Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alleged leak of more than 5M Gmail accounts

isleaked.com

Post reply on HN
Print view View original

51–60 of 141 posts

Re: Alleged leak of more than 5M Gmail accounts

#51

Post by ak217 »

unknownBits wrote: post #46
sinak wrote: post #32

Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ - Github: https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/acco…

With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

I'm not sure exactly what point you're trying to make, but you seem confused about how 2FA works.

The goal of 2FA/MFA is to make you demonstrate that you're in possession of two independent secrets (authentication factors). Once you've shown that, it's considered safe enough to replace the second secret (OTP sent to your phone or generated by your TOTP app like Google Authenticator) with a cookie (the check is not IP-based). Typically the cookie only lasts for 30 or 60 days.

If what you're concerned about is the idea that Google knows your phone number, you can use Google Authenticator or another TOTP app instead.

Re: Alleged leak of more than 5M Gmail accounts

#54

Post by caractacus »

Sommer717 wrote: post #15

Weird, it gives me a very old password. Though back when I had that password my account was hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.

Me too. It gives the first two letters of a pw that I have used in the past but as far as I'm aware, not on that account. This raises all kinds of questions...

Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.

Re: Alleged leak of more than 5M Gmail accounts

#55

Post by hmottestad »

unicornporn wrote: post #48
tonymon wrote: post #12

Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails

OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...

The webpage will give you the first two letters of your password.

Re: Alleged leak of more than 5M Gmail accounts

#56

Post by NaNaN »

A summary about phishing:

    1. Found you password with the same email address somewhere
     and ask if you still use that email address on another site.
    2. And get your IP, then login through proxy to bypass the security checking.
    3. Still, to know which email address is in use.
If you just worry, change you password right now without using their service. :P It may be good that every a few months some guys remind you to change passwords.

Re: Alleged leak of more than 5M Gmail accounts

#58

Post by Vanayad »

hmottestad wrote: post #55
unicornporn wrote: post #48

Earlier quoted context omitted.

OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...

The webpage will give you the first two letters of your password.

The webpage gave the correct first two letters of my password...but that was changed more than a year and half ago, so this leak must be VERY old. I have been using last pass for the past time and when I got it I immediately changed my google password. This is the reason why I'm saying is that old.

Re: Alleged leak of more than 5M Gmail accounts

#59

Post by Vanayad »

The webpage gave the correct first two letters of my password...but that was changed more than a year and half ago, so this leak must be VERY old. I have been using last pass for the past time and when I got it I immediately changed my google password. This is the reason why I'm saying is that old.
Post reply on HN