News for hackers. Stuff that matters.
Re:Was your Gmail compromised in yesterday's attack? by adamfeldman on Thursday September 11, 2014 @11:22AM (#8303053)
Why would you put your gmail address into a random website? Google, being Google, has already taken care of this: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up...

You should also already have two-factor authentication setup, so you shouldn't have anything to worry about: https://support.google.com/accounts/answer/180744?hl=en

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by malvosenior on Thursday September 11, 2014 @11:25AM (#8303082)
Says my account was hacked, but then gives me the incorrect two letters for the start of my password. Seems bunk.

Also, why wouldn't you give your email address to a random website? I have it plastered all over the net. Spam is a solved problem at this point. Ironically thanks to Gmail!

Agree on 2 factor auth though.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by SloopJon on Thursday September 11, 2014 @11:37AM (#8303179)
Most of the stories about this list have pointed out that it doesn't necessarily contain passwords from Gmail, but from various accounts that used a Gmail address as a username.

Someone on Slashdot searched for "+" suffixes in the list, as in [email protected]:

http://tech.slashdot.org/comments.pl?sid=5680529&cid=4787421...

Some of the most popular suffixes were xtube, daz (and daz3d), filedropper, and eharmony. The two characters returned by isleaked.com for my address could indeed have been from daz3d.com.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by nmjohn on Thursday September 11, 2014 @11:30AM (#8303131)
The passwords didn't come from google.

It was someplace you used your email with that password. It had a couple of my emails all with the same throwaway password I only use on sites that I either don't trust or have no intention of ever using again.

If you search around the full leak is very easy to find

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by omh on Thursday September 11, 2014 @11:30AM (#8303125)
Says my account was hacked, but then gives me the incorrect two letters for the start of my password

Out of interest - are those two letters the start of a password from any other site?

Presumably the leak came from a third party site so it would be your password from there rather than your gmail password.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by malvosenior on Thursday September 11, 2014 @11:32AM (#8303145)
Nope, I have a throwaway I normally use but this isn't it. Not sure what this is coming from, but I don't recall any passwords that start with these two characters.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by stultus on Friday September 12, 2014 @03:10AM (#8306901)
for me it shows first two letters of the email itself. I might have used the username itself as a password in some random site, but this is/was not my gmail password :)
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by christiangenco on Thursday September 11, 2014 @11:22AM (#8303054)
I usually never enter any personal information in sites like these, but this clause won me over:

> If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for [email protected] enter myac*[email protected]), thus we'll show you a count of matches for this pattern. We respect your privacy.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by nmjohn on Thursday September 11, 2014 @11:33AM (#8303147)
This link was posted yesterday [0].

The passwords were not leaked from google, parts of it maybe were new, but other parts are suspected to be copied from older leaks.

The actual dump can be found if you look for it - with full passwords.

We can get a pretty good idea where they come from too by searching for emails with a + in the domain and looking at what comes after (I delete uninteresting ones - like single letters or numbers):

$ grep '+' goo.txt | cut -d+ -f2 | cut -d@ -f1 | sort | uniq -c | sort -h

      7 wholefoods
      9 albumhunt
      9 freebies
      9 itickets
      9 rsbuddy
     11 comicbookdb
     11 paygr
     12 junk
     12 texasmonthly
     14 usercash
     15 precyl
     17 freebie
     18 bravenet
     18 filesavr
     19 policeauctions
     31 freebiejeebies
     51 bryce
     52 savage2
     54 bioware
     57 spam
     62 savage
     63 friendster
     64 eharmony
     66 daz3d
     88 filedropper
    132 daz
    176 xtube
[0]: https://news.ycombinator.com/item?id=8295102
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by aquil_abdullah on Thursday September 11, 2014 @11:29AM (#8303116)
I would be VERY VERY suspicious about this. Who are the people behind isleaked.com? I would read this post before first:

http://jameswatt.me/2014/09/10/isleaked-com-registered-2-day...

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by BillFranklin on Thursday September 11, 2014 @11:29AM (#8303115)
There are a few websites like this with varying reliability (either haven't been updated recently or have inferred the worst-case-scenario from hacks). This is the first time I've seen this one. You could also check out these:

https://haveibeenpwned.com/ https://breachalarm.com/ https://pwnedlist.com/query

Though I doubt they will include the most recent hack.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by mparramon on Thursday September 11, 2014 @11:23AM (#8303061)
Mine was, but the password there is more than 4 years old, I have changed it several times since then. Makes me think that this leak is just a collection of old leaks out together.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by celticninja on Thursday September 11, 2014 @11:29AM (#8303121)
this is exactly what has happened, someone pulled together a load of data from hacks and leaks and made one file. the data in general appears to be years out of date, of course some people may still have the same password and may have reused credentials for other sites.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by socialist_coder on Thursday September 11, 2014 @11:28AM (#8303106)
Same. Super old password.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by adricnet on Thursday September 11, 2014 @11:34AM (#8303150)
Could we get a more accurate headline please? At least s/attack/dump/ ? There was no attack reported.

The Google blog post noted in a comment has much better information, it seems: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up...

I don't see an article or site title at the URL so hopefully suggestions are useful here.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by kolev on Thursday September 11, 2014 @11:28AM (#8303102)
I think a lot more emails leaked due to people putting their full email to check than during the leak, although the service says people can use a search pattern, but who'd bother, right? People, it's inconvenient, I know, I know, but, please, start using 2FA! At last! I thought a lot of people who are not technical, Authy is a better tool, so, please, spread the awareness, and let's put this nonsense to an end!
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by adlpz on Thursday September 11, 2014 @11:21AM (#8303050)
The obvious question: is this site to be trusted?
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by rtkwe on Thursday September 11, 2014 @11:25AM (#8303083)
Not sure. It said my email was in the leak but the "First two symbols of password is: " is from one of my old passwords I don't use any more, don't know when I changed it away from that old password.

If you're more concerned about spam it's your gmail address which is probably already getting loads of spam you don't notice because gmail's filters are excellent.

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by maerF0x0 on Thursday September 11, 2014 @11:35AM (#8303162)
@xiunhao888 , you should put a warning in the title so people read the comments first. The james watt blog post is important information http://jameswatt.me/2014/09/10/isleaked-com-registered-2-day... .
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by fphhotchips on Thursday September 11, 2014 @11:38AM (#8303185)
I took a look and then compared against my current LastPass account (in case it was from another site's leak), and nothing. I've never had a password for gmail that started with these two characters, either.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by myrandomcomment on Thursday September 11, 2014 @11:35AM (#8303159)
I am confused. Is this Reddit because this is a "repost"?

https://news.ycombinator.com/item?id=8295102

[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by woodylondon on Thursday September 11, 2014 @11:24AM (#8303073)
FYI > I checked all my accounts and one was leaked. HOWEVER, it was the password I used when I first setup the account in 2004, and has been changed many times since.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by knd775 on Thursday September 11, 2014 @11:29AM (#8303120)
This doesn't seem to work with Google Apps emails. Were thy not at all apart of the leak?
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by nkozyra on Thursday September 11, 2014 @11:29AM (#8303112)
I'm always slightly offended when my email address isn't in these things.
[ Parent | on HN ]
Re:Was your Gmail compromised in yesterday's attack? by kolev on Thursday September 11, 2014 @11:29AM (#8303119)
It's funny that HN itself does not use 2FA via YCominator's Authy, let's say. So pathetic!
[ Parent | on HN ]