Anyone got a link to the actual data?
In case nobody else has anything better: check the discord server of the-eye.eu .. My guess is that there is somebody who has it.
The 773M Record “Collection #1” Data Breach
51–60 of 128 posts
Re: The 773M Record “Collection #1” Data Breach
#52Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
He has the "Pwned Password" search to allow you to narrow it down and he has a really good article that he links to explaining why despite its inconvenience. If I was him I'd do the same. HIBP is a side project of his and I wouldn't be able to sleep at night knowing I have the responsibility of securing billions of email & password combinations. At the risk of the breach of those accounts adding fuel to the credentia…
I am not sure you should put too much confidence in the "pwned password" search.
I know one of the weak password I stupidly reuse everywhere was compromised since I had someone buy something with my paypal account. But it comes up as clean in the password search. So it was probably cracked from one of the leaked hashes but the plain text was never entered into the public dumps.
Re: The 773M Record “Collection #1” Data Breach
#53Funny, I downloaded about 700GB of password dumps last week trying to figure out how someone got one of my passwords (no big deal, they never managed to access anything)
Maybe it was this one.
Re: The 773M Record “Collection #1” Data Breach
#54Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
You can check the sites involved in the pastebin directory list though.
Re: The 773M Record “Collection #1” Data Breach
#55Earlier quoted context omitted.
So your claim has gone from "it uploads the password to the server" to "you trust unverified Javascript". No, I don't have any particular reason to trust it. I was just pointing out that the claim you made was inaccurate.
Well it does, if you have javascript off, from the source (page says "If you submit a password in the form below, it will not be anonymised first") Troy seems to have a fine reputation, but I don't want to trust the crown jewels (my passwords to everything) on Troy's reputation, the security of his site, cloudflare, and random javascript bits hosted in various places. So sure the design and explanation of the page is…
Please stop inventing claims to disagree with.
I claimed your initial unqualified statement, that it uploaded your password, was inaccurate, with both an explanation of what it was doing and the claim that I had not seen any evidence of it doing anything else.
I did not claim the site was not vulnerable to MITM or other injection attacks.
I did not claim you should trust this or any other resource with your password or any other data.
Re: The 773M Record “Collection #1” Data Breach
#56This is frankly terrifying and very ironic. Websites put so much effort into tracking every little thing about their users, from where they come from to what they do. Hotjar ( https://hotjar.com ) goes ahead and tracks mouse movements and now we even have crazy f-ed up startups like Peekmap ( https://peekmap.com ) that claim to predict eye gaze without the webcam. And yet they get pwned so easily. So much effort into…
How does Peekmap work? Their website contains no details.
I just can't imagine how you can reliably track a users eye gaze without a webcam - is it just some snake oil pretending to solve everything with AI?
Re: The 773M Record “Collection #1” Data Breach
#57This is frankly terrifying and very ironic. Websites put so much effort into tracking every little thing about their users, from where they come from to what they do. Hotjar ( https://hotjar.com ) goes ahead and tracks mouse movements and now we even have crazy f-ed up startups like Peekmap ( https://peekmap.com ) that claim to predict eye gaze without the webcam. And yet they get pwned so easily. So much effort into…
How does Peekmap work? Their website contains no details. I just can't imagine how you can reliably track a users eye gaze without a webcam - is it just some snake oil pretending to solve everything with AI?
It could be ML prediction based on scrolling + mouse movements or just old-school code which finds the closest and brightest div next to mouse coordinates. Maybe it's slightly more useful than plain mouse heat map which all competitors use, even if it's a crude approximation.
Re: The 773M Record “Collection #1” Data Breach
#58Earlier quoted context omitted.
He has the "Pwned Password" search to allow you to narrow it down and he has a really good article that he links to explaining why despite its inconvenience. If I was him I'd do the same. HIBP is a side project of his and I wouldn't be able to sleep at night knowing I have the responsibility of securing billions of email & password combinations. At the risk of the breach of those accounts adding fuel to the credentia…
There wouldn't be any inconvenience if your password manager did its job of helping you manage your passwords. 1Password has implemented a feature that helps you easily check all your passwords, I'm honestly surprised it's taking so long for the others to do too. The data is there, there's a super easy API, it doesn't take that much effort...
Enpass has such a feature too. I just had it check all my passwords in the light of this new breach.
Re: The 773M Record “Collection #1” Data Breach
#59Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
Hmmm? He tells you which breach it came from, so in my case I know LinkedIn, Adobe, Dropbox, Binweevils (thanks kids!)
Re: The 773M Record “Collection #1” Data Breach
#60This is frankly terrifying and very ironic. Websites put so much effort into tracking every little thing about their users, from where they come from to what they do. Hotjar ( https://hotjar.com ) goes ahead and tracks mouse movements and now we even have crazy f-ed up startups like Peekmap ( https://peekmap.com ) that claim to predict eye gaze without the webcam. And yet they get pwned so easily. So much effort into…
and receive no meaningful legal consequences. These people should be on the hook for all damage done with this dump, but they won't be, so it doesn't really matter. It's not ironic, it's just business as usual. Collecting data on users should be extremely risky, even if they consent to it's collection.
We are getting there, thanks to the EU. The GDPR directive has teeth, and it /will/ affect all larger US companies as well.
Fines of up to 4% of yearly revenue area no joke: https://www.forbes.com/sites/bernardmarr/2018/06/11/gdpr-the...