4 ms·

Interesting. I tested with my gmail-account and it was reported as pwned. Then I tested the gmail-account again with this service which also shows the two fir

Interesting. I tested with my gmail-account and it was reported as pwned. Then I tested the gmail-account again with this service which also shows the two first characters of the leaked password. https://isleaked.com/en https://isleaked.com/en Turns out that the leaked "gmail" password was my old password used for unimportant websites and this was never used with the gmail-account itself. So apparently one of those unimportant websites was hacked and the email/password was then grabbed. No way to tell which site that was since haveibeenhacked.com does not include that information, but instead makes it appear that the actual gmail password is/was compromised.

craigching 12y ago
> No way to tell which site that was Hey, that's a great idea! Try and use some indicator in the password you choose so that when your password is revealed you know who it is :) Probably hard to do in practice, but I'm going to keep that in mind next time I visit a site and use a throw-away password
- rogerbinns 12y ago
  Use a better email service. For example I use my own domain with all email going to me. Consequently I can use site1@my.domain for one site, site2@my.domain for another. Makes it real easy to see who has been sharing things. Gmail lets you use plus suffixes, as well as extra dots: http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-more-from-your.html http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-m...
  - craigching 12y ago
    > Gmail lets you use plus suffixes, as well as extra dots Very nice, thanks for that!
biggc 12y ago
Yeah exactly. My gmail password wasn't comprised, just the password I use for throwaway accounts.
yaur 12y ago
I threw http://amihacked.org/ http://amihacked.org/ together yesterday to give people a way to find out their leaked passwords. It would be cool to figure out where these came from since it does appear to not be gmail accounts.

craigching 12y ago

> No way to tell which site that was Hey, that's a great idea! Try and use some indicator in the password you choose so that when your password is revealed you know who it is :) Probably hard to do in practice, but I'm going to keep that in mind next time I visit a site and use a throw-away password

rogerbinns 12y ago
Use a better email service. For example I use my own domain with all email going to me. Consequently I can use site1@my.domain for one site, site2@my.domain for another. Makes it real easy to see who has been sharing things. Gmail lets you use plus suffixes, as well as extra dots: http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-more-from-your.html http://gmailblog.blogspot.com/2008/03/2-hidden-ways-to-get-m...
- craigching 12y ago
  > Gmail lets you use plus suffixes, as well as extra dots Very nice, thanks for that!

biggc 12y ago

Yeah exactly. My gmail password wasn't comprised, just the password I use for throwaway accounts.

yaur 12y ago

I threw http://amihacked.org/ http://amihacked.org/ together yesterday to give people a way to find out their leaked passwords. It would be cool to figure out where these came from since it does appear to not be gmail accounts.