7 ms·
Check if your email is amongst those compromised in Gawker break-in
- steveklabnik 16y agoIf you're on OSX, it's 'md5' and not 'md5sum.'
- rscott 16y agoWell, that is most unfortunate. A big thanks for the heads up.
- jedsmith 16y agoWhat is the point of including the domain tied to the address? It just decreases the anonymity of what you've hashed, and actually does a disservice. There are corporate domains in there and the namespace of what to search for becomes a lot smaller. In addition, my domain is my name. I saw many others in the file that this was the case for. It's not a big leap to compute my e-mail from 'jedsmith.org', and I'm sure it isn't for those guys either. You're leaking data with this view. Here's a version that is far more anonymous (and easier, I think): http://undertow.jedsmith.org/gawker/ http://undertow.jedsmith.org/gawker/
- jdludlow 16y agoI like it. OS X users, if you are paranoid about using online tools for the SHA-256 hashing, you can do this from the command line with sha256deep. Via Homebrew it'd go like this (replace the 1st step with whatever package manager you like): $ brew install md5deep $ echo -n my@email | sha256deep d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2
- wizardishungry 16y agoThe hash is md5 not sha
- jedsmith 16y agoHe's referring to using mine.
- izak30 16y agoAlso python >import hashlib >hashlib.sha256("you@yourdomain.com").hexdigest()
- sirn 16y ago…or without installing anything: $ echo -n 'my@email' |openssl dgst -sha256 d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2
- jrmg 16y agoOr, with the cryptically named 'md5'... echo -n 'my@email' | md5
- chrisbroadfoot 16y agomd5 != sha256 $ echo -n 'my@email' | shasum -a 256 d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2 -
- jrmg 16y agoAh - true - we're talking about different things though (which is my fault to start with, but I see confusion in others too). MD5 is what's used in the linked spreadsheet's email address fields, which is what I thought we were talking about. SHA-256 is used in jedsmith's lists.
- abraham 16y agoWhy even bother hashing the email addresses when the entire dump can be downloaded with bit torrent.
- jedsmith 16y agoBecause I'd prefer not to help distribute the leaked information? If you want the information, nothing stopping you from getting it, true. However, me throwing up an entire list of e-mails just adds to the problem.
- ig1 16y agoAny one with ill intent will have already downloaded the full unanonymous file.
- metageek 16y agoI found it useful because I use site-specific email addresses (as in username+domain@example.com). I didn't know if I had a gawker login, so I searched for my domain. If I hadn't found it, I could've saved myself digging through my saved email.
- eekfuh 16y ago266 emails whose domain end with .gov Very interesting.
- jrockway 16y agoInteresting that people only have a work account, or interesting that people who work for the government also slack off at work? .gov is not just Obama and super-secret crytpo scientists. It's also the person who makes sure that every form they send out has an OMB Control Number.
- eekfuh 16y ago(I wasn't going to reply but since I'm getting pretty heavily down-voted I will) I was commenting on how I thought it was interesting that so many government employee's would use their work email for (most likely) non-work related sites. Also I find it interesting how assuming you were off such a small comment I posted.
- dholowiski 16y agoThats great, thanks. I was relieved to not find my email in the list, although I could swear I've commented on gawker sites.
- jamesjyu 16y agoYou probably used Facebook Connect. This, btw, is a great example of when using a trusted 3rd party login is a big win.
- ThePengwin 16y agoStill, it's annoying when they can turn around and use such a login to spam things to another account. sadly, I'm on the list, and it was an account i was banned from posting with about 2 years ago. I wish I could have deleted it.
- jrockway 16y agoFuck. What the fuck did I even need a Gawker account for? (Thanks for making this. I was going to download the torrent, but assumed that I did not ever visit their site, much less make an account. Wrong!)
- bradgessler 16y agoYou needed it if you commented on a post.
- thibaut_barrere 16y agoI went on the spreadsheet out of curiosity, only to discover my email was there as well! I didn't know Gawker == LifeHacker, on which I have commented in the past.
- ergo98 16y agoWhy did you ever trust Gawker? I don't mean "trust that they won't compromise it" (though in this case it's a salted DES password -- on the gradient of exposures, this one isn't terribly high for anything but ultra-simple dictionary tests like password), I mean "trust anyone working at or for Gawker". That's the point of these releases that really surprises me: People get paranoid because they use the same password everywhere...yet they provide every agent at every one of those places with their credentials and assume its safe.
- fellowniusmonk 16y agoThank goodness I always use mailinator for junk like that.
- ABrandt 16y agoFor some reason every md5 from this spreadsheet I try to decrypt, I get nothing. I'm using online tools like md5decrypter.com to do this. Am I missing something?
- ThePengwin 16y agoan MD5 hash is a one-way encryption, you cant reverse an MD5 hash to reveal what creates it. The quickest way to decrypt an MD5 hash is if someone calculates and stores all the possible combinations and then you look up to find them (known as rainbow tables), otherwise you just have to use brute force. Even so, the returned value could be different again, as there is only so many combinations that md5 can make (although for something as long as a password or email address, thats highly unlikely). md5decrypter would just be a big database of tested strings and their MD5 hash,
- aneesh 16y agomd5 is a hash function, and hash functions are designed to have two properties: 1) they are hiding. You (theoretically) can't reverse the function by any method other than brute-force. 2) they are *binding. You (theoretically) can't find any other input that hashes to the same output by any method other than brute-force. Any tool that "decrypts" md5 hashes most likely does so by generating what is called a rainbow table -- a giant list of many possible inputs, and the hashes they generate. If you look at the spreadsheet and find a hash from your rainbow table, voila, you know what it came from. To make it harder to use rainbow tables, any security-conscious site will "salt" the passwords before hashing them, by adding a random string prefix. The point is for the random "salt" to be different for each password you are hashing, so a standard (unsalted) rainbow table won't work, and further, the same rainbow table won't work for every password. (md5 itself has been shown to be vulnerable to collision attacks, which is why I said "theoretically")
- ABrandt 16y agoOkay thank you for the explanation. Let me try and apply my rudimentary knowledge here... So a hash function is used to encrypt data by translating it with a certain rule set--I've learned about a simple key%b type function before. But with md5 this hashing function isn't the same each time a new code is created? How is the system able to decode it then? _Something_ out there has to know how to translate that back into a readable string right? And collision is when different strings end up with the same encrypted code (except if you use a hash chain structure). So how is this used in an attack? Sorry for all the questions. I know I could probably google this but I always learn better through instruction. Thanks!
- mahmud 16y agoWarning: logging into any of the compromised Gawker accounts might result in exposure to the inane life details of a Gawker reader!
- franze 16y agothx, great tool, mine was part of the leak .... i commented once about a year ago .....
- il 16y agoIf your email is in that list, expect it to get spammed heavily in the coming days. While it's nice of random social whatever startup hint.io to warn people that their password is compromised, linking to their landing page multiple times in the email makes me think they have ulterior motives.
- mjs 16y agoWhat's the point of these tools that let you know whether Gawker's database held my email address? It's no secret that I have a Gawker account, and a Twitter account, and a Facebook account... What I would like to know is how likely it is that my password could be compromised. How were the passwords stored? Hashed? Salted and hashed?
- brown9-2 16y agoBecause some of us don't remember if we have an account on the site and might not be able to download a ~500mb torrent to verify if we do/did.
- visakhcr 16y agoJust go to Gawker site and try the link "Forgot Password". If your email is not registered with Gawker, it will tell you the same.
- brown9-2 16y agoThis sounds like a bad idea if the site is still comprimised.
- mjs 16y agoIf you do have an account but your password is not a dictionary word and it's been hashed and salted, do you care?
- cjdavis 16y agoIt is very, very easy. The first 8 characters of your password were hashed using DES without a salt. Your cell phone has enough CPU to crack them all.
- patrickgzill 16y agoI have to say I am underwhelmed by the speed of browing this table.
- ja27 16y agoI got a "We've detected unusual activity on your account" lockout on my Gmail account this morning. Since I can't find anything suspicious on the account I assume it's just bots hammering away, trying the Gawker password and other guesses. Anyone else get that?
- Danny72 16y agoI had that as well. No strange IP addresses are listed as having accessed it, so I assume it's safe.
- kra 16y agohttp://www.didigetgawkered.com/ http://www.didigetgawkered.com/