4 ms·

5M Gmail passwords leaked to Russian Bitcoin forum

56 points by gokhan 12y ago

marksamman 12y ago
https://news.ycombinator.com/item?id=8295102 https://news.ycombinator.com/item?id=8295102
- r721 12y ago
  Flagged out of front page though.
  - pmalynin 12y ago
    Huh, I wonder why. Because it seems my submission is being penalized for being submitted hours before it hit the general media.
    - r721 12y ago
      There are a few reasons: http://www.righto.com/2013/11/how-hacker-news-ranking-really-works.html http://www.righto.com/2013/11/how-hacker-news-ranking-really... I think it's the relation between upvotes/comments and also maybe many were upvoting from the submission page (which triggers vote ring detection or something, read about that somewhere)
freehunter 12y ago
Definitely not Gmail passwords, or at least not passwords leaked from Google themselves. I have an account on there that I only use for spam and signing up for sites that require an email address, but it lists a junk password that has never been used with that account on Google itself. It's been used with that email address on many sites, but not Google. It seems this list is either curated to only include Gmail address scraped from some other site or they tried combining an email and a passwords list together.
- levesque 12y ago
  Checked on the linked website (https://isleaked.com/en.php https://isleaked.com/en.php) for my junk gmail account. It didn't have the right first letters for my gmail password, but it is a match for some forums I've been using. Perhaps this is where the info comes from?
- wlesieutre 12y ago
  Agreed, the password it has for me is not my Gmail password, but one that I've used to sign up for various junk accounts using the email address.
- jacquesm 12y ago
  The problem with such lists is that plenty of people will use the same password they used on website 'x' with their gmail account. So don't be surprised if a whole pile of these actually will work with the listed gmail address.
  - pyre 12y ago
    Right, but there is a least a chance that the email:password combos are wrong, even if the email is valid.
- pscsbs 12y ago
  Me too. My password is in the dataset, but it's one I've never used with my Google account. It's my "low-security" password that I use on sites that I don't really care about.
philliescurt 12y ago
i found an address i use but the password they have listed has not been valid for over two years
switch33 12y ago
WARNING: This is probably fake and a scam. If you ctrl + f you are giving away your account name to the site which can be done with some simple javascript. There was a talk about that a while back. And the username can then be used for a bruteforce attack. News companies need to stop being so dumb and reporting on these fake hacks.
afreak 12y ago
https://canary.pw/view/?item=13221ab1721254808546bd068b6cd475 https://canary.pw/view/?item=13221ab1721254808546bd068b6cd47... https://canary.pw/view/?item=1bc5b34811b50f3fbce06cb550883727 https://canary.pw/view/?item=1bc5b34811b50f3fbce06cb55088372... https://canary.pw/view/?item=87ecceaf19b0187e901e15c5bc8f8a9d https://canary.pw/view/?item=87ecceaf19b0187e901e15c5bc8f8a9... Canary is still chewing through the dataset I fed it and figuring out where they all relate (if at all), but so far it seems that some of the data is as old as January 2014. This is likely not from Gmail itself but perhaps a collection of other leaks.
- afreak 12y ago
  https://pay.reddit.com/r/netsec/comments/2fz13q/5_millions_of_gmail_passwords_leaked_rus_most/cke79db https://pay.reddit.com/r/netsec/comments/2fz13q/5_millions_o... A good backgrounder too.
  - _puk 12y ago
    Interestingly I have one hit for my gmail on isleaked. Looking at that link I see freebiejeebies, which if I check in keepass I created an account for in 2008 with a unique password (as I tended to back then, even for throwaways). Sure enough the first two characters match that reported by isleaked (Though case doesn't match..) Having gone through the majority of the other entries in keepass, that is the only password starting with the two reported characters. So can safely say freebiejeebies was compromised at some point. Now to work out why I'd have an account on there in the first place ;)
heliumcraft 12y ago
wouldn't the passwords be hashed? or are these passwords captured through other means like trojans?
- UberB 12y ago
  According to the article, they never managed to hack into Google's database. This just looks like a large accumulation of user info from phishing.
autism_hurts 12y ago
Anybody have the raw data?
- r721 12y ago
  Look at dead comments in other submission.
deleted 12y ago
[deleted]
smmnyc 12y ago
The account I found on this list was captured in the adobe.com breach (http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html http://blogs.adobe.com/conversations/2013/10/important-custo...)
aroch 12y ago
One of my throwaway gmail's is in the leak, the password matches the password I gave at devicescape.com

