0

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum.

A media article on the leak

Other media have reported that the password is typically not a gmail password and might be used on systems other than gmail where the gmail address is the identifier. I want to determine which of my passwords was paired with my gmail address. The link has a zip (7z) file and it appears that there are only gmail addresses present -- no passwords. Other media have reported that the posted file has been revised to exclude the passwords.

Is there a website that will email (to my gmail) the password that was leaked?

4

Responsible media outlets which have obtained the original data set for a password leak will not publicly disclose the passwords. You can go searching around for the raw breach data yourself, but the areas of the internet which would advertise hosting of such data (after it's been pulled from Pastebin and the likes) are likely riddled with malware and exploits.

If your email is listed among those included in a breach specifically associated with your mail provider, it would be safest to assume the email account itself was compromised.

Given that other sources are claiming that the password data may actually be from services other than GMail itself, you should also assume (if your email is listed) that any other accounts associated with your email address are also compromised.

As an aside, you may want to check out http://haveibeenpwned.com. There, you can plug in your email address and see which (if any) public data disclosures it has been found in. Recently, functionality was added which also searches some sources from Pastebin and similar sites.

  • The responsible media outlet could be more "community minded" and then send a message to my Gmail to tell me the password. That way I would not have to change the password for every service that uses that identifier. – H2ONaCl Sep 13 '18 at 21:55
  • Any responsible individual in possession of password data - regardless of their job or how they acquired it - would not be emailing it in the clear, much less to recipients they have no means of reliably authenticating. – Iszi Sep 13 '18 at 22:00
  • There seems to be no harm in sending the password to my gmail account. If the gmail account is secure there is certainly no harm. The account might be secure because the gmail identifier password pair was used to authenticate for a system other than gmail. The media reported that this is typically true of the leaked pairs. If the gmail account is compromised by the associated password, then an email content containing the password would be disclosing information that the intruder already possessed. – H2ONaCl May 20 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.