No evidence is presented that anybody but the security researcher noticed the unprotected data. The data is a compilation of previously leaked emails.
[deleted]
To +1 this:
>... from previously reported and non-reported data breaches.
DarkBeam leaks billions of email and password combinations
11–20 of 39 posts
Re: DarkBeam leaks billions of email and password combinations
#12The irony is darkbeam positions itself as a digital risk management platform. A based SOC2 security audit would reveal these vulnerabilities.
No. Only if the database was exposed at the time of the audit.
Re: DarkBeam leaks billions of email and password combinations
#13No evidence is presented that anybody but the security researcher noticed the unprotected data. The data is a compilation of previously leaked emails.
"exposing records with user emails and passwords from previously reported and non-reported data breaches."
I think you mean to say that there is no evidence presented precluding someone grabbing the data?
Re: DarkBeam leaks billions of email and password combinations
#14I suppose it would require a good few domains and or public mail boxes but imagine if one was to create n fake users for each real user. If any of the fake users log-in on their account all users are forced to change their password.
Canary accounts:
https://joesecurity.blogspot.com/2009/05/what-is-canary-acco...
Re: DarkBeam leaks billions of email and password combinations
#15The company I work for (stytch.com, we provide an authentication API) tracks breached passwords and, depending upon config, will invalidate passwords that have been leaked. Will be interesting to watch our logs over the coming weeks.
.. do you happen to have a service that lets users know if their password was in the breach?
Re: DarkBeam leaks billions of email and password combinations
#16The company I work for (stytch.com, we provide an authentication API) tracks breached passwords and, depending upon config, will invalidate passwords that have been leaked. Will be interesting to watch our logs over the coming weeks.
.. do you happen to have a service that lets users know if their password was in the breach?
Re: DarkBeam leaks billions of email and password combinations
#17Each time a breach like this happens I want to download the file and check if
1. My emails are in the dataset, and
2. Any of my passwords are in that dataset.
I really just want the collection of passwords so that I can use it as a check against any of my current passwords.
[EDIT: I know about haveibeenpwned.com; I'm not asking for a service that I send a http request to to determine if a single username exists in the db, I want the db itself so I can chuck it into sqlite and check multiple records at a single time, quickly, for both usernames alone and passwords alone
I also believe it's a bad idea to ask a third-party to perform the check. Even if you trust that third-party now, there is no way to ensure that trust in the future - i.e. it gets bought, breached or pwned itself in the future and best case scenario is that the record of your username lookup is available as "confirmed". Without visiting that site, no one would never know if that record was a throwaway or not.]
Re: DarkBeam leaks billions of email and password combinations
#18Each time a breach like this happens I want to download the file and check if 1. My emails are in the dataset, and 2. Any of my passwords are in that dataset. I really just want the collection of passwords so that I can use it as a check against any of my current passwords. [EDIT: I know about haveibeenpwned.com; I'm not asking for a service that I send a http request to to determine if a single username exists in th…
Services already exist that does this. Some password managers will check but the popular service often talked about on here is https://haveibeenpwned.com/
Re: DarkBeam leaks billions of email and password combinations
#19Each time a breach like this happens I want to download the file and check if 1. My emails are in the dataset, and 2. Any of my passwords are in that dataset. I really just want the collection of passwords so that I can use it as a check against any of my current passwords. [EDIT: I know about haveibeenpwned.com; I'm not asking for a service that I send a http request to to determine if a single username exists in th…
If you use any of the better password managers this feature exists and runs automatically. If you don't want to go that route, then you can make use of https://haveibeenpwned.com/