all 10 comments

sorted by: hot top controversial new old
[–] 50 points 1 year ago (8 children)

There is a lot of hype in this article and precious little in the way of verifiable facts.

Does anyone have any links to something more credible?

  • source
  • hideshow 8 child comments
  • [–] 30 points 1 year ago (5 children)

    The article is full of typos, too.

    Who let this dreck out the door? Did Forbes lay off all their editors or what?

  • source
  • parent
  • hideshow 5 child comments
  • [+] 12 points 1 year ago (3 children)
  • [–] 7 points 1 year ago (2 children)
  • [–] 4 points 1 year ago

    This appears to just be a compilation of other leaks: https://www.bleepingcomputer.com/news/security/no-the-16-billion-credentials-leak-is-not-a-new-data-breach/

    Still not a bad idea to change passwords and make sure MFA is enabled.

  • source
  • 14 comments in c/news@lemmy.world view that post
    [–] 54 points 1 year ago (4 children)

    There is a lot of hype in this article and precious little in the way of verifiable facts.

    Does anyone have any links to something more credible?

  • source
  • hideshow 4 child comments
  • [–] 19 points 1 year ago* (last edited 1 year ago)

    Same - why I don’t have panic email from our csirt?? Oh - maybe their passw0rd was leek

    I’ve checked KrebsOnSecurity, SecurityWeek, BleepingComputer, and DarkReading

  • source
  • parent
  • [–] 7 points 1 year ago

    Does Tom's Guide (arc) count?

    But they have some caveats,

    ... due to the size and the fact there's no way to check one dataset to another, it's highly likely there's overlapping information. Meaning the researchers don't know exactly how many people have been compromised.

    All we know is that, according to the Cybernews [(arc)] report, one dataset (with over 455 million records) was named to "indicate its origins in the Russian Federation". Meanwhile, a second containing over 60 million records, was named after the messaging platform Telegram.

    While this is (to date) seemingly one of the biggest troves of stolen login data discovered, the researchers said the datasets they found remained exposed only for a brief amount of time.

    "The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data," Cybernews reported.

    That does not sound like a silver lining?

    Well either way, I'm not that familiar with CyberNews as a source, but glancing at their home page there's like 3 or 4 stories about data leaks, so idk if that's just life in 2025 or if they've got a bit of a preoccupation with that subject

  • source
  • parent
  • [–] 15 points 1 year ago

    OMG OMG ACT NOW! WE'RE ALL GOING TO DIE

    twice a week...

    I'm getting so tired of these clickbait articles always everywhere screaming at you.

    I get the point, passwords leaked, AGAIN, they leak every week from somewhere, but can you just tone it down?

    Pretty please?

  • source
  • [–] 14 points 1 year ago

    Until I see an email from haveibeenpwned, I call shenanigans.

  • source
  • [–] 9 points 1 year ago (3 children)

    Can someone check if my password was leaked? It's "Hunter2". Thanks.

  • source
  • hideshow 3 child comments
  • [–] 8 points 1 year ago

    "It’s why Google is telling billions of users to replace their passwords with much secure passkeys."

    Editing failures kind of undermine the credibility of the article. You literally had one job.

  • source
  • [–] 5 points 1 year ago

    Password managers and 2fa works pretty well.

  • source
  • [–] -5 points 1 year ago

    I’ve pretty much stopped caring about hacked / leaked creds. I figure I’m boring and ordinary enough that though I’ll maybe get targeted eventually, there’s not much to gain and so whatever.

  • source
  • 9 comments in c/technology@lemmy.world view that post
    [–] 1 point 1 year ago (4 children)

    As far as I know, the passwords aren't stored in the databases, it's the hash produced by a one-way function that is stored in the database. Grabbing these is useless.

  • source
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    Hashes can be brute forced, it's just normally too expensive to do so for any reasonably complex password. If you're using "password123" as your password even a hashed password is easily cracked (salting and peppering can help make this more difficult, although still not impossible).

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    I'm perfectly aware anything can be brute forced and that's why it doesn't worth to mention. Now, the amount of resources required to brute force a hashed password has nothing to do with the complexity of the password. No matter what the password is, the hash will have a fixed length and appear as a random sequence of bytes. Otherwise you are not doing it properly.

    The complexity of the password has something to do with guessing the password from dictionary or known most common passwords.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago* (1 child)

    Kind of both. The modern way of brute forcing is to just hash the 100,000 or so most common passwords, previously leaked passwords, and minor permutations of all of the above. It's computationally and space intensive, but for a determined attacker entirely doable on modern hardware. That's why complexity matters, because it's not a simple iteration through every possible permutation, but a targeted search through a known password list.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 19 points 1 year ago (3 children)

    What is this article? Besides terrible, I mean. This article is terrible.

    First of all, this isn't a new leak. It's not even a combination of old leaks. It's just somebody noticing that a bunch of leaks existed and did an Excel Sum operation on the passwords on them.

    According to Vilius Petkauskas at Cybernews, whose researchers have been investigating the leakage since the start of the year, “30 exposed datasets containing from tens of millions to over 3.5 billion records each,” have been discovered. In total, Petkauskas has confirmed, the number of compromised records has now hit 16 billion. Let that sink in for a bit.

    And to add insult to injury, the article has this gem:

    Is This The GOAT When It Comes To Passwords Leaking?

    Password compromise is no joke.

    Certainly not with writing like this.

  • source
  • hideshow 3 child comments
  • 2 comments in c/infosec_news@infosec.pub view that post
    [–] 8 points 1 year ago

    It’s why Google is telling billions of users to replace their passwords with much secure passkeys.

    Much secure. So passkey.

  • source
  • [–] 5 points 1 year ago

    If only passkeys were not another excuse for user lock-in.

    Also, users benefit from password sharing. Stop pretending that doesn't exist.

  • source