Inside the Massive 711M Record Onliner Spambot Dump | Hacker News Reader

Inside the Massive 711M Record Onliner Spambot Dump

troyhunt.com

67 pointsrobin_reala18 comments

Things I Dread/Appreciate Seeing in my Inbox #47: "Have I been pwned?"

Such a valuable free service. https://haveibeenpwned.com/

Just got my notification about this one today [sigh]

Does anyone have the password section of the dataset? My email address is in the list, but I care more about which (if any) of my passwords was exposed.

I believe there's a new section of the site where you can enter the password and see if it's been pwned, it should've been updated to include this latest dump.

that... seems like a bad idea.

Yes, just intercept the connection or some phishing server and you are really pwned.

If that https connection can be intercepted, you might have more to worry about.

Btw this is the page: https://haveibeenpwned.com/Passwords

and before you complain, at least read Troy's article where he introduces this service.

https://www.troyhunt.com/introducing-306-million-freely-down...

Oh wow, what? Why would anyone encourage this? The data is out there, it's a public dataset, just show me the password or a hash of it or something.

The site does say "Do not send any password you actively use to a third-party service - even this one!"

I think what he's getting at is whether there is a place where he can look up whether his email, in combination with a password, was leaked.

At the very least, I wish HIBP could distinguish between whether the data contains an email-plus-password or the email address only.

It does.

It indicates what data has been disclosed for each hacked source (Email, Password, Usernames, Credit cards, Names, etc).

https://haveibeenpwned.com/Passwords

I wouldn't use the form, but that page also has download links of password hashes for you to check locally.

The blog seems to indicate that this list appears to be made up of previously leaked/available lists that were already out in the wild.

It indicated LinkedIn as one of the likely sources.

I know an email address that appears in this leak but not in any other leak that hibp knows about. That might invalidate that hypothesis (or alternatively hibp's dataset might not be as complete as it could be).

hipb dataset is rather lacking.

The spam list is 711M emails. The post indicates that it's made up of several existing datasets combined together.

I wasn't implying this was just LinkedIn data, apologies if my tl;dr of the article wasn't clear.

You should just read the blog post.

I suppose I shouldn't be surprised (since this is a list of pwned data), but it's sad how, out of all the passwords shown, every single one sucks balls. steve123? C'mon guys!

1. Used the password for the email? Change it!

2. Used the password everywhere? Change them all!

Reply on news.ycombinator.com