11 ms·

Alleged leak of more than 5M Gmail accounts

158 points by pmalynin 12y ago

Vanayad 12y ago
The webpage gave the correct first two letters of my password...but that was changed more than a year and half ago, so this leak must be VERY old. I have been using last pass for the past time and when I got it I immediately changed my google password. This is the reason why I'm saying is that old.
laacz 12y ago
This leak is more likely a result of phishing attacks. So, if you have been (and still are) careful enough, your email should not be on that list.
bagels 12y ago
Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it. I generally don't bother, because it's just more security risks.
- crummy 12y ago
  "If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."
  - the_af 12y ago
    Only up to 3 characters? Why 3? Especially since it's an email address and not a random string, which limits the possibilities for the 3 missing characters. This looks like it's giving more info than you'd think to a dodgy website...
    - khc 12y ago
      maybe because they want to limit the search time?
- joeblau 12y ago
  Exactly. just show me the list and let me do a command+f. I'm not trying to enter my email into their system.
  - deleted 12y ago
    [deleted]
  - durrrrrrr 12y ago
    Are you being serious? Next time you search google, would you rather they display 5,000,000 results on one page and you Ctrl+F the response?
    - polarix 12y ago
      If the local client could handle it, this would be a much more secure way of browsing.
      - mlatu 12y ago
        i sure hope you are beeing sarcastic, if not, consider this: it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly. http://arstechnica.com/security/2012/12/how-script-kiddies-can-hijack-your-browser-to-steal-your-password/ http://arstechnica.com/security/2012/12/how-script-kiddies-c...
    - bostik 12y ago
      Wget and grep would be more likely to be used - but in answer to your question: yes, in a case like this. Let's do some quick back-of-the-envelope math. 5M addresses, with very few longer than 25 characters. Let's say the average is around 17 characters. 17 * 5 * 10^6 = 35 * 10 ^7 = 3.5 * 10^8 bytes, or 350MB. Text generally compresses to 1/8 space with zlib, so the amount to transfer would be about 44MB, at most. Serving the list as xz compressed file could probably cut the size down to below 40MB. In the age of 100MB youtube videos, that doesn't sound like much to me.
- FatalLogic 12y ago
  It could be even more dangerous than you are imagining. If you check a username, then you would probably also be revealing the IP address range and browser referrer that is normally used to access your account. Google uses IP address and location to help detect illegal access. So giving away this information could make it easier for your account to be stolen.
  - emeidi 12y ago
    How? Is the hacker going to buy a plane ticket, fly to my home and plug his laptop into my network?
    - FatalLogic 12y ago
      Of course not. He's going to go botnet shopping and try to log in through a compromised machine with an IP address in the same town, in the same address range. He might even be able to use the same IP as you, if you happen to be using a gateway with many machines behind it, and one of them is compromised.
- kostko 12y ago
  Give me your email, and I'll check for you. I won't do anything, I promise. Joking aside, I downloaded the list and my email is not listed. Phew...
  - dredmorbius 12y ago
    I also checked a few of those near and dear to me. Should probably try my full address list...
- VikingCoder 12y ago
  ...or that when you log on to the site, the site would tell you that your account was in the list.
- rodrigorega 12y ago
  To avoid this, I made this script to check if my email addresses are in a leak list: https://github.com/rodrigorega/wordlist_compare https://github.com/rodrigorega/wordlist_compare
  - mlatu 12y ago
    nice.. i'll use grep instead, thanks for the effort though
rdjik 12y ago
It's nowhere near advisable for anyone to submit their address to that box. Notwithstanding the questionable reliability of this what is meant by "leaked"? a trove of phished credentials does not really qualify as a "leak".
- lucaspiller 12y ago
  I just tried it with my old Gmail account that I no longer use, and it displayed the first two letters of my password. The password was random letters and numbers, 16 characters, so not easily guessable. Seems legit to me :-)
- nness 12y ago
  "If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."
ecma 12y ago
On August 20 an address of mine was entered and my Origin account was subsequently compromised. Looks like this leak matches the creds that account had before I reacted. Happily enough it was a low equity account, I had 2FA and nothing else seems to have been grabbed. Edit: to clarify, I had 2FA on an account which alerted me to the Gmail compromise. I obviously messed up with that email account.
ars 12y ago
I used the wildcard and mine is not in it. So I don't think this is a hack of google itself, but rather just collecting addresses from elsewhere and collecting the gmail ones.
deleted 12y ago
[deleted]
vocket 12y ago
I tried it and it gave me a year old password. I am guessing they only got a hold of old passwords.
tonymon 12y ago
Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails
- thaumaturgy 12y ago
  I bet there are some people who have other leaked account & password lists, and since the isleaked.com site is kind enough to give the first two characters of the password for any given email account, it'd probably be possible to guess the passwords for some of those accounts.
  - psykovsky 12y ago
    Am I blind? I only see if there is a match, no password initial letters at all ??? EDIT: Not blind, it just doesn't show the initial letters if you search using a wildcard even if there is only 1 match.
- mct 12y ago
  Interestingly, there are a large number of non-gmail.com addresses in there, including 123k yandex.ru addresses, plus a (very) small number of yahoo.com and hotmail.com addresses. Here's the output of "cut -d@ -f2 | sort | uniq -c | sort -nr": https://gist.github.com/anonymous/255959493c0a26cce856 https://gist.github.com/anonymous/255959493c0a26cce856 The data hasn't been very well edited from whatever dump it came from. For example, there are lines that end in "gmail.com_xtube", "gmail.com7777", "gmail.com|login", etc, which are curious.
- unicornporn 12y ago
  OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...
  - 12y ago
curiousDog 12y ago
It says mine is in it but suggests the wrong password. I don't think I even had a password with those letters plus I've had 2FA for a while now. Wonder how legit this is.
fnayr 12y ago
My older account (8+ years) was leaked but my more recent one (4+ years) was not. EDIT: This was good to find out because I did not have 2 factor auth on my older account as I hardly use it anymore.
Sommer717 12y ago
Weird, it gives me a very old password. Though back when I had that password my account was hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.
- deleted 12y ago
  [deleted]
- caractacus 12y ago
  Me too. It gives the first two letters of a pw that I have used in the past but as far as I'm aware, not on that account. This raises all kinds of questions... Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.
- INTPenis 12y ago
  I can also verify this. One of my gmail accounts was in there, incidentally the "trash account" I use when I sign up for various services online. And the password was one of my lowest security "trash passwords" I use with this e-mail as login sometimes if it's a service I wouldn't trust or don't care if it's compromised. So I wouldn't worry about this. Someone had their site hacked most likely and these are logins to the site, not from Google.
minusSeven 12y ago
can anyone talk about how this site works and where they get the list of leaked email address from ?
hotmilo23 12y ago
Tried it with mine and it said yes but had the password wrong. It didn't match a password I've ever used...
tectonic 12y ago
It's suggesting a password that I do use on some sites, but never have on Gmail. I think this is a scraped database from somewhere else...
- zwischenzug 12y ago
  Same for me.
hmottestad 12y ago
My Gmail was hacked a few years ago. This database showed the first two letters of the password I had at the time. I had (stupidly) been using the same password on other sites, so after I was hacked i made a new password just for gmail. Now I also have two factor authentication :)
- deleted 12y ago
  [deleted]
hayksaakian 12y ago
checked the plain text list against against 20 of my contacts, and nothing matched
gotothrowaway 12y ago
For me, it has a password I don't ever recall using with gmail. If I have, I don't think it's been in the past few years. That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.
- chippy 12y ago
  but matched up with your email... and many people don't have throwaways
mcoliver 12y ago
Interestingly enough fuck@gmail.com is an email address.....grepping the email list txt file is ahhhmazing
Fede_V 12y ago
I just checked using a bunch of throwaway email accounts I had to sign up for various promotions. One of them was leaked - and one of them had a very old password associated with it. I now use KeePass2 to manage all my passwords - so the old password has absolutely nothing to do with the new one. This makes me think that they simply tried to use some other hacked site, and checked to see whether the same pwd was recycled for gmail.
cornewut 12y ago
I don't think this is leaked from Google. Probably people just were using the same password for some other service...
sinak 12y ago
Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ https://www.google.com/landing/2step/ - Github: https://github.com/settings/security https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/account/security https://www.dropbox.com/account/security - Lastpass: http://helpdesk.lastpass.com/security-options/google-authenticator/ http://helpdesk.lastpass.com/security-options/google-authent... - More: https://twofactorauth.org/ https://twofactorauth.org/
- unknownBits 12y ago
  With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
  - doubt_me 12y ago
    https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en https://play.google.com/store/apps/details?id=com.google.and...
    - kolev 12y ago
      This is much better: https://play.google.com/store/apps/details?id=com.authy.authy https://play.google.com/store/apps/details?id=com.authy.auth...
      - Aissen 12y ago
        This is much better: https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp https://play.google.com/store/apps/details?id=org.fedorahost... Open source fork of the (now closed source) Google Authenticator.
