3 ms·
I doubt dropbox was hacked. It also doesn't look like a dictionary attack. It seems more likely that a third-party website wasn't storing passwords correctly,
by nostromo 12y ago
I doubt dropbox was hacked. It also doesn't look like a dictionary attack.
It seems more likely that a third-party website wasn't storing passwords correctly, was hacked, and this is the list of users that use a single password for everything.
- pain_perdu 12y agoIf your theory is correct, would we not expect to see the account names be a bit more random? That is to say, these are in alphabetical order and clearly coming from a large list because the letters in each progressive account are similar: Bille97... Billel... Billen... Billet... Billew... Isn't it unlikely that so many alphabetically-similar accounts from the third-party site would use the same password for dropbox?
- yen223 12y agoIt is very likely that they have X million passwords leaked from other sites, and they only chose to release emails that begin with "bi-".
- asdfaoeu 12y agoUsing http://thepiratebay.se/torrent/7803135/1_million_email_list http://thepiratebay.se/torrent/7803135/1_million_email_list to give the relative frequency of email addresses I'd estimate they have a total of around 30k addresses -> % cat 1000000\ email\ list.txt | sed 's/, */\n/g' | grep "@"| sort | uniq | wc -l 835694 -> % cat 1000000\ email\ list.txt | sed 's/, */\n/g' | grep "@"| sort | uniq | grep -i "^b[e-i]" | wc -l 11160 irb(main):001:0> (835694.0 / 11160) * 400 => 29953.189964157707
- kolev 12y agoWhat if the guy created accounts so that people can check those are "real" and collect free bitcoins? Picking similar emails is to try to trick us into believing that he has 7 million of those.
- wrongc0ntinent 12y agoIt's also possible that they have it _all_ and none of the 3 "teasers" are indicative of the complete list. You should assume this is the case if you use dropbox, and act accordingly.