Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it.
I generally don't bother, because it's just more security risks.
"If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."
Only up to 3 characters? Why 3? Especially since it's an email address and not a random string, which limits the possibilities for the 3 missing characters. This looks like it's giving more info than you'd think to a dodgy website...
i sure hope you are beeing sarcastic, if not, consider this: it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly.
Wget and grep would be more likely to be used - but in answer to your question: yes, in a case like this.
Let's do some quick back-of-the-envelope math. 5M addresses, with very few longer than 25 characters. Let's say the average is around 17 characters. 17 * 5 * 10^6 = 35 * 10 ^7 = 3.5 * 10^8 bytes, or 350MB. Text generally compresses to 1/8 space with zlib, so the amount to transfer would be about 44MB, at most. Serving the list as xz compressed file could probably cut the size down to below 40MB.
In the age of 100MB youtube videos, that doesn't sound like much to me.
you should reconsider this, because it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly.
It could be even more dangerous than you are imagining.
If you check a username, then you would probably also be revealing the IP address range and browser referrer that is normally used to access your account.
Google uses IP address and location to help detect illegal access. So giving away this information could make it easier for your account to be stolen.
Of course not. He's going to go botnet shopping and try to log in through a compromised machine with an IP address in the same town, in the same address range.
He might even be able to use the same IP as you, if you happen to be using a gateway with many machines behind it, and one of them is compromised.
I just tried it with my old Gmail account that I no longer use, and it displayed the first two letters of my password. The password was random letters and numbers, 16 characters, so not easily guessable. Seems legit to me :-)
"If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."
On August 20 an address of mine was entered and my Origin account was subsequently compromised. Looks like this leak matches the creds that account had before I reacted. Happily enough it was a low equity account, I had 2FA and nothing else seems to have been grabbed.
Edit: to clarify, I had 2FA on an account which alerted me to the Gmail compromise. I obviously messed up with that email account.
I bet there are some people who have other leaked account & password lists, and since the isleaked.com site is kind enough to give the first two characters of the password for any given email account, it'd probably be possible to guess the passwords for some of those accounts.
Interestingly, there are a large number of non-gmail.com addresses in there, including 123k yandex.ru addresses, plus a (very) small number of yahoo.com and hotmail.com addresses. Here's the output of "cut -d@ -f2 | sort | uniq -c | sort -nr":
The data hasn't been very well edited from whatever dump it came from. For example, there are lines that end in "gmail.com_xtube", "gmail.com7777", "gmail.com|login", etc, which are curious.
The webpage gave the correct first two letters of my password...but that was changed more than a year and half ago, so this leak must be VERY old. I have been using last pass for the past time and when I got it I immediately changed my google password. This is the reason why I'm saying is that old.
Assuming hacker did sign in into your Gmail , you might be able to get that information from the list of last logins in your Gmail account. Any IP that's out of your normal location would reveal that.
More in this link
https://support.google.com/mail/answer/45938?hl=en
Yeah, this is an account that only forwards emails, so I almost never log in. However, when I changed my password now I logged in and out a bunch of times. This made this very short list of recently logged locations only contain one line that was not from today. Hmm. Would be better if they showed 50 recent logins or something...
It says mine is in it but suggests the wrong password. I don't think I even had a password with those letters plus I've had 2FA for a while now. Wonder how legit this is.
Though back when I had that password my account was hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.
Me too. It gives the first two letters of a pw that I have used in the past but as far as I'm aware, not on that account. This raises all kinds of questions...
Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.
I can also verify this. One of my gmail accounts was in there, incidentally the "trash account" I use when I sign up for various services online.
And the password was one of my lowest security "trash passwords" I use with this e-mail as login sometimes if it's a service I wouldn't trust or don't care if it's compromised.
So I wouldn't worry about this. Someone had their site hacked most likely and these are logins to the site, not from Google.
For me, it has a password I don't ever recall using with gmail. If I have, I don't think it's been in the past few years.
That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.
I just checked using a bunch of throwaway email accounts I had to sign up for various promotions. One of them was leaked - and one of them had a very old password associated with it.
I now use KeePass2 to manage all my passwords - so the old password has absolutely nothing to do with the new one. This makes me think that they simply tried to use some other hacked site, and checked to see whether the same pwd was recycled for gmail.
With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say:
"During sign-in, you can tell us not to ask for a code again on that particular computer."
Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
I'm not sure exactly what point you're trying to make, but you seem confused about how 2FA works.
The goal of 2FA/MFA is to make you demonstrate that you're in possession of two independent secrets (authentication factors). Once you've shown that, it's considered safe enough to replace the second secret (OTP sent to your phone or generated by your TOTP app like Google Authenticator) with a cookie (the check is not IP-based). Typically the cookie only lasts for 30 or 60 days.
If what you're concerned about is the idea that Google knows your phone number, you can use Google Authenticator or another TOTP app instead.
I do have an OSS client, but the very first step to enable Gmail's 2FA is to give your phone number.
I agree that there are good reasons for asking that, but the comment above apparently raises a good point, namely, that you apparently cannot enable 2FA without giving Google your phone number.
