It has passwords collected from other sites, at least from heroesofnewerth.com
That's one more example against password reusing.
Alleged leak of more than 5M Gmail accounts
41–50 of 141 posts
Re: Alleged leak of more than 5M Gmail accounts
#42Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails
I bet there are some people who have other leaked account & password lists, and since the isleaked.com site is kind enough to give the first two characters of the password for any given email account, it'd probably be possible to guess the passwords for some of those accounts.
Re: Alleged leak of more than 5M Gmail accounts
#43Sites should stop storing plain text password
Re: Alleged leak of more than 5M Gmail accounts
#44I can tell from the first 2 characters that the leaked password associated with my email address was scraped from Pizza Hut Australia's online ordering system (they only recently implemented SSL on the login page).
It's interesting that I setup a particular password for that service when I noticed it didn't use SSL. Make's me wonder how many databases this comes from. It certainly isn't Google's.
Re: Alleged leak of more than 5M Gmail accounts
#45Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails
Interestingly, there are a large number of non-gmail.com addresses in there, including 123k yandex.ru addresses, plus a (very) small number of yahoo.com and hotmail.com addresses. Here's the output of "cut -d@ -f2 | sort | uniq -c | sort -nr":
https://gist.github.com/anonymous/255959493c0a26cce856
The data hasn't been very well edited from whatever dump it came from. For example, there are lines that end in "gmail.com_xtube", "gmail.com7777", "gmail.com|login", etc, which are curious.
Re: Alleged leak of more than 5M Gmail accounts
#46Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ - Github: https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/acco…
With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say:
"During sign-in, you can tell us not to ask for a code again on that particular computer."
Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
Re: Alleged leak of more than 5M Gmail accounts
#47grep admin google_5000000.txt -c
1019
sigh
Re: Alleged leak of more than 5M Gmail accounts
#48Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails
OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...
Re: Alleged leak of more than 5M Gmail accounts
#49Links to zip archive with plain email list (without passwords): https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4... Alternative: http://rghost.net/57937836 The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails
Thanks! Checking that list against my gmail contacts, I found six of my friends in there!
Re: Alleged leak of more than 5M Gmail accounts
#50Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services: - Google: https://www.google.com/landing/2step/ - Github: https://github.com/settings/security - AWS: http://aws.amazon.com/mfa/virtual_mfa_applications - Facebook: https://www.facebook.com/settings?tab=security - Twitter: https://twitter.com/settings/security - Dropbox: https://www.dropbox.com/acco…
With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say: "During sign-in, you can tell us not to ask for a code again on that particular computer." Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..