5 ms·
4M gmail addresses with passwords leaked (large html file, 150megs)
- deleted 10y ago[deleted]
- disposablename 10y agoProbably passwords from other sites, not gmail. Lists my email next to a password I've never used on gmail, or any other important site.
- buckbova 10y agoCaution, this is a link to the actual emails.
- r1ch 10y agoAs a 150MB HTML file. Good luck, mobile users.
- aaronpk 10y agoDid not see that coming.
- lechevalierd3on 10y agoYeah not sure why one would link to that file directly.
- mr_november 10y agoI've changed the title to reflect the size but there is no story here without the link. What would you have done? I ask not to confront but rather to learn. I didn't feel completely comfortable posting the link but thought it was better that it's out there (and it looks like it's not even new according to comments).
- tmp_cURL 10y agoTo download, I used: curl https://pred.me/gmail.html -vo /tmp/pred.me.gmail.$RANDOM.txt There appear to be no malicous/unsafe <scripts/> at the moment. No HTML tags. Just one email per line, and a colon (:) delimiter for the password. The MD5 hash is: c1d5f3998459acea8d32937a4485c0b7 Availability is spotty. The server is refusing connections, probably due to high load. The IP address resolved to: 81.4.110.159 I don't think the direct link is out of line. Some users might need guidance on how to safely inspect the file. In terms of HN community conventions and common behaviors, people will often submit a question like "Ask HN: Lorem Ipsum..." and then provide follow-up details in the message body, including relevant information, such as the details I've provided above. This way, if the owner of the resource at the address starts serving up malware, users can verify the content before consuming it. These are merely community memes though. Not any sort of auspicious, high-minded "best practices as prescribed by experts" or anything. Just some stuff a bro might do around here. Also, WHOIS info might be useful, if safety or malware is a concern... http://whois.domaintools.com/pred.me http://whois.domaintools.com/pred.me This doesn't preclude the domain owner having been pwnt and used as a patsy. Or even whether that person might have a valid reason for hosting the file?
- kafkaesq 10y agoFascinating. Any thoughts as to how this came about?
- r1ch 10y agoI think this is the "bitcoin gmail dump". My email is listed here, but it has a throwaway password that I've never used as my gmail password. https://haveibeenpwned.com/PwnedWebsites#BTSec https://haveibeenpwned.com/PwnedWebsites#BTSec
- deleted 10y ago[deleted]
- mr_november 10y agoA friend tells me he was emailed by https://haveibeenpwned.com/ https://haveibeenpwned.com/, letting him know his details were at that link.
- ayuvar 10y agoLooks like at least some of these passwords come from the Daz3D website (964 hits).
- fiatjaf 10y agoCan anyone see if my name is in there?
- simcop2387 10y agoI'm sure it'll get added to haveibeenpwned.com fairly quickly. That said I'm trying to grab it for the same reason. If your email is in your HN profile I'll give it a check.
- r1ch 10y agoPretty sure it's already there, looks like https://haveibeenpwned.com/PwnedWebsites#BTSec https://haveibeenpwned.com/PwnedWebsites#BTSec
- simcop2387 10y agoOh nice, I missed it in there. Sometimes it takes an hour or so before I see new ones in there.
- milas 10y agoI got an email for it on Nov 25. Subject: Yours is one of 4,788,657 email addresses found in a paste titled "pred.me" At the time, it showed up on the "Latest Pastes" on HIBP, but I think it's aged out now.
- Flammy 10y agoI give this dump 12 more minutes until someone at Google uploads it to an internal tool to invalidate all of the emails listed.
- acjohnson55 10y agoUnfortunately, I wouldn't be shocked if someone out there had a tool that can escalate this exploit just as quickly.
- deleted 10y ago[deleted]
- Sephr 10y agoMirror?
- EliteSoba 10y agoNew here, so not sure about what's okay for filesharing so I just put it on mf: https://www.mediafire.com/?igf84x5vnxaprog https://www.mediafire.com/?igf84x5vnxaprog
- nilved 10y agoThis is from 2014 and likely not a Google hack or leak but a subset of credentials revealed by hacks or leaks from other sites. https://productforums.google.com/forum/#!topic/gmail/4q3AYMiUEsk https://productforums.google.com/forum/#!topic/gmail/4q3AYMi... and https://facepunch.com/showthread.php?t=1423764 https://facepunch.com/showthread.php?t=1423764 refer to this link. Edit to add: https://haveibeenpwned.com/PwnedWebsites#BTSec https://haveibeenpwned.com/PwnedWebsites#BTSec
- Karuma 10y agoIndeed... My email is listed here, but it shows "password" as its password, which is completely false. I only use "password" in random websites that force me to register (but that I'll never visit again).
- coldcode 10y agoI looked at the paste file. It had my gmail address (which is mostly what I use for public stuff) but the password came from only one place: travel.travelocity.com; however that user database is long gone as Travelocity is now just a brand of Expedia so that old account no longer exists. Of course I don't reuse passwords so it's not an issue. I wonder how it got there.
- rasz_pl 10y agofake, checked 3 gmails. not only are the passwords wrong, they are random garbage that was never used with those accounts
- cuchoi 10y agoOne returned me the error "You changed your password 5 months ago"
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]