Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alleged leak of more than 5M Gmail accounts

isleaked.com

Post reply on HN
Print view View original

111–120 of 141 posts

Re: Alleged leak of more than 5M Gmail accounts

#111

Post by archenemy »

marksamman wrote: post #88

If you search for the character '+' in the list of e-mails you can get an idea where the mails leaked from. It seems to me like this is a collection of databases scraped from different sources as others have suggested. For Gmail users, it's a good practice to register to websites using username+websitename@gmail.com (e.g. mark.samman+hackernews@gmail.com), that way you'll know who leaked your data when it appears in…

I have always wondered what use is this with regards to spam and sneaky address lists. What exactly prevents someone from cleaning up the addresses before letting them out?

If I were a bad behaved site and sell (sold? sorry, tired and non native speaker) my userlist, i'd probably remove all plus-suffixes from the addresses. Same as if I were a blackhat stealing them to be sold.

Honest question, no snark.

Re: Alleged leak of more than 5M Gmail accounts

#112

Post by switch33 »

WARNING: This is probably fake and a scam. If you ctrl + f you are giving away your account name to the site which can be done with some simple javascript.

There was a talk about that a while back. And the username can then be used for a bruteforce attack. News companies need to stop being so dumb and reporting on these fake hacks.

Re: Alleged leak of more than 5M Gmail accounts

#113

Post by palebluedot »

cordite wrote: post #109
palebluedot wrote: post #103

Earlier quoted context omitted.

You don't need reception for 2FA; Google Authenticator and FreeOTP work fine even in airplane mode, if you have your phone / tablet with you.

Yeah, good luck on a windows phone.

If there is no existing offline OTP authenticator for Windows phone, FreeOTP is open-source. Perhaps someone will port it over: https://fedorahosted.org/freeotp/

Re: Alleged leak of more than 5M Gmail accounts

#114

Post by kolev »

Aissen wrote: post #94
kolev wrote: post #72

Earlier quoted context omitted.

This is much better: https://play.google.com/store/apps/details?id=com.authy.auth...

This is much better: https://play.google.com/store/apps/details?id=org.fedorahost... Open source fork of the (now closed source) Google Authenticator.

Nice! Thanks for sharing!

Re: Alleged leak of more than 5M Gmail accounts

#115

Post by VikingCoder »

bagels wrote: post #2

Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it. I generally don't bother, because it's just more security risks.

...or that when you log on to the site, the site would tell you that your account was in the list.

Re: Alleged leak of more than 5M Gmail accounts

#116

Post by nzealand »

freehunter wrote: post #108
valarauca1 wrote: post #101

Earlier quoted context omitted.

Then your laziness is important to you then your security.

It's a fair point though. At some point you're putting too much of a barrier on everything. You can have security and convenience at the same time, we just haven't done it yet. However, I have 2FA turned on with GMail and I authenticate basically once, then it remembers my PC and I don't have to authenticate again for a long time.

It remembers the second authorization on all your devices?

Re: Alleged leak of more than 5M Gmail accounts

#117

Post by nzadrozny »

sp332 wrote: post #110
valarauca1 wrote: post #101

Earlier quoted context omitted.

Then your laziness is important to you then your security.

I have ssh-agent for SSH. Can we get something similar for websites?

Actually, I was recently pointed at Joyent's node-http-signature[1], which is pretty clever. It can sign an HTTP request using one's SSH keys. Handy for a CLI client for a HTTP API.

I've done a couple of HTTP auth schemes for my dayjob and am thinking of using something like this for my next.

1. https://github.com/joyent/node-http-signature/blob/master/ht...

Re: Alleged leak of more than 5M Gmail accounts

#118

Post by ZoFreX »

probably_wrong wrote: post #69
unknownBits wrote: post #46

Earlier quoted context omitted.

With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

> Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways. Although that wouldn't be 2FA, it's worth noting that Facebook, Hotmail and Flickr will ask for some extra verification if you connect from a different country that usual. So that's probably not a bad idea.

Google do as well - they block logins that they determine to be suspicious, and a separate country seems to be a big factor in that decision.

Re: Alleged leak of more than 5M Gmail accounts

#119

Post by ZoFreX »

cordite wrote: post #109
palebluedot wrote: post #103

Earlier quoted context omitted.

You don't need reception for 2FA; Google Authenticator and FreeOTP work fine even in airplane mode, if you have your phone / tablet with you.

Yeah, good luck on a windows phone.

Microsoft Authenticator works just fine with GMail :)

Re: Alleged leak of more than 5M Gmail accounts

#120

Post by dragonwriter »

unknownBits wrote: post #46
sinak wrote: post #32

Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ - Github: https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/acco…

With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

> With two-factor authentication you are happily providing gmail with your phone number.

Which I also provide to Google because all of my phone numbers are forwarding numbers for my GVoice account, so that's not a big deal.

> They say they need this to send you a verification code when you log into your gmail account.

Sure.

> Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

How can they determine its valid without the second factor the first time you log on from a particular device? That's a key feature of 2FA (plus, if you ever use a shared computer, you don't want to choose the option to never ask for a code again on that computer!)

Post reply on HN