There is a lot of hype in this article and precious little in the way of verifiable facts.
Does anyone have any links to something more credible?
There is a lot of hype in this article and precious little in the way of verifiable facts.
Does anyone have any links to something more credible?
OMG OMG ACT NOW! WE'RE ALL GOING TO DIE
twice a week...
I'm getting so tired of these clickbait articles always everywhere screaming at you.
I get the point, passwords leaked, AGAIN, they leak every week from somewhere, but can you just tone it down?
Pretty please?
Can someone check if my password was leaked? It's "Hunter2". Thanks.
"It’s why Google is telling billions of users to replace their passwords with much secure passkeys."
Editing failures kind of undermine the credibility of the article. You literally had one job.
I’ve pretty much stopped caring about hacked / leaked creds. I figure I’m boring and ordinary enough that though I’ll maybe get targeted eventually, there’s not much to gain and so whatever.
There is a lot of hype in this article and precious little in the way of verifiable facts.
Does anyone have any links to something more credible?
The article is full of typos, too.
Who let this dreck out the door? Did Forbes lay off all their editors or what?
AI doesn't make typos
https://cybernews.com/security/billions-credentials-exposed-infostealers-data-leak/
Several collections of login credentials reveal one of the largest data breaches in history, totaling a humongous 16 billion exposed login credentials. The data most likely originates from various infostealers.
Might be a bit early for a better source. I decided to share because if it is true its important to get it on peoples radar.
This appears to just be a compilation of other leaks: https://www.bleepingcomputer.com/news/security/no-the-16-billion-credentials-leak-is-not-a-new-data-breach/
Still not a bad idea to change passwords and make sure MFA is enabled.
As far as I know, the passwords aren't stored in the databases, it's the hash produced by a one-way function that is stored in the database. Grabbing these is useless.
Hashes can be brute forced, it's just normally too expensive to do so for any reasonably complex password. If you're using "password123" as your password even a hashed password is easily cracked (salting and peppering can help make this more difficult, although still not impossible).
I'm perfectly aware anything can be brute forced and that's why it doesn't worth to mention. Now, the amount of resources required to brute force a hashed password has nothing to do with the complexity of the password. No matter what the password is, the hash will have a fixed length and appear as a random sequence of bytes. Otherwise you are not doing it properly.
The complexity of the password has something to do with guessing the password from dictionary or known most common passwords.
Kind of both. The modern way of brute forcing is to just hash the 100,000 or so most common passwords, previously leaked passwords, and minor permutations of all of the above. It's computationally and space intensive, but for a determined attacker entirely doable on modern hardware. That's why complexity matters, because it's not a simple iteration through every possible permutation, but a targeted search through a known password list.
What is this article? Besides terrible, I mean. This article is terrible.
First of all, this isn't a new leak. It's not even a combination of old leaks. It's just somebody noticing that a bunch of leaks existed and did an Excel Sum operation on the passwords on them.
According to Vilius Petkauskas at Cybernews, whose researchers have been investigating the leakage since the start of the year, “30 exposed datasets containing from tens of millions to over 3.5 billion records each,” have been discovered. In total, Petkauskas has confirmed, the number of compromised records has now hit 16 billion. Let that sink in for a bit.
And to add insult to injury, the article has this gem:
Is This The GOAT When It Comes To Passwords Leaking?
Password compromise is no joke.
Certainly not with writing like this.
Clickbait from Forbes, with not a single mention of 2FA/Two Factor Auth?
https://files.catbox.moe/n4627i.jpg
Colour me not surprised.
https://news.ycombinator.com/item?id=41590466 https://larslofgren.com/forbes-marketplace/
tldr OP shouldn't be posting Forbes articles
It’s why Google is telling billions of users to replace their passwords with much secure passkeys.
Much secure. So passkey.
If only passkeys were not another excuse for user lock-in.
Also, users benefit from password sharing. Stop pretending that doesn't exist.
all 14 comments