback and suggestions welcome 👍

[Stefán Jökull Sigurðarson @stebets]

@erlendur Ekki fara að koma með rökréttar staðreyndir og commom sense inn í umræðuna… 😅

[Stefán Jökull Sigurðarson @stebets]

Here they come….

[Scott Helme @Scott_Helme]

If passkeys have people this upset, wait until they hear about DBSC 🤣
Your session is hardware bound to your device... 🫆

Somewhere, a cookie just found out it can be device-bound 🍪🔐

https://t.co/WJUR8i9yLm

[Stefán Jökull Sigurðarson @stebets]

@kellabyte We make pretty good use of Azure SQL for @haveibeenpwned and with some recent changes we made, we have pretty damn good perf as well :) it’s not the cheapest though but we’re also working on reducing that while improving perf and minimizing disruptions at the same time

[Stefán Jökull Sigurðarson @stebets]

The original article jumps to some conclusions and frankly has potentially unsafe and dangerous recommendations. @Scott_Helme dives into the details.

[Scott Helme @Scott_Helme]

Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.

The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.

I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.

https://t.co/XULAcwyi1A

[Scott Helme @Scott_Helme]

Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.

The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.

I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.

https://t.co/XULAcwyi1A

[Troy Hunt @troyhunt]

If only they’d checked first 🤔

[Stefán Jökull Sigurðarson @stebets]

@X_sun_ny @maxpowerFL Being able to do things that are boring but need to be done was the game changer for me.