Collection #1 data breach

QlimaxUK · 17 Jan 2019 at 17:48

Don't know too much about this so I will post as I understand it...

So there has been a big email/password dump on a hacker forum (plain text format) millions of users maybe affected check https://haveibeenpwned.com/ to see if your on the list I will post news sources below:

https://www.forbes.com/sites/kateof...to-find-out-if-your-password-has-been-stolen/

https://bit-tech.net/news/tech/software/773-million-credentials-leaked-in-collection-1-database/1/

https://motherboard.vice.com/en_us/...tion-one-data-breach-password-hack-what-to-do

My question is, does anyone know if these are Email/Password combo's or separate emails AND passwords that are unconnected to each other and where did this data actually come from?

Energize · 17 Jan 2019 at 17:53

They will be connected if they are from the same source.

QlimaxUK · 17 Jan 2019 at 17:53

but whats the source?

Energize · 17 Jan 2019 at 17:55

QlimaxUK said:
but whats the source?

Article suggests there are multiple sources.

But you use separate passwords for your critical accounts like email and banking right?...

QlimaxUK · 17 Jan 2019 at 18:21

I do use separate password for most things I have just changed the pw for my 'main email' just in case

QlimaxUK · 17 Jan 2019 at 18:40

This is a tricky one as it doesn't actually tell us exactly which online services have been breached to get this data so all I can do is change the email account pw so they can't use that to reset the accounts they might want and do a lockout and I don't want to have to change every single account I have tied to this email + as mad as it sounds if I did get one of my 'web service accounts' hacked then at least I would know which service they got the email from and would know which password has been 'got'

VincentHanna · 17 Jan 2019 at 18:45

HIBP has a password checking bit if you are worried.

https://haveibeenpwned.com/Passwords

PiKe · 17 Jan 2019 at 18:47

VincentHanna said:
HIBP has a password checking bit if you are worried.

https://haveibeenpwned.com/Passwords

Not accurate, I often get emails with my password in plain text but that list says I haven't been pwned.

QlimaxUK · 17 Jan 2019 at 19:13

VincentHanna said:
HIBP has a password checking bit if you are worried.

https://haveibeenpwned.com/Passwords

YES I did see that part but call me paranoid but I don't trust that part as the log file of the query form on that site could get hacked and they will get your password that way

VincentHanna · 17 Jan 2019 at 19:22

But you don't enter the email address it relates to...

QlimaxUK · 17 Jan 2019 at 19:27

but I have already entered an email to that site so I am not giving them a password too

Mark1989 · 17 Jan 2019 at 19:32

Been pwned too apparently but with no direct source it's slightly annoying!

Flubble · 17 Jan 2019 at 21:12

i googled some of my old passwords and they are there in plain text, they were random letters and numbers too

i'm glad i stopped signing up to so many different sites, makes it easier to remember where i have

sometimes wish i could delete every trace of myself from the internet and start again

Feek · 17 Jan 2019 at 23:45

Going back more than ten years, I used a handful of generic passwords across sites (as I expect most of us did). I don't use them any more and have been using unique and complicated passwords since 2009. I'm using this as an excuse to go through every single login in my password manager (1Password) and change the passwords. It also means I'm having a good tidy up because a lot of sites I had accounts on no longer exist so I'm deleting them.

1Password is great, it checks on the fly against HIBP to show if any passwords have been compromised. None of my unique passwords have and I'll be very surprised if they are.

LoadsaMoney · 18 Jan 2019 at 15:25

Good News: No pwnage found!.

dowie · 18 Jan 2019 at 15:35

Thanks to the likes of linkedin, myspace etc.. I've already been pwned on multiple occasions.

I now don't know most of my passwords and simply get them autogenerated and stored.

glenimp617 · 18 Jan 2019 at 15:36

is it safe you enter your email address into that site?

Semple · 18 Jan 2019 at 15:44

QlimaxUK said:
but whats the source?

The source is normally something like pastebin, i think the researcher who runs the hibp site has a script/tool that looks at paste dumps to see if they match email/password combinations.

Unfortunately he'll never reveal passwords - which is annoying for us, as it means you can't then go and change just that sites password (or any others using the same password).

TheOracle said:
is it safe you enter your email address into that site?

It's run by a security researcher, it's been running for years and he's pretty open about how it operates etc.

Obviously your choice to enter your email address - there's no password request, so the worst thing that could happen is you get signed up for a load of junk.

touch · 18 Jan 2019 at 16:05

PiKe said:
Not accurate, I often get emails with my password in plain text but that list says I haven't been pwned.

It can only check against these leaks which have been released to the public. There's undoubtedly many other data breaches where hackers have kept or sold the data which are unknown currently.

shorttricky · 18 Jan 2019 at 16:16

QlimaxUK said:
My question is, does anyone know if these are Email/Password combo's or separate emails AND passwords that are unconnected to each other and where did this data actually come from?

it's a set of email addresses and passwords totalling 2,692,818,238 rows, spread over 12,000 separate files and more than 87GB of data. That includes nearly 773 million unique email addresses, and almost 22 million unique passwords, which actually come together to make 1,160,253,228 unique password and email combinations.

QlimaxUK said:
but whats the source?

Bunch of different breaches - full list here - https://pastebin.com/UsxU4gXA

PiKe said:
Not accurate, I often get emails with my password in plain text but that list says I haven't been pwned.

haveibeenpwned can only inform you about breaches they have listed in their database. A lot of smaller breaches haven't made it to their attention.

QlimaxUK said:
YES I did see that part but call me paranoid but I don't trust that part as the log file of the query form on that site could get hacked and they will get your password that way

The site never sees your password, only a hashed value - there's a really interesting readup about it at https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity