5M Gmail passwords leaked to Russian Bitcoin forum

http://www.dailydot.com/crime/google-gmail-5-million-passwords-leaked/

by gokhan • 12 years ago

56 20 12 years ago

dailydot.com

marksamman• 12 years ago

https://news.ycombinator.com/item?id=8295102

r7213• 12 years ago

Flagged out of front page though.

pmalynin• 12 years ago

Huh, I wonder why. Because it seems my submission is being penalized for being submitted hours before it hit the general media.

freehunter• 12 years ago

Definitely not Gmail passwords, or at least not passwords leaked from Google themselves. I have an account on there that I only use for spam and signing up for sites that require an email address, but it lists a junk password that has never been used with that account on Google itself. It's been used with that email address on many sites, but not Google.

It seems this list is either curated to only include Gmail address scraped from some other site or they tried combining an email and a passwords list together.

levesque• 12 years ago

Checked on the linked website (https://isleaked.com/en.php) for my junk gmail account. It didn't have the right first letters for my gmail password, but it is a match for some forums I've been using. Perhaps this is where the info comes from?

wlesieutre• 12 years ago

Agreed, the password it has for me is not my Gmail password, but one that I've used to sign up for various junk accounts using the email address.

jacquesm• 12 years ago

The problem with such lists is that plenty of people will use the same password they used on website 'x' with their gmail account. So don't be surprised if a whole pile of these actually will work with the listed gmail address.

pyre• 12 years ago

Right, but there is a least a chance that the email:password combos are wrong, even if the email is valid.

pscsbs• 12 years ago

Me too. My password is in the dataset, but it's one I've never used with my Google account. It's my "low-security" password that I use on sites that I don't really care about.

philliescurt• 12 years ago

i found an address i use but the password they have listed has not been valid for over two years

afreak2• 12 years ago

https://canary.pw/view/?item=13221ab1721254808546bd068b6cd47...

https://canary.pw/view/?item=1bc5b34811b50f3fbce06cb55088372...

https://canary.pw/view/?item=87ecceaf19b0187e901e15c5bc8f8a9...

Canary is still chewing through the dataset I fed it and figuring out where they all relate (if at all), but so far it seems that some of the data is as old as January 2014. This is likely not from Gmail itself but perhaps a collection of other leaks.

afreak2• 12 years ago

https://pay.reddit.com/r/netsec/comments/2fz13q/5_millions_o...

A good backgrounder too.

_puk• 12 years ago

Interestingly I have one hit for my gmail on isleaked.

Looking at that link I see freebiejeebies, which if I check in keepass I created an account for in 2008 with a unique password (as I tended to back then, even for throwaways).

Sure enough the first two characters match that reported by isleaked (Though case doesn't match..)

Having gone through the majority of the other entries in keepass, that is the only password starting with the two reported characters.

So can safely say freebiejeebies was compromised at some point.

Now to work out why I'd have an account on there in the first place ;)

heliumcraft• 12 years ago

wouldn't the passwords be hashed? or are these passwords captured through other means like trojans?

UberB• 12 years ago

According to the article, they never managed to hack into Google's database. This just looks like a large accumulation of user info from phishing.

autism_hurts• 12 years ago

Anybody have the raw data?

r7213• 12 years ago

Look at dead comments in other submission.

smmnyc• 12 years ago

The account I found on this list was captured in the adobe.com breach (http://blogs.adobe.com/conversations/2013/10/important-custo...)

aroch• 12 years ago

One of my throwaway gmail's is in the leak, the password matches the password I gave at devicescape.com

5M Gmail passwords leaked to Russian Bitcoin forum

Related Stories