x3sphere 12y ago
The passwords seem to have come from somewhere else. My email is on the list, but the password is wrong and actually matches the one I use for throwaway accounts.
- maxerickson 12y ago
  There seem to be enough people reporting this to do some correlation and figure out what was really compromised.
myrandomcomment 12y ago
So my wife's is in there but the password it gives is from over a year ago.
cornewut 12y ago
Quite a few of the leaked accounts also appear to be using SoundCloud. Could this be related?
j0hnskot 12y ago
It says mine is leaked too. But the two first digits of my password it gives me are not relevant with my password. What does this mean?
turtles 12y ago
Where the passwords at? Would make a good common passwords list for security testing. EDIT: Not seeing the password list online, and below someone mentioned it showed an old password for them, so thinking someone is making this up.
tapsboy 12y ago
I just tried it with an old account. It correctly gave out the first two letters of existing password Luckily, 2FA was already enabled.
aquadrop 12y ago
It has passwords collected from other sites, at least from heroesofnewerth.com That's one more example against password reusing.
Vincez 12y ago
Sites should stop storing plain text password
Intermernet 12y ago
I can tell from the first 2 characters that the leaked password associated with my email address was scraped from Pizza Hut Australia's online ordering system (they only recently implemented SSL on the login page). It's interesting that I setup a particular password for that service when I noticed it didn't use SSL. Make's me wonder how many databases this comes from. It certainly isn't Google's.
- deleted 12y ago
  [deleted]
- junto 12y ago
  Out of interest, do you know from your data as to when your Pizza Hut Australia account could have been compromised? Was it a plus addressing yourname+pizzhut@yourdomain.com type email address? Would be interested to know more about this. I'm @junto on Twitter if you don't mind contacting me. It would be appreciated.
  - Intermernet 12y ago
    Hi, No I assume that the breach happened in the last 3 years, and before they implemented SSL. I have noticed that http://www.pizzahut.com.au/members/login http://www.pizzahut.com.au/members/login is still a valid page, inaccessible via SSL, but haven't checked if logging in on that page actually works. I noticed that they've also implemented a password reset email, instead of their previous practice of just emailing you the password. Hopefully this means that they are no longer keeping unhashed passwords on the system. It seems that they realised they weren't doing things correctly in the last 6 months (maybe a bit longer, not 100% sure) and have taken steps to rectify this. This may be due to a discovered security breach, but may just be a change in their internal IT policy. Hopefully they're now following best practices!
joshka 12y ago
grep admin google_5000000.txt -c 1019 sigh
deleted 12y ago
[deleted]
NaNaN 12y ago
A summary about phishing: 1. Found you password with the same email address somewhere and ask if you still use that email address on another site. 2. And get your IP, then login through proxy to bypass the security checking. 3. Still, to know which email address is in use. If you just worry, change you password right now without using their service. :P It may be good that every a few months some guys remind you to change passwords.
- broolstoryco 12y ago
  Exactly what proxy would allow to appear to be using my IP address?
  - netrus 12y ago
    For many security checks, a proxy in the same country would be sufficient. They might only check if you log in from Asia and America at the same time.
deleted 12y ago
[deleted]
noyesno 12y ago
Interesting, the password associated to a secondary Gmail account of mine turned out to be not for Gmail login but for a Friendster.com account from years back that used it as user ID.
broolstoryco 12y ago
I found my email there, but the first two letters are of a password that I have never used with gmail (it is a disposable password i use for uniportant sites)
nmjohn 12y ago
The full list was leaked, my email was on it but I've never used that password for an email account in my life. It's my throwaway "I don't trust this website" password. I use it for a reason!
kaoD 12y ago
My account was compromised a couple months ago. Google detected a series of logins from Poland, Lithuania and Oregon (probably botnets, which I think it rejected) and sent me a warning. I expected my address to be there but it wasn't. Makes me wonder.
onestone 12y ago
It isn't the actual Gmail passwords that are leaked. One of my accounts is there, but the password is one I have used on other sites, never on the actual Gmail account.
- ndr 12y ago
  Can you disclose which site?
  - onestone 12y ago
    Can't be sure, it's a "garbage sites" password which I've used too many times on untrusted sites. Any one of those sites could have been hacked, or had been a phishing gateway itself. Of course what I did was bad practice. One should store passwords in a secure password manager, and use a different (preferably 30+ chars) password on each site.
    - dredmorbius 12y ago
