5 Million Google Passