Hacker News Reader

Comment by adamfeldman | Hacker News Reader

Why would you put your gmail address into a random website? Google, being Google, has already taken care of this: http://googleonlinesecurity.blogspot.com/2014/09/cleaning-up...

You should also already have two-factor authentication setup, so you shouldn't have anything to worry about: https://support.google.com/accounts/answer/180744?hl=en

View on HN

Says my account was hacked, but then gives me the incorrect two letters for the start of my password. Seems bunk.

Also, why wouldn't you give your email address to a random website? I have it plastered all over the net. Spam is a solved problem at this point. Ironically thanks to Gmail!

Agree on 2 factor auth though.

Says my account was hacked, but then gives me the incorrect two letters for the start of my password

Out of interest - are those two letters the start of a password from any other site?

Presumably the leak came from a third party site so it would be your password from there rather than your gmail password.

Nope, I have a throwaway I normally use but this isn't it. Not sure what this is coming from, but I don't recall any passwords that start with these two characters.

for me it shows first two letters of the email itself. I might have used the username itself as a password in some random site, but this is/was not my gmail password :)

The passwords didn't come from google.

It was someplace you used your email with that password. It had a couple of my emails all with the same throwaway password I only use on sites that I either don't trust or have no intention of ever using again.

If you search around the full leak is very easy to find

Most of the stories about this list have pointed out that it doesn't necessarily contain passwords from Gmail, but from various accounts that used a Gmail address as a username.

Someone on Slashdot searched for "+" suffixes in the list, as in username+suffix@gmail.com:

http://tech.slashdot.org/comments.pl?sid=5680529&cid=4787421...

Some of the most popular suffixes were xtube, daz (and daz3d), filedropper, and eharmony. The two characters returned by isleaked.com for my address could indeed have been from daz3d.com.

Reply on news.ycombinator.com