It isn't the actual Gmail passwords that are leaked. One of my accounts is there, but the password is one I have used on other sites, never on the actual Gmail account.
Can you disclose which site?
Alleged leak of more than 5M Gmail accounts
81–90 of 141 posts
Re: Alleged leak of more than 5M Gmail accounts
#82It isn't the actual Gmail passwords that are leaked. One of my accounts is there, but the password is one I have used on other sites, never on the actual Gmail account.
Can you disclose which site?
Can't be sure, it's a "garbage sites" password which I've used too many times on untrusted sites. Any one of those sites could have been hacked, or had been a phishing gateway itself.
Of course what I did was bad practice. One should store passwords in a secure password manager, and use a different (preferably 30+ chars) password on each site.
Re: Alleged leak of more than 5M Gmail accounts
#83Earlier quoted context omitted.
With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
I'm not sure exactly what point you're trying to make, but you seem confused about how 2FA works. The goal of 2FA/MFA is to make you demonstrate that you're in possession of two independent secrets (authentication factors). Once you've shown that, it's considered safe enough to replace the second secret (OTP sent to your phone or generated by your TOTP app like Google Authenticator) with a cookie (the check is not IP…
Ip or cookie, still don't see the need for giving your phone number. In case of a crack, the cracker knows your private phone number too, for what?
Re: Alleged leak of more than 5M Gmail accounts
#84My email address was there but "your first two symbols" listed there was wrong. Is that first two symbols hash of my password?
Re: Alleged leak of more than 5M Gmail accounts
#85For me, it has a password I don't ever recall using with gmail. If I have, I don't think it's been in the past few years. That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.
but matched up with your email... and many people don't have throwaways
Re: Alleged leak of more than 5M Gmail accounts
#86My email address was there but "your first two symbols" listed there was wrong. Is that first two symbols hash of my password?
Based on the two letters of mine, I have a feeling that it's from a BB forum crawl or similar.
Re: Alleged leak of more than 5M Gmail accounts
#87It has a password for another site but not gmail.
Not sure which, but it isn't gmail.
Re: Alleged leak of more than 5M Gmail accounts
#88If you search for the character '+' in the list of e-mails you can get an idea where the mails leaked from. It seems to me like this is a collection of databases scraped from different sources as others have suggested.
For Gmail users, it's a good practice to register to websites using username+websitename@gmail.com (e.g. mark.samman+hackernews@gmail.com), that way you'll know who leaked your data when it appears in lists like this or when you get spam. Gmail ignores the plus character and anything that follows the plus. You can also add dots at arbitrary positions in the username part.
Re: Alleged leak of more than 5M Gmail accounts
#89Full list with passwords: sendfile.su/1020941
Re: Alleged leak of more than 5M Gmail accounts
#90I was on the list and now I got a Facebook password reset code to my phone, without asking for one. Someone already seems to be trying to use the passwords.