4 ms·

Was your Gmail compromised in yesterday's attack?

17 points by xiunhao888 12y ago

adlpz 12y ago
The obvious question: is this site to be trusted?
- rtkwe 12y ago
  Not sure. It said my email was in the leak but the "First two symbols of password is: " is from one of my old passwords I don't use any more, don't know when I changed it away from that old password. If you're more concerned about spam it's your gmail address which is probably already getting loads of spam you don't notice because gmail's filters are excellent.
adamfeldman 12y ago
Why would you put your gmail address into a random website? Google, being Google, has already taken care of this: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up-after-password-dumps.html http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up... You should also already have two-factor authentication setup, so you shouldn't have anything to worry about: https://support.google.com/accounts/answer/180744?hl=en https://support.google.com/accounts/answer/180744?hl=en
- deleted 12y ago
  [deleted]
- malvosenior 12y ago
  Says my account was hacked, but then gives me the incorrect two letters for the start of my password. Seems bunk. Also, why wouldn't you give your email address to a random website? I have it plastered all over the net. Spam is a solved problem at this point. Ironically thanks to Gmail! Agree on 2 factor auth though.
  - omh 12y ago
    Says my account was hacked, but then gives me the incorrect two letters for the start of my password Out of interest - are those two letters the start of a password from any other site? Presumably the leak came from a third party site so it would be your password from there rather than your gmail password.
    - malvosenior 12y ago
      Nope, I have a throwaway I normally use but this isn't it. Not sure what this is coming from, but I don't recall any passwords that start with these two characters.
    - stultus 12y ago
      for me it shows first two letters of the email itself. I might have used the username itself as a password in some random site, but this is/was not my gmail password :)
  - nmjohn 12y ago
    The passwords didn't come from google. It was someplace you used your email with that password. It had a couple of my emails all with the same throwaway password I only use on sites that I either don't trust or have no intention of ever using again. If you search around the full leak is very easy to find
  - SloopJon 12y ago
    Most of the stories about this list have pointed out that it doesn't necessarily contain passwords from Gmail, but from various accounts that used a Gmail address as a username. Someone on Slashdot searched for "+" suffixes in the list, as in username+suffix@gmail.com: http://tech.slashdot.org/comments.pl?sid=5680529&cid=47874217 http://tech.slashdot.org/comments.pl?sid=5680529&cid=4787421... Some of the most popular suffixes were xtube, daz (and daz3d), filedropper, and eharmony. The two characters returned by isleaked.com for my address could indeed have been from daz3d.com.
christiangenco 12y ago
I usually never enter any personal information in sites like these, but this clause won me over: > If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy.
mparramon 12y ago
Mine was, but the password there is more than 4 years old, I have changed it several times since then. Makes me think that this leak is just a collection of old leaks out together.
- socialist_coder 12y ago
  Same. Super old password.
- celticninja 12y ago
  this is exactly what has happened, someone pulled together a load of data from hacks and leaks and made one file. the data in general appears to be years out of date, of course some people may still have the same password and may have reused credentials for other sites.
woodylondon 12y ago
FYI > I checked all my accounts and one was leaked. HOWEVER, it was the password I used when I first setup the account in 2004, and has been changed many times since.
kolev 12y ago
I think a lot more emails leaked due to people putting their full email to check than during the leak, although the service says people can use a search pattern, but who'd bother, right? People, it's inconvenient, I know, I know, but, please, start using 2FA! At last! I thought a lot of people who are not technical, Authy is a better tool, so, please, spread the awareness, and let's put this nonsense to an end!
nkozyra 12y ago
I'm always slightly offended when my email address isn't in these things.
BillFranklin 12y ago
There are a few websites like this with varying reliability (either haven't been updated recently or have inferred the worst-case-scenario from hacks). This is the first time I've seen this one. You could also check out these: https://haveibeenpwned.com/ https://haveibeenpwned.com/ https://breachalarm.com/ https://breachalarm.com/ https://pwnedlist.com/query https://pwnedlist.com/query Though I doubt they will include the most recent hack.
aquil_abdullah 12y ago
I would be VERY VERY suspicious about this. Who are the people behind isleaked.com? I would read this post before first: http://jameswatt.me/2014/09/10/isleaked-com-registered-2-days-before-gmail-leak-public/ http://jameswatt.me/2014/09/10/isleaked-com-registered-2-day...
kolev 12y ago
It's funny that HN itself does not use 2FA via YCominator's Authy, let's say. So pathetic!
knd775 12y ago
This doesn't seem to work with Google Apps emails. Were thy not at all apart of the leak?
nmjohn 12y ago
This link was posted yesterday [0]. The passwords were not leaked from google, parts of it maybe were new, but other parts are suspected to be copied from older leaks. The actual dump can be found if you look for it - with full passwords. We can get a pretty good idea where they come from too by searching for emails with a + in the domain and looking at what comes after (I delete uninteresting ones - like single letters or numbers): $ grep '+' goo.txt | cut -d+ -f2 | cut -d@ -f1 | sort | uniq -c | sort -h 7 wholefoods 9 albumhunt 9 freebies 9 itickets 9 rsbuddy 11 comicbookdb 11 paygr 12 junk 12 texasmonthly 14 usercash 15 precyl 17 freebie 18 bravenet 18 filesavr 19 policeauctions 31 freebiejeebies 51 bryce 52 savage2 54 bioware 57 spam 62 savage 63 friendster 64 eharmony 66 daz3d 88 filedropper 132 daz 176 xtube [0]: https://news.ycombinator.com/item?id=8295102 https://news.ycombinator.com/item?id=8295102
adricnet 12y ago
Could we get a more accurate headline please? At least s/attack/dump/ ? There was no attack reported. The Google blog post noted in a comment has much better information, it seems: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up-after-password-dumps.html http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up... I don't see an article or site title at the URL so hopefully suggestions are useful here.
myrandomcomment 12y ago
I am confused. Is this Reddit because this is a "repost"? https://news.ycombinator.com/item?id=8295102 https://news.ycombinator.com/item?id=8295102
maerF0x0 12y ago
@xiunhao888 , you should put a warning in the title so people read the comments first. The james watt blog post is important information http://jameswatt.me/2014/09/10/isleaked-com-registered-2-days-before-gmail-leak-public/ http://jameswatt.me/2014/09/10/isleaked-com-registered-2-day... .
fphhotchips 12y ago
I took a look and then compared against my current LastPass account (in case it was from another site's leak), and nothing. I've never had a password for gmail that started with these two characters, either.

