L
LeakedSource Blog
leakedsource.com · Company blog · on HN since 2016
LeakedSource's blog analyzed data breaches, covering password statistics and hashing weaknesses for leaks like Last.fm, Myspace, and Twitter.
What HN saysHN links it for breach details and password analysis, such as Myspace's duplicate passwords and Last.fm's unsalted MD5 hashes.
20HN people shared it
9linked it in comments
11stories submitted
455story points
10 years agolast shared
2016people per year2026
Most-shared posts
- 1Analysis of Twitter.com Leak3 people · 19 points · first shared 2016 · 2 comments on HN
- 2LeakedSource Analysis of Last.fm Hack3 people · 1 points · first shared 2016 · discussion on HN
- 3The longer passwords in the Last.fm database2 people · 141 points · first shared 2016 · 119 comments on HN
- 4Myspace was hacked2 people · 2 points · first shared 2016 · discussion on HN
- 5AdultFriendFinder was hacked1 people · 283 points · first shared 2016 · 242 comments on HN
- 6Leakedsource is a search engine for data leaked in a breach1 people · 2 points · first shared 2016 · discussion on HN
- 7Analysis of Dota 2 forums hack1 people · 2 points · first shared 2016 · 1 comments on HN
- 8Were your passwords compromised in the many data breaches?1 people · 2 points · first shared 2016 · discussion on HN
- 9A typical cease and desist letter1 people · 1 points · first shared 2016 · discussion on HN
- 10LeakedSource Analysis of *.mail.ru Hack1 people · 1 points · first shared 2016 · discussion on HN
- 11Rambler was hacked1 people · 1 points · first shared 2016 · discussion on HN
- 12Weebly1 people · first shared 2016
- 13Linkedin1 people · first shared 2016
- 14Vk1 people · first shared 2016
What HN people wrote when they linked it
creshal · 2016-11-21
Yes and no.
Pass phrases are good, since (if backed by the same amount of entropy) they're easier to remember than passwords.
But for $DEITY's sake, don't use sentences. Natural human language has very, very poor entropy – especially since people gravitate towards catch phrases, song lyrics and the like, which can be (and have been[1]) very easily guessed.
That's why I put in diceware as fallback recommendation – while dice aren't perfect, they're a very decent source of entropy.
[1] https://www.leakedsource.com/i/lastfmlong.txt
DanBC · 2016-05-27
https://www.leakedsource.com/blog/myspace
> Due to some accounts having two passwords, there are 427,484,128 total passwords for only 360 million users. Additionally, the accounts with password "homelesspa" seem to be automatically generated as all the emails that use this password follow the same format. We also suspect given the number of passwords with a 1 at the end, MySpace required numbers and letters at some point.
mattjaynes · 2016-10-20
More details and background: https://www.leakedsource.com/blog/weebly/
jrowley · 2016-09-02
You can get even better idea of their site growth (or lack thereof) from the above link (scroll to the bottom of the page) http://www.leakedsource.com/blog/lastfm
runesoerensen · 2016-09-01
> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing
Enough said.
> The most popular password pulled from the Last.fm database was 123456. Seriously, it’s 2016 people
Sure, but the breach was in 2012 TechCrunch. Better article: http://www.leakedsource.com/blog/lastfm
campuscodi · 2016-06-09
Can someone change the op's link to: https://www.leakedsource.com/blog/twitter
The real source, not this redundant media crap that buried the lede...
cpncrunch · 2016-06-09
>Can someone change the op's link to: >https://www.leakedsource.com/blog/twitter
No, let's not. First of all, leakedsource has already been submitted separately, but has fewer upvotes. Presumably people prefer the techcrunch version.
It's not really surprising, as leakedsource's article is poorly laid out. It doesn't even have a title (they've put "Preface" as a title, but that's the heading of the first section). Then there's the banner adverts at the top.
>The real source, not this redundant media crap that buried the lede...
The techcrunch article has responses from twitter and others, along with some analysis, so it's not "redundant media crap".
Jhsto · 2016-05-20
The said dump contains unsalted SHA1 encrypted passwords: https://www.leakedsource.com/blog/linkedin
executesorder66 · 2016-06-06
Better link: https://www.leakedsource.com/blog/vk