I have a couple of old legacy gmail accounts I don't use any more but still keep active, so I have 2FA on them, but anything important goes to my own mail server.
>Probably to prevent an attacker from stealing your account, but not to stop them from reading your emails.
Since nothing important goes to them any more and I mainly keep them active to stop them getting squatted for for some highly intermittent email (3+yrs) I might have forgotten, then it doesn't matter much there. As it is, the main attacker where gmail is concerned is google itself, followed by the NSA.
As for other people with gmail accounts, yes, but I'm aware of when that happens and wouldn't email anything sensitive to any gmail(hotmail,yahoo,etc.) account.
The problem is that, as a security solution, having your own mail server and being careful about who you send emails to doesn't scale and it's not feasible in the general case. If you're worried about Google/NSA/spies as the main attackers, I'm not sure hosting your email is the best solution. Yes, it works if you never send email to anyone with Gmail, Yahoo, Hotmail, etc. But that will prevent most normal uses of email. And if you do send email to regular people, then someone, somewhere, will read your emails; that's what they are for after all. And then the privacy of your email is as good as the security measures your recipient has in place.
Same with 2FA: it's a security measure to make it difficult for an attacker to gain access to your account, and one all of us should use, but it's not there to prevent them from reading your emails.
Maybe the overall solution is "don't use email -- self-hosted or otherwise -- for anything sensitive, ever." This will probably work, but is not feasible for most of us.
My gmail(and aws and dropbox and digital ocean and github and zoho and ...) TFA uses a TOTP app, not my phone number. (and works just fine on my iPad - which doesn't really have a phone number - at least not one I know or worry about...)
Also, according to the three biggest telcos where I live:
> Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways.
Although that wouldn't be 2FA, it's worth noting that Facebook, Hotmail and Flickr will ask for some extra verification if you connect from a different country that usual. So that's probably not a bad idea.
> With two-factor authentication you are happily providing gmail with your phone number.
Which I also provide to Google because all of my phone numbers are forwarding numbers for my GVoice account, so that's not a big deal.
> They say they need this to send you a verification code when you log into your gmail account.
Sure.
> Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
How can they determine its valid without the second factor the first time you log on from a particular device? That's a key feature of 2FA (plus, if you ever use a shared computer, you don't want to choose the option to never ask for a code again on that computer!)
It's a fair point though. At some point you're putting too much of a barrier on everything. You can have security and convenience at the same time, we just haven't done it yet.
However, I have 2FA turned on with GMail and I authenticate basically once, then it remembers my PC and I don't have to authenticate again for a long time.
Actually, I was recently pointed at Joyent's node-http-signature[1], which is pretty clever. It can sign an HTTP request using one's SSH keys. Handy for a CLI client for a HTTP API.
I've done a couple of HTTP auth schemes for my dayjob and am thinking of using something like this for my next.
as long as we need to depend on javascript for crypto there will not be a secure way to do such things. im saying this because you can not safely assume the integrity of your crypto system to be intact if you have to download it with the page it's used on. thats about the same as always having to download your ssh client first from the server you are connecting to. someone could tinker with that download and give you something that uses the attacker as a proxy to connect to your server of choice and while you notice nothing, that malware would upload your private key. same thing could happen when you use some sort of crypto implemented in javascript.
lets talk about this when someone made it possible to have a website instruct the browser to make a call to a crypto library or some such
Indeed; more generally, I said CLI. TLDR of the previous link: it's an interesting general-purpose take on using ssh public/private keys (and methods) to sign and authenticate HTTP requests.
The passwords seem to have come from somewhere else. My email is on the list, but the password is wrong and actually matches the one I use for throwaway accounts.
140 comments
[ 4.9 ms ] story [ 209 ms ] threadI generally don't bother, because it's just more security risks.
http://arstechnica.com/security/2012/12/how-script-kiddies-c...
Let's do some quick back-of-the-envelope math. 5M addresses, with very few longer than 25 characters. Let's say the average is around 17 characters. 17 * 5 * 10^6 = 35 * 10 ^7 = 3.5 * 10^8 bytes, or 350MB. Text generally compresses to 1/8 space with zlib, so the amount to transfer would be about 44MB, at most. Serving the list as xz compressed file could probably cut the size down to below 40MB.
In the age of 100MB youtube videos, that doesn't sound like much to me.
http://arstechnica.com/security/2012/12/how-script-kiddies-c...
If you check a username, then you would probably also be revealing the IP address range and browser referrer that is normally used to access your account.
Google uses IP address and location to help detect illegal access. So giving away this information could make it easier for your account to be stolen.
He might even be able to use the same IP as you, if you happen to be using a gateway with many machines behind it, and one of them is compromised.
Notwithstanding the questionable reliability of this what is meant by "leaked"? a trove of phished credentials does not really qualify as a "leak".
Edit: to clarify, I had 2FA on an account which alerted me to the Gmail compromise. I obviously messed up with that email account.
So I don't think this is a hack of google itself, but rather just collecting addresses from elsewhere and collecting the gmail ones.
https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4...
Alternative: http://rghost.net/57937836
The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails
EDIT: Not blind, it just doesn't show the initial letters if you search using a wildcard even if there is only 1 match.
https://gist.github.com/anonymous/255959493c0a26cce856
The data hasn't been very well edited from whatever dump it came from. For example, there are lines that end in "gmail.com_xtube", "gmail.com7777", "gmail.com|login", etc, which are curious.
EDIT: This was good to find out because I did not have 2 factor auth on my older account as I hardly use it anymore.
Though back when I had that password my account was hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.
Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.
And the password was one of my lowest security "trash passwords" I use with this e-mail as login sometimes if it's a service I wouldn't trust or don't care if it's compromised.
So I wouldn't worry about this. Someone had their site hacked most likely and these are logins to the site, not from Google.
I had (stupidly) been using the same password on other sites, so after I was hacked i made a new password just for gmail.
Now I also have two factor authentication :)
That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.
I now use KeePass2 to manage all my passwords - so the old password has absolutely nothing to do with the new one. This makes me think that they simply tried to use some other hacked site, and checked to see whether the same pwd was recycled for gmail.
- Google: https://www.google.com/landing/2step/
- Github: https://github.com/settings/security
- AWS: http://aws.amazon.com/mfa/virtual_mfa_applications
- Facebook: https://www.facebook.com/settings?tab=security
- Twitter: https://twitter.com/settings/security
- Dropbox: https://www.dropbox.com/account/security
- Lastpass: http://helpdesk.lastpass.com/security-options/google-authent...
- More: https://twofactorauth.org/
"During sign-in, you can tell us not to ask for a code again on that particular computer."
Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
Open source fork of the (now closed source) Google Authenticator.
The goal of 2FA/MFA is to make you demonstrate that you're in possession of two independent secrets (authentication factors). Once you've shown that, it's considered safe enough to replace the second secret (OTP sent to your phone or generated by your TOTP app like Google Authenticator) with a cookie (the check is not IP-based). Typically the cookie only lasts for 30 or 60 days.
If what you're concerned about is the idea that Google knows your phone number, you can use Google Authenticator or another TOTP app instead.
I'm under the impression that you need to provide Google your phone number before being allowed to enable TOTP.
I guess phone number is needed for the secure reset. In the case you lose the device this would render your account inaccessible.
I agree that there are good reasons for asking that, but the comment above apparently raises a good point, namely, that you apparently cannot enable 2FA without giving Google your phone number.
I have a couple of old legacy gmail accounts I don't use any more but still keep active, so I have 2FA on them, but anything important goes to my own mail server.
Do you encrypt your emails? Do you regularly send emails to other people (who probably have Gmail accounts)?
Since nothing important goes to them any more and I mainly keep them active to stop them getting squatted for for some highly intermittent email (3+yrs) I might have forgotten, then it doesn't matter much there. As it is, the main attacker where gmail is concerned is google itself, followed by the NSA.
As for other people with gmail accounts, yes, but I'm aware of when that happens and wouldn't email anything sensitive to any gmail(hotmail,yahoo,etc.) account.
Same with 2FA: it's a security measure to make it difficult for an attacker to gain access to your account, and one all of us should use, but it's not there to prevent them from reading your emails.
Maybe the overall solution is "don't use email -- self-hosted or otherwise -- for anything sensitive, ever." This will probably work, but is not feasible for most of us.
Also, according to the three biggest telcos where I live:
"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," ( http://www.itnews.com.au/News/322194,telcos-declare-sms-unsa... )
Although that wouldn't be 2FA, it's worth noting that Facebook, Hotmail and Flickr will ask for some extra verification if you connect from a different country that usual. So that's probably not a bad idea.
Which I also provide to Google because all of my phone numbers are forwarding numbers for my GVoice account, so that's not a big deal.
> They say they need this to send you a verification code when you log into your gmail account.
Sure.
> Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..
How can they determine its valid without the second factor the first time you log on from a particular device? That's a key feature of 2FA (plus, if you ever use a shared computer, you don't want to choose the option to never ask for a code again on that computer!)
However, I have 2FA turned on with GMail and I authenticate basically once, then it remembers my PC and I don't have to authenticate again for a long time.
I've done a couple of HTTP auth schemes for my dayjob and am thinking of using something like this for my next.
1. https://github.com/joyent/node-http-signature/blob/master/ht...
as long as we need to depend on javascript for crypto there will not be a secure way to do such things. im saying this because you can not safely assume the integrity of your crypto system to be intact if you have to download it with the page it's used on. thats about the same as always having to download your ssh client first from the server you are connecting to. someone could tinker with that download and give you something that uses the attacker as a proxy to connect to your server of choice and while you notice nothing, that malware would upload your private key. same thing could happen when you use some sort of crypto implemented in javascript.
lets talk about this when someone made it possible to have a website instruct the browser to make a call to a crypto library or some such
Please read up on what "nodejs" is before lambasting it with an oft repeated security trope.
Indeed; more generally, I said CLI. TLDR of the previous link: it's an interesting general-purpose take on using ssh public/private keys (and methods) to sign and authenticate HTTP requests.
EDIT: Not seeing the password list online, and below someone mentioned it showed an old password for them, so thinking someone is making this up.