56 points by gokhan 12y ago

marksamman 12y ago

https://news.ycombinator.com/item?id=8295102 https://news.ycombinator.com/item?id=8295102

r721 12y ago
Flagged out of front page though.
- pmalynin 12y ago
  Huh, I wonder why. Because it seems my submission is being penalized for being submitted hours before it hit the general media.
  - r721 12y ago
    There are a few reasons: http://www.righto.com/2013/11/how-hacker-news-ranking-really-works.html http://www.righto.com/2013/11/how-hacker-news-ranking-really... I think it's the relation between upvotes/comments and also maybe many were upvoting from the submission page (which triggers vote ring detection or something, read about that somewhere)

freehunter 12y ago

Definitely not Gmail passwords, or at least not passwords leaked from Google themselves. I have an account on there that I only use for spam and signing up for sites that require an email address, but it lists a junk password that has never been used with that account on Google itself. It's been used with that email address on many sites, but not Google. It seems this list is either curated to only include Gmail address scraped from some other site or they tried combining an email and a passwords list together.

levesque 12y ago
Checked on the linked website (https://isleaked.com/en.php https://isleaked.com/en.php) for my junk gmail account. It didn't have the right first letters for my gmail password, but it is a match for some forums I've been using. Perhaps this is where the info comes from?
wlesieutre 12y ago
Agreed, the password it has for me is not my Gmail password, but one that I've used to sign up for various junk accounts using the email address.
jacquesm 12y ago
The problem with such lists is that plenty of people will use the same password they used on website 'x' with their gmail account. So don't be surprised if a whole pile of these actually will work with the listed gmail address.
- pyre 12y ago
  Right, but there is a least a chance that the email:password combos are wrong, even if the email is valid.
pscsbs 12y ago
Me too. My password is in the dataset, but it's one I've never used with my Google account. It's my "low-security" password that I use on sites that I don't really care about.

philliescurt 12y ago

i found an address i use but the password they have listed has not been valid for over two years

switch33 12y ago

WARNING: This is probably fake and a scam. If you ctrl + f you are giving away your account name to the site which can be done with some simple javascript. There was a talk about that a while back. And the username can then be used for a bruteforce attack. News companies need to stop being so dumb and reporting on these fake hacks.

afreak 12y ago

https://canary.pw/view/?item=13221ab1721254808546bd068b6cd475 https://canary.pw/view/?item=13221ab1721254808546bd068b6cd47... https://canary.pw/view/?item=1bc5b34811b50f3fbce06cb550883727 https://canary.pw/view/?item=1bc5b34811b50f3fbce06cb55088372... https://canary.pw/view/?item=87ecceaf19b0187e901e15c5bc8f8a9d https://canary.pw/view/?item=87ecceaf19b0187e901e15c5bc8f8a9... Canary is still chewing through the dataset I fed it and figuring out where they all relate (if at all), but so far it seems that some of the data is as old as January 2014. This is likely not from Gmail itself but perhaps a collection of other leaks.

afreak 12y ago
https://pay.reddit.com/r/netsec/comments/2fz13q/5_millions_of_gmail_passwords_leaked_rus_most/cke79db https://pay.reddit.com/r/netsec/comments/2fz13q/5_millions_o... A good backgrounder too.
- _puk 12y ago
  Interestingly I have one hit for my gmail on isleaked. Looking at that link I see freebiejeebies, which if I check in keepass I created an account for in 2008 with a unique password (as I tended to back then, even for throwaways). Sure enough the first two characters match that reported by isleaked (Though case doesn't match..) Having gone through the majority of the other entries in keepass, that is the only password starting with the two reported characters. So can safely say freebiejeebies was compromised at some point. Now to work out why I'd have an account on there in the first place ;)

heliumcraft 12y ago

wouldn't the passwords be hashed? or are these passwords captured through other means like trojans?

UberB 12y ago
According to the article, they never managed to hack into Google's database. This just looks like a large accumulation of user info from phishing.

autism_hurts 12y ago

Anybody have the raw data?

r721 12y ago
Look at dead comments in other submission.

deleted 12y ago

[deleted]

smmnyc 12y ago

The account I found on this list was captured in the adobe.com breach (http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html http://blogs.adobe.com/conversations/2013/10/important-custo...)

aroch 12y ago

One of my throwaway gmail's is in the leak, the password matches the password I gave at devicescape.com