      My present "garbage site" practice is to pop open a session to mailinator.com to a randomly generated box name. Mailinator will give an alternate address that's a hash of the first, so that the address itself cannot be used to check. See below. I'll create a set of long passwords (20-30 characters) with pwgen. Those are input as name, email, and password fields (different for each). If I need to verify an email, I can. I don't record the values, they're throwaway. If the site rejects 'mailinator.com', there are other domains provided as alternates. Example: inache8baezo0aowahph@mailinator.com is also m8r-ds4te4@mailinator.com inache8baezo0aowahph@mailinator.com inache8baezo0aowahph@mailtothis.com (or m8r-ds4te4 at the other domains) The 'm8r' address can't be used to check for mail. Note, obviously, that anyone with the actual mailbox hash can check it. For example: http://mailinator.com/inbox.jsp?to=facebook http://mailinator.com/inbox.jsp?to=facebook Oh, there's even an RSS mailbox subscription, neat: http://www.mailinator.com/feed?to= http://www.mailinator.com/feed?to=
  - rasz_pl 12y ago
    it has my ancient password from ~2008 for http://login.aeriagames.com/user http://login.aeriagames.com/user That company went under 4-5 years ago, and I seem to remember few forum (phpbb afaik) software/database breaches at the time.
ganessh 12y ago
My email address was there but "your first two symbols" listed there was wrong. Is that first two symbols hash of my password?
- kibibu 12y ago
  Based on the two letters of mine, I have a feeling that it's from a BB forum crawl or similar.
Sarkie 12y ago
It has a password for another site but not gmail. Not sure which, but it isn't gmail.
marksamman 12y ago
If you search for the character '+' in the list of e-mails you can get an idea where the mails leaked from. It seems to me like this is a collection of databases scraped from different sources as others have suggested. For Gmail users, it's a good practice to register to websites using username+websitename@gmail.com (e.g. mark.samman+hackernews@gmail.com), that way you'll know who leaked your data when it appears in lists like this or when you get spam. Gmail ignores the plus character and anything that follows the plus. You can also add dots at arbitrary positions in the username part.
- unbelievr 12y ago
  Going with your suggestion, the amount of DBs must be huge. The most prominent additions after the + sign (ignoring just single numbers) are: - Bioware (54) - Bravenet (19) - Bryce/daz3d/daz (244) - Eharmony (64) - Filedropper/fd/etc. (113) - Freebie/Freebiejeebies (64) - Friendster (65) - Hon (42) - Policeauctions (28) - Savage/Savage2 (116) - Xtube/porn (200ish)
- netrus 12y ago
  On the other hand, this will reveal to anyone you have a HN/NRA/porn account in case of a leak ;)
- archenemy 12y ago
  I have always wondered what use is this with regards to spam and sneaky address lists. What exactly prevents someone from cleaning up the addresses before letting them out? If I were a bad behaved site and sell (sold? sorry, tired and non native speaker) my userlist, i'd probably remove all plus-suffixes from the addresses. Same as if I were a blackhat stealing them to be sold. Honest question, no snark.
gmailleak 12y ago
Full list with passwords: sendfile.su/1020941
JasuM 12y ago
I was on the list and now I got a Facebook password reset code to my phone, without asking for one. Someone already seems to be trying to use the passwords.
Grue3 12y ago
My email is on there, but the password is not the one I'm currently using. Though I wonder which site or sites I've been using this password on. Has anyone figured it out? I'm going to crosscheck with my saved passwords list in Firefox when I get home.
deleted 12y ago
[deleted]
cordite 12y ago
The problem with 2FA for me is that I am underground for a good part of my day, without reception. I use google voice to get notified of calls and voicemails so I can be fairly responsive, but obviously using another service that can be accessed in multiple places defeats the point, especially when owned by the same people.
- palebluedot 12y ago
  You don't need reception for 2FA; Google Authenticator and FreeOTP work fine even in airplane mode, if you have your phone / tablet with you.
  - cordite 12y ago
    Yeah, good luck on a windows phone.
    - palebluedot 12y ago
      If there is no existing offline OTP authenticator for Windows phone, FreeOTP is open-source. Perhaps someone will port it over: https://fedorahosted.org/freeotp/ https://fedorahosted.org/freeotp/
    - ZoFreX 12y ago
      Microsoft Authenticator works just fine with GMail :)
      - cordite 12y ago
        Confirmed! Though I had to go outside to get the initial pass code via SMS. It does not seem like twitter supports this authenticator.
gmailleak 12y ago
pass: ru-board
switch33 12y ago
WARNING: This is probably fake and a scam. If you ctrl + f you are giving away your account name to the site which can be done with some simple javascript. There was a talk about that a while back. And the username can then be used for a bruteforce attack. News companies need to stop being so dumb and reporting on these fake hacks.
deleted 12y ago
[deleted]
priteshjain 12y ago
Site is down right now :(
LilyOfTheValley 12y ago
Two-factor authentication looks more appealing then ever. But first go to www.gmailleak.com make sure your account was not compromised.

