Largest dump in history: 2.7 billion records; 773 million of them unique; 140 million never seen before

#1

Originally published at: https://boingboing.net/2019/01/16/87-gb-12000-files.html

5 Likes
#2

“…a billion here, a billion there…”

4 Likes
#3

So you’re saying it’s time to change my password? I mean, passwords?

25 Likes
#4

Apparently I’ve been pwned. Changed my passwords. I have 2FA enabled already, and my old password wasn’t compromised, but better safe than sorry.

7 Likes
#5

I have been pwned on 2 websites out of probably hundreds. I’ll call that a win.

9 Likes
#6

Hmm. Tempting to put up a honeypot that’s “crackable” with vast amount of random user/passwords.

3 Likes
#7

I’ve been on these lists before, and it’s annoying because elite hackors keep trying to access my bank account using my “insecure web page password” instead of the “only that bank really long password” and keep triggering the bank to shut the account down.

14 Likes
#8

Did someone say “the largest dump in history”?

24 Likes
#9

Clean bill of health. Nice

3 Likes
#10

Good time to remind everyone that:

  • The BBS supports two-factor auth (2FA). Find it in your settings.
  • The reason to use the various login options we support (Google, Github, etc) is that they will block suspicious logins here, too. If you can’t/won’t enable 2FA, those are your next best option.
  • regardless of the above, get/use a good password manager, and use dedicated, unique passes for everything.
13 Likes
#11

My e-mail provider allows for up to 100 aliases for my account so I use unique e-mail addresses for banking, shopping, commenting on the internet, etc… So far none of the important ones have shown up on any of these lists.

3 Likes
#12

It’s actually very easy to come up with unique passwords for everything and have them written down in a way that avoids the evil maid problem. Here’s an example of an easy to remember, but hard to crack, Facebook password:

Ykwctam$?

That string of letters and symbols is difficult to remember, but you know what’s easier to remember? “You know what’s cooler than a million dollars?

And, writing the password down in a notebook could be as simple as:

$1B

This would be meaningless to any third party, but would immediately remind you of the password. Quotes from movies, lyrics, lines of poetry… anything you can remember offhand can be turned into an acronym for a password.

6 Likes
#13

Oh no, I got pwned, too. Discus and LinkedIn. Hmm, should I change my passwords? Nah, let the hackers have those accounts.

4 Likes
#14

jokes on them, i’m actually a honeypot

8 Likes
#15

A database of names and passwords weights 87Gb?!

Why not a simple txt file? What I am missing?!

1 Like
#16

Apparently I’ve been pwned on MySpace… MySpace? I don’t remember ever having joined MySpace.

5 Likes
#17

So what exactly does it mean if your email adress has been “pwned” but not the associated password? Just that the adress will show up in lists for spam but the account can’t be logged into?

1 Like
#18

I got a hit and after some reverse-checking, found it was a password related to the old windows app for tweetdeck. Weird.

2 Likes
#19

So how do you find out what site your email has been “pwned” for? Changing all my passwords would probably take a week!

#20

Only four breaches for my email address, and those are old breaches where I have since changed my password.
That’s the annoying thing about the “Have I Been Pwned?” website. There’s no way for it to practically update its records, so once your email account has been compromised, as far as the site’s concerned it’s compromised forever.

1 Like