5 ms·
1.4B Clear Text Credentials Discovered in a Single Database
- marksomnian 9y agoTitle is exaggerating; this "single database" is actually an aggregate of many previous breach dumps.
- ryanlol 9y agoYeah, this is just stupid. 1.4B rows isn't even a decent amount of data as far as the publicly available DBs go. Silly marketing fluff from yet another "threat intelligence" snake oil outfit.
- snarfy 9y agoWhich makes the aggregate a single database.
- breakingcups 9y agoYes, but it is not like a single service has been breached to leak that many accounts, significantly reducing the relevance and impact of this particular database. Anyone can compile a list such as this from other big dumps without much trouble, you just need some disk space.
- coldtea 9y ago>Yes, but it is not like a single service has been breached to leak that many accounts, significantly reducing the relevance and impact of this particular database. Err, it actually increases its relevance and impact. With the same database now a hacker can reach multiple services...
- minton 9y agoI agree the title is click bait. Here’s a quote from the creator (taken from the reddit link): > I have compiled it, I just want to show how big is password reuse problem for security community, and how easy was to crack those hashes using open source software.
- lern_too_spel 9y agoAnd it's not "discovered." Somebody aggregated the breaches and intentionally made it public.
- LeonM 9y agoHow comes that 'homelesspa' ranks 13 on the most used passwords? I mean, I understand why '123456' and 'password' are in the list, but a seemingly random combination of words such as 'homelesspa'? I did found this: https://twitter.com/clinton_ngn/status/736247662866006018 https://twitter.com/clinton_ngn/status/736247662866006018 But no real explanation
- michaelmcmillan 9y agoMost likely a bot that registered a ton of users with the same password.
- kevin_thibedeau 9y agoCould be added to detect who is scanning with this list. Akin to mapmakers adding fake streets.
- seanalltogether 9y agoIt looks like 427 million of these entries came from a myspace breach. https://news.ycombinator.com/item?id=11788694 https://news.ycombinator.com/item?id=11788694
- maximumkek 9y agoanybody with links to the db?
- sschueller 9y agoWhere can I download this dump so I can find out if any of my accounts are in it?
- varren 9y agohttps://www.reddit.com/r/pwned/comments/7hhqfo/combination_of_many_breaches/ https://www.reddit.com/r/pwned/comments/7hhqfo/combination_o...
- gregsadetsky 9y agoThanks a lot for the link! I ended up downloading the database, and going through all of my email contacts to see who was affected to write to them individually. About 7/10 frequently contacted people were in the database (...!). About half of those let me know that the passwords were not in use anymore. The other half was very, very grateful...! It was a great time to remind them about password managers, 2fa, etc.
- stanmancan 9y agoNot a link to the DB but a great relevant service: https://haveibeenpwned.com/ https://haveibeenpwned.com/
- ninonino 9y agoRather often quite incomplete, often only has partials of dumps he claims to have added and when this was pointed out he didn't want to add the rest - didn't even want to change the description of the dumps to say they were incomplete
- jwcrux 9y agoDo you have references for this? I've had nothing but good experiences with HIBP in the past.
- Johnny555 9y agoThis seems odd: This database makes finding passwords faster and easier than ever before. As an example searching for “admin,” “administrator” and “root” returned 226,631 passwords of admin users in a few seconds. Out of 1.4B credentials there are only 226K for admin, administrator and root?
- an_account 9y agoIf anything that sounds high to me.
- pedalpete 9y agoWe're talking account passwords for web services mostly, right? I think that would explain why admin, administrator and root are rarely used as usernames.
- katastic 9y agoWhat about "sa"?
- campuscodi 9y agoThis article is such garbage... it was tore apart in a /r/netsec discussion just last night. https://www.reddit.com/r/netsec/comments/7ikbzo/14_billion_clear_text_credentials_discovered_in_a/ https://www.reddit.com/r/netsec/comments/7ikbzo/14_billion_c...
- jokoon 9y agoI checked, most are outdated passwords. Odd thing, I checked with other people, and they don't remember those as old passwords. I even found passwords I don't remember...
- rando444 9y agoA couple of the constant examples of password reuse that can be found: proceeds to list domain names that are aliases of one another Also the whole describing the thing as a database and saying it's fast because it's alphabetical... At least describe what kind of database you're talking about so we can understand why an index isn't possible.