158 points by pmalynin 12y ago

The webpage gave the correct first two letters of my password...but that was changed more than a year and half ago, so this leak must be VERY old. I have been using last pass for the past time and when I got it I immediately changed my google password. This is the reason why I'm saying is that old.

laacz 12y ago

This leak is more likely a result of phishing attacks. So, if you have been (and still are) careful enough, your email should not be on that list.

bagels 12y ago

Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it. I generally don't bother, because it's just more security risks.

crummy 12y ago
"If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."
- the_af 12y ago
  Only up to 3 characters? Why 3? Especially since it's an email address and not a random string, which limits the possibilities for the 3 missing characters. This looks like it's giving more info than you'd think to a dodgy website...
  - khc 12y ago
    maybe because they want to limit the search time?
joeblau 12y ago
Exactly. just show me the list and let me do a command+f. I'm not trying to enter my email into their system.
- deleted 12y ago
  [deleted]
- durrrrrrr 12y ago
  Are you being serious? Next time you search google, would you rather they display 5,000,000 results on one page and you Ctrl+F the response?
  - polarix 12y ago
    If the local client could handle it, this would be a much more secure way of browsing.
    - mlatu 12y ago
      i sure hope you are beeing sarcastic, if not, consider this: it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly. http://arstechnica.com/security/2012/12/how-script-kiddies-can-hijack-your-browser-to-steal-your-password/ http://arstechnica.com/security/2012/12/how-script-kiddies-c...
  - bostik 12y ago
    Wget and grep would be more likely to be used - but in answer to your question: yes, in a case like this. Let's do some quick back-of-the-envelope math. 5M addresses, with very few longer than 25 characters. Let's say the average is around 17 characters. 17 * 5 * 10^6 = 35 * 10 ^7 = 3.5 * 10^8 bytes, or 350MB. Text generally compresses to 1/8 space with zlib, so the amount to transfer would be about 44MB, at most. Serving the list as xz compressed file could probably cut the size down to below 40MB. In the age of 100MB youtube videos, that doesn't sound like much to me.
FatalLogic 12y ago
It could be even more dangerous than you are imagining. If you check a username, then you would probably also be revealing the IP address range and browser referrer that is normally used to access your account. Google uses IP address and location to help detect illegal access. So giving away this information could make it easier for your account to be stolen.
- emeidi 12y ago
  How? Is the hacker going to buy a plane ticket, fly to my home and plug his laptop into my network?
  - FatalLogic 12y ago
    Of course not. He's going to go botnet shopping and try to log in through a compromised machine with an IP address in the same town, in the same address range. He might even be able to use the same IP as you, if you happen to be using a gateway with many machines behind it, and one of them is compromised.
kostko 12y ago
Give me your email, and I'll check for you. I won't do anything, I promise. Joking aside, I downloaded the list and my email is not listed. Phew...
- dredmorbius 12y ago
  I also checked a few of those near and dear to me. Should probably try my full address list...
VikingCoder 12y ago
...or that when you log on to the site, the site would tell you that your account was in the list.
rodrigorega 12y ago
To avoid this, I made this script to check if my email addresses are in a leak list: https://github.com/rodrigorega/wordlist_compare https://github.com/rodrigorega/wordlist_compare
- mlatu 12y ago
  nice.. i'll use grep instead, thanks for the effort though

rdjik 12y ago

It's nowhere near advisable for anyone to submit their address to that box. Notwithstanding the questionable reliability of this what is meant by "leaked"? a trove of phished credentials does not really qualify as a "leak".

lucaspiller 12y ago
I just tried it with my old Gmail account that I no longer use, and it displayed the first two letters of my password. The password was random letters and numbers, 16 characters, so not easily guessable. Seems legit to me :-)
nness 12y ago
"If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."

ecma 12y ago

On August 20 an address of mine was entered and my Origin account was subsequently compromised. Looks like this leak matches the creds that account had before I reacted. Happily enough it was a low equity account, I had 2FA and nothing else seems to have been grabbed. Edit: to clarify, I had 2FA on an account which alerted me to the Gmail compromise. I obviously messed up with that email account.

ars 12y ago

I used the wildcard and mine is not in it. So I don't think this is a hack of google itself, but rather just collecting addresses from elsewhere and collecting the gmail ones.

deleted 12y ago

[deleted]

vocket 12y ago

I tried it and it gave me a year old password. I am guessing they only got a hold of old passwords.

tonymon 12y ago

Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails

thaumaturgy 12y ago
I bet there are some people who have other leaked account & password lists, and since the isleaked.com site is kind enough to give the first two characters of the password for any given email account, it'd probably be possible to guess the passwords for some of those accounts.
- psykovsky 12y ago
  Am I blind? I only see if there is a match, no password initial letters at all ??? EDIT: Not blind, it just doesn't show the initial letters if you search using a wildcard even if there is only 1 match.
mct 12y ago
Interestingly, there are a large number of non-gmail.com addresses in there, including 123k yandex.ru addresses, plus a (very) small number of yahoo.com and hotmail.com addresses. Here's the output of "cut -d@ -f2 | sort | uniq -c | sort -nr": https://gist.github.com/anonymous/255959493c0a26cce856 https://gist.github.com/anonymous/255959493c0a26cce856 The data hasn't been very well edited from whatever dump it came from. For example, there are lines that end in "gmail.com_xtube", "gmail.com7777", "gmail.com|login", etc, which are curious.
unicornporn 12y ago
OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...
- 12y ago

curiousDog 12y ago

It says mine is in it but suggests the wrong password. I don't think I even had a password with those letters plus I've had 2FA for a while now. Wonder how legit this is.

fnayr 12y ago

My older account (8+ years) was leaked but my more recent one (4+ years) was not. EDIT: This was good to find out because I did not have 2 factor auth on my older account as I hardly use it anymore.

Sommer717 12y ago

Weird, it gives me a very old password. Though back when I had that password my account was hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.

deleted 12y ago
[deleted]
caractacus 12y ago
Me too. It gives the first two letters of a pw that I have used in the past but as far as I'm aware, not on that account. This raises all kinds of questions... Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.
INTPenis 12y ago
I can also verify this. One of my gmail accounts was in there, incidentally the "trash account" I use when I sign up for various services online. And the password was one of my lowest security "trash passwords" I use with this e-mail as login sometimes if it's a service I wouldn't trust or don't care if it's compromised. So I wouldn't worry about this. Someone had their site hacked most likely and these are logins to the site, not from Google.

minusSeven 12y ago

can anyone talk about how this site works and where they get the list of leaked email address from ?

hotmilo23 12y ago

Tried it with mine and it said yes but had the password wrong. It didn't match a password I've ever used...

tectonic 12y ago

It's suggesting a password that I do use on some sites, but never have on Gmail. I think this is a scraped database from somewhere else...

zwischenzug 12y ago
Same for me.

hmottestad 12y ago

My Gmail was hacked a few years ago. This database showed the first two letters of the password I had at the time. I had (stupidly) been using the same password on other sites, so after I was hacked i made a new password just for gmail. Now I also have two factor authentication :)

deleted 12y ago
[deleted]

hayksaakian 12y ago

checked the plain text list against against 20 of my contacts, and nothing matched

gotothrowaway 12y ago

For me, it has a password I don't ever recall using with gmail. If I have, I don't think it's been in the past few years. That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.

chippy 12y ago
but matched up with your email... and many people don't have throwaways

mcoliver 12y ago

Interestingly enough fuck@gmail.com is an email address.....grepping the email list txt file is ahhhmazing

Fede_V 12y ago

I just checked using a bunch of throwaway email accounts I had to sign up for various promotions. One of them was leaked - and one of them had a very old password associated with it. I now use KeePass2 to manage all my passwords - so the old password has absolutely nothing to do with the new one. This makes me think that they simply tried to use some other hacked site, and checked to see whether the same pwd was recycled for gmail.

cornewut 12y ago

I don't think this is leaked from Google. Probably people just were using the same password for some other service...

sinak 12y ago

Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ https://www.google.com/landing/2step/ - Github: https://github.com/settings/security https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/account/security https://www.dropbox.com/account/security - Lastpass: http://helpdesk.lastpass.com/security-options/google-authenticator/ http://helpdesk.lastpass.com/security-options/google-authent... - More: https://twofactorauth.org/ https://twofactorauth.org/

unknownBits 12y ago
With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
- doubt_me 12y ago
  https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en https://play.google.com/store/apps/details?id=com.google.and...
  - kolev 12y ago
    This is much better: https://play.google.com/store/apps/details?id=com.authy.authy https://play.google.com/store/apps/details?id=com.authy.auth...
    - Aissen 12y ago
      This is much better: https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp https://play.google.com/store/apps/details?id=org.fedorahost... Open source fork of the (now closed source) Google Authenticator.

x3sphere 12y ago

The passwords seem to have come from somewhere else. My email is on the list, but the password is wrong and actually matches the one I use for throwaway accounts.

maxerickson 12y ago
There seem to be enough people reporting this to do some correlation and figure out what was really compromised.

myrandomcomment 12y ago

So my wife's is in there but the password it gives is from over a year ago.

cornewut 12y ago

Quite a few of the leaked accounts also appear to be using SoundCloud. Could this be related?

j0hnskot 12y ago

It says mine is leaked too. But the two first digits of my password it gives me are not relevant with my password. What does this mean?

turtles 12y ago

Where the passwords at? Would make a good common passwords list for security testing. EDIT: Not seeing the password list online, and below someone mentioned it showed an old password for them, so thinking someone is making this up.

tapsboy 12y ago

I just tried it with an old account. It correctly gave out the first two letters of existing password Luckily, 2FA was already enabled.

aquadrop 12y ago

It has passwords collected from other sites, at least from heroesofnewerth.com That's one more example against password reusing.

Vincez 12y ago

Sites should stop storing plain text password

Intermernet 12y ago

I can tell from the first 2 characters that the leaked password associated with my email address was scraped from Pizza Hut Australia's online ordering system (they only recently implemented SSL on the login page). It's interesting that I setup a particular password for that service when I noticed it didn't use SSL. Make's me wonder how many databases this comes from. It certainly isn't Google's.

deleted 12y ago
[deleted]
junto 12y ago
Out of interest, do you know from your data as to when your Pizza Hut Australia account could have been compromised? Was it a plus addressing yourname+pizzhut@yourdomain.com type email address? Would be interested to know more about this. I'm @junto on Twitter if you don't mind contacting me. It would be appreciated.
- Intermernet 12y ago
  Hi, No I assume that the breach happened in the last 3 years, and before they implemented SSL. I have noticed that http://www.pizzahut.com.au/members/login http://www.pizzahut.com.au/members/login is still a valid page, inaccessible via SSL, but haven't checked if logging in on that page actually works. I noticed that they've also implemented a password reset email, instead of their previous practice of just emailing you the password. Hopefully this means that they are no longer keeping unhashed passwords on the system. It seems that they realised they weren't doing things correctly in the last 6 months (maybe a bit longer, not 100% sure) and have taken steps to rectify this. This may be due to a discovered security breach, but may just be a change in their internal IT policy. Hopefully they're now following best practices!

joshka 12y ago

grep admin google_5000000.txt -c 1019 sigh

deleted 12y ago

[deleted]

NaNaN 12y ago

A summary about phishing: 1. Found you password with the same email address somewhere and ask if you still use that email address on another site. 2. And get your IP, then login through proxy to bypass the security checking. 3. Still, to know which email address is in use. If you just worry, change you password right now without using their service. :P It may be good that every a few months some guys remind you to change passwords.

broolstoryco 12y ago
Exactly what proxy would allow to appear to be using my IP address?
- netrus 12y ago
  For many security checks, a proxy in the same country would be sufficient. They might only check if you log in from Asia and America at the same time.

deleted 12y ago

[deleted]

noyesno 12y ago

Interesting, the password associated to a secondary Gmail account of mine turned out to be not for Gmail login but for a Friendster.com account from years back that used it as user ID.

broolstoryco 12y ago

I found my email there, but the first two letters are of a password that I have never used with gmail (it is a disposable password i use for uniportant sites)

nmjohn 12y ago

The full list was leaked, my email was on it but I've never used that password for an email account in my life. It's my throwaway "I don't trust this website" password. I use it for a reason!

kaoD 12y ago

My account was compromised a couple months ago. Google detected a series of logins from Poland, Lithuania and Oregon (probably botnets, which I think it rejected) and sent me a warning. I expected my address to be there but it wasn't. Makes me wonder.

onestone 12y ago

It isn't the actual Gmail passwords that are leaked. One of my accounts is there, but the password is one I have used on other sites, never on the actual Gmail account.

