6 ms·
GitHub accounts leaked [REMOVED]
- paxpelus 10y agoI really suggest if you see your email in this list to change your github password. I have seen my account in this list along with the name of the companies I am member of in Github. I tested 3-4 other accounts and all of them are valid credentials for github.com
- kruhft 10y agoNone of my 3 accounts in there.
- metafunctor 10y agoLooks like the results of brute forcing password hashes. The list only contains easy passwords.
- paxpelus 10y agoMost of the passwords seem easy but you can find some harder passwords in the list. Examples: ABab12!@, 1ae2T8gogE, nyC27f6cuW, 01j2o8h8n9 and more
- pawadu 10y ago01j2o8h8n9 is by no means a secure password
- dozzie 10y agoHow do you assess that?
- pawadu 10y agoat first this looks like 10 letter + digits, so the number of possible combinations are 10 ^(26 + 10) = 10^36 But notice that the letters all come from the right half of the keyboard, which is not that uncommon. So the attacker could have tried 10 ^(26/2 + 10) = 10^23 passwords, which is really not that secure. But then again, the password starts with 01 so this would show up very early in an exhaustive search. And given these characteristics, chances are the hash was already in someones rainbow tables.
- dozzie 10y ago> But notice that the letters all come from the right half of the keyboard Better yet, now notice that the letters come from a set of four! That reduces the search space even more! Ridiculous argument.
- pawadu 10y ago> Ridiculous argument. I beg to differ: http://www.ijicic.org/ijicic-10-09032.pdf http://www.ijicic.org/ijicic-10-09032.pdf
- saasinator 10y agoI tested a number of accounts, it's a legit dump. If your email is in there I'd change your password and anywhere else you re-used the password.
- paxpelus 10y agoI am still testing several accounts, more than 90% are legit accounts that didn't changed password yet. Among the accounts I did find companies such as Microsoft, General Electric, EpicGames and more.
- keyle 10y agoBTW the EpicGames are just people that downloaded UE4 and got access to the github source. They're not actually from Epic.
- pawadu 10y agoKind of off topic, but doesn't github and other big companies use a services that automatically emails the owner and/or resets their password when their account information shows up on pastebin? So why are the accounts still up?
- keyle 10y agoI didn't know such service existed. Sounds interesting. Is there a service monitoring pastebin etc. for an individual's email account?
- pawadu 10y agohavent tried it myself: https://haveibeenpwned.com https://haveibeenpwned.com
- paxpelus 10y agoI received emails from https://rbnhd.com/ https://rbnhd.com/ & https://changepassword.nu/ https://changepassword.nu/ and found those emails on my spam folder (gmail). The emails were saying that my password was leaked. I never subscribed on any of the above services.