17 points by xiunhao888 12y ago

adlpz 12y ago

The obvious question: is this site to be trusted?

rtkwe 12y ago
Not sure. It said my email was in the leak but the "First two symbols of password is: " is from one of my old passwords I don't use any more, don't know when I changed it away from that old password. If you're more concerned about spam it's your gmail address which is probably already getting loads of spam you don't notice because gmail's filters are excellent.

adamfeldman 12y ago

Why would you put your gmail address into a random website? Google, being Google, has already taken care of this: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up-after-password-dumps.html http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up... You should also already have two-factor authentication setup, so you shouldn't have anything to worry about: https://support.google.com/accounts/answer/180744?hl=en https://support.google.com/accounts/answer/180744?hl=en

deleted 12y ago
[deleted]
malvosenior 12y ago
Says my account was hacked, but then gives me the incorrect two letters for the start of my password. Seems bunk. Also, why wouldn't you give your email address to a random website? I have it plastered all over the net. Spam is a solved problem at this point. Ironically thanks to Gmail! Agree on 2 factor auth though.
- omh 12y ago
  Says my account was hacked, but then gives me the incorrect two letters for the start of my password Out of interest - are those two letters the start of a password from any other site? Presumably the leak came from a third party site so it would be your password from there rather than your gmail password.
  - malvosenior 12y ago
    Nope, I have a throwaway I normally use but this isn't it. Not sure what this is coming from, but I don't recall any passwords that start with these two characters.
  - stultus 12y ago
    for me it shows first two letters of the email itself. I might have used the username itself as a password in some random site, but this is/was not my gmail password :)
- nmjohn 12y ago
  The passwords didn't come from google. It was someplace you used your email with that password. It had a couple of my emails all with the same throwaway password I only use on sites that I either don't trust or have no intention of ever using again. If you search around the full leak is very easy to find
- SloopJon 12y ago
  Most of the stories about this list have pointed out that it doesn't necessarily contain passwords from Gmail, but from various accounts that used a Gmail address as a username. Someone on Slashdot searched for "+" suffixes in the list, as in username+suffix@gmail.com: http://tech.slashdot.org/comments.pl?sid=5680529&cid=47874217 http://tech.slashdot.org/comments.pl?sid=5680529&cid=4787421... Some of the most popular suffixes were xtube, daz (and daz3d), filedropper, and eharmony. The two characters returned by isleaked.com for my address could indeed have been from daz3d.com.

christiangenco 12y ago

I usually never enter any personal information in sites like these, but this clause won me over: > If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy.

mparramon 12y ago

Mine was, but the password there is more than 4 years old, I have changed it several times since then. Makes me think that this leak is just a collection of old leaks out together.

socialist_coder 12y ago
Same. Super old password.
celticninja 12y ago
this is exactly what has happened, someone pulled together a load of data from hacks and leaks and made one file. the data in general appears to be years out of date, of course some people may still have the same password and may have reused credentials for other sites.

woodylondon 12y ago

FYI > I checked all my accounts and one was leaked. HOWEVER, it was the password I used when I first setup the account in 2004, and has been changed many times since.

kolev 12y ago

I think a lot more emails leaked due to people putting their full email to check than during the leak, although the service says people can use a search pattern, but who'd bother, right? People, it's inconvenient, I know, I know, but, please, start using 2FA! At last! I thought a lot of people who are not technical, Authy is a better tool, so, please, spread the awareness, and let's put this nonsense to an end!

nkozyra 12y ago

I'm always slightly offended when my email address isn't in these things.

BillFranklin 12y ago

There are a few websites like this with varying reliability (either haven't been updated recently or have inferred the worst-case-scenario from hacks). This is the first time I've seen this one. You could also check out these: https://haveibeenpwned.com/ https://haveibeenpwned.com/ https://breachalarm.com/ https://breachalarm.com/ https://pwnedlist.com/query https://pwnedlist.com/query Though I doubt they will include the most recent hack.

aquil_abdullah 12y ago

I would be VERY VERY suspicious about this. Who are the people behind isleaked.com? I would read this post before first: http://jameswatt.me/2014/09/10/isleaked-com-registered-2-days-before-gmail-leak-public/ http://jameswatt.me/2014/09/10/isleaked-com-registered-2-day...

kolev 12y ago

It's funny that HN itself does not use 2FA via YCominator's Authy, let's say. So pathetic!

knd775 12y ago

This doesn't seem to work with Google Apps emails. Were thy not at all apart of the leak?

nmjohn 12y ago

This link was posted yesterday [0]. The passwords were not leaked from google, parts of it maybe were new, but other parts are suspected to be copied from older leaks. The actual dump can be found if you look for it - with full passwords. We can get a pretty good idea where they come from too by searching for emails with a + in the domain and looking at what comes after (I delete uninteresting ones - like single letters or numbers): $ grep '+' goo.txt | cut -d+ -f2 | cut -d@ -f1 | sort | uniq -c | sort -h 7 wholefoods 9 albumhunt 9 freebies 9 itickets 9 rsbuddy 11 comicbookdb 11 paygr 12 junk 12 texasmonthly 14 usercash 15 precyl 17 freebie 18 bravenet 18 filesavr 19 policeauctions 31 freebiejeebies 51 bryce 52 savage2 54 bioware 57 spam 62 savage 63 friendster 64 eharmony 66 daz3d 88 filedropper 132 daz 176 xtube [0]: https://news.ycombinator.com/item?id=8295102 https://news.ycombinator.com/item?id=8295102

adricnet 12y ago

Could we get a more accurate headline please? At least s/attack/dump/ ? There was no attack reported. The Google blog post noted in a comment has much better information, it seems: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up-after-password-dumps.html http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up... I don't see an article or site title at the URL so hopefully suggestions are useful here.

myrandomcomment 12y ago

I am confused. Is this Reddit because this is a "repost"? https://news.ycombinator.com/item?id=8295102 https://news.ycombinator.com/item?id=8295102

maerF0x0 12y ago

@xiunhao888 , you should put a warning in the title so people read the comments first. The james watt blog post is important information http://jameswatt.me/2014/09/10/isleaked-com-registered-2-days-before-gmail-leak-public/ http://jameswatt.me/2014/09/10/isleaked-com-registered-2-day... .

fphhotchips 12y ago

I took a look and then compared against my current LastPass account (in case it was from another site's leak), and nothing. I've never had a password for gmail that started with these two characters, either.