ndr 12y ago
Can you disclose which site?
- onestone 12y ago
  Can't be sure, it's a "garbage sites" password which I've used too many times on untrusted sites. Any one of those sites could have been hacked, or had been a phishing gateway itself. Of course what I did was bad practice. One should store passwords in a secure password manager, and use a different (preferably 30+ chars) password on each site.
  - dredmorbius 12y ago
    My present "garbage site" practice is to pop open a session to mailinator.com to a randomly generated box name. Mailinator will give an alternate address that's a hash of the first, so that the address itself cannot be used to check. See below. I'll create a set of long passwords (20-30 characters) with pwgen. Those are input as name, email, and password fields (different for each). If I need to verify an email, I can. I don't record the values, they're throwaway. If the site rejects 'mailinator.com', there are other domains provided as alternates. Example: inache8baezo0aowahph@mailinator.com is also m8r-ds4te4@mailinator.com inache8baezo0aowahph@mailinator.com inache8baezo0aowahph@mailtothis.com (or m8r-ds4te4 at the other domains) The 'm8r' address can't be used to check for mail. Note, obviously, that anyone with the actual mailbox hash can check it. For example: http://mailinator.com/inbox.jsp?to=facebook http://mailinator.com/inbox.jsp?to=facebook Oh, there's even an RSS mailbox subscription, neat: http://www.mailinator.com/feed?to= http://www.mailinator.com/feed?to=
- rasz_pl 12y ago
  it has my ancient password from ~2008 for http://login.aeriagames.com/user http://login.aeriagames.com/user That company went under 4-5 years ago, and I seem to remember few forum (phpbb afaik) software/database breaches at the time.

ganessh 12y ago

My email address was there but "your first two symbols" listed there was wrong. Is that first two symbols hash of my password?

kibibu 12y ago
Based on the two letters of mine, I have a feeling that it's from a BB forum crawl or similar.

Sarkie 12y ago

It has a password for another site but not gmail. Not sure which, but it isn't gmail.

marksamman 12y ago

If you search for the character '+' in the list of e-mails you can get an idea where the mails leaked from. It seems to me like this is a collection of databases scraped from different sources as others have suggested. For Gmail users, it's a good practice to register to websites using username+websitename@gmail.com (e.g. mark.samman+hackernews@gmail.com), that way you'll know who leaked your data when it appears in lists like this or when you get spam. Gmail ignores the plus character and anything that follows the plus. You can also add dots at arbitrary positions in the username part.

unbelievr 12y ago
Going with your suggestion, the amount of DBs must be huge. The most prominent additions after the + sign (ignoring just single numbers) are: - Bioware (54) - Bravenet (19) - Bryce/daz3d/daz (244) - Eharmony (64) - Filedropper/fd/etc. (113) - Freebie/Freebiejeebies (64) - Friendster (65) - Hon (42) - Policeauctions (28) - Savage/Savage2 (116) - Xtube/porn (200ish)
netrus 12y ago
On the other hand, this will reveal to anyone you have a HN/NRA/porn account in case of a leak ;)
archenemy 12y ago
I have always wondered what use is this with regards to spam and sneaky address lists. What exactly prevents someone from cleaning up the addresses before letting them out? If I were a bad behaved site and sell (sold? sorry, tired and non native speaker) my userlist, i'd probably remove all plus-suffixes from the addresses. Same as if I were a blackhat stealing them to be sold. Honest question, no snark.

gmailleak 12y ago

Full list with passwords: sendfile.su/1020941

JasuM 12y ago

I was on the list and now I got a Facebook password reset code to my phone, without asking for one. Someone already seems to be trying to use the passwords.

Grue3 12y ago

My email is on there, but the password is not the one I'm currently using. Though I wonder which site or sites I've been using this password on. Has anyone figured it out? I'm going to crosscheck with my saved passwords list in Firefox when I get home.

deleted 12y ago

[deleted]

cordite 12y ago

The problem with 2FA for me is that I am underground for a good part of my day, without reception. I use google voice to get notified of calls and voicemails so I can be fairly responsive, but obviously using another service that can be accessed in multiple places defeats the point, especially when owned by the same people.

palebluedot 12y ago
You don't need reception for 2FA; Google Authenticator and FreeOTP work fine even in airplane mode, if you have your phone / tablet with you.
- cordite 12y ago
  Yeah, good luck on a windows phone.
  - palebluedot 12y ago
    If there is no existing offline OTP authenticator for Windows phone, FreeOTP is open-source. Perhaps someone will port it over: https://fedorahosted.org/freeotp/ https://fedorahosted.org/freeotp/
  - ZoFreX 12y ago
    Microsoft Authenticator works just fine with GMail :)
    - cordite 12y ago
      Confirmed! Though I had to go outside to get the initial pass code via SMS. It does not seem like twitter supports this authenticator.

gmailleak 12y ago

pass: ru-board

switch33 12y ago

WARNING: This is probably fake and a scam. If you ctrl + f you are giving away your account name to the site which can be done with some simple javascript. There was a talk about that a while back. And the username can then be used for a bruteforce attack. News companies need to stop being so dumb and reporting on these fake hacks.

deleted 12y ago

[deleted]

priteshjain 12y ago

Site is down right now :(

LilyOfTheValley 12y ago

Two-factor authentication looks more appealing then ever. But first go to www.gmailleak.com make sure your account was not compromised.