4 ms·
GITHUB HACKED: Unhashed passwords pasted, check your email, change your password
- brgarciarivas 10y agoget wrekt
- sctb 10y agoPlease don't comment like this on Hacker News.
- baxter001 10y agoGit automatically exposes the email of committers, or at least a string that is nominatively an email, I see no evidence of a anything beyond that here.
- bsin10 10y agoPlain text passwords pertaining to each email are included in the dump.
- postila 10y agoDecision to store plain text user passwords must cost someone's job.
- ohscarl 10y agoOne of the pastes at that link lists thousands of real Github account emails followed by an unhashed password. Some of them have private repositories listed as well. I'd rather not post the pastebin to remove the hassle of finding the exact one, but it was posted in the past few hours and I'd recommend that everyone check their Github emails on haveibeenpwned.com to see if it's found in the paste. Better yet change your password immediately since there's no announcement from Github regarding the extent of the breach.
- xavierJohnson 10y agohavent been able to find myself in the list... not sure this is real news...
- nmgsd 10y agocan anyone confirm this is legit?
- ohscarl 10y agoThe pastebin of 5,199 emails is still up as of now. I reported it but if someone has a PRO account, those reports will get processed sooner and hopefully the leak won't be abused too badly.
- ohscarl 10y agoOfficial response from Github: -------- Hi there Oscar, Thanks for writing in about this. If your credentials were included in that file, you should have already received an email from us and had your password reset. We've done the same for all users involved. There's no indication that GitHub was breached and our downtime was unrelated. We believe the 5,199 users in the paste linked on haveibeenpwned.com are the result of someone using a breach from another website against ours to check for users re-using the same credentials. If you have any questions, do let us know!
- nikolay 10y agoThat's what happens when people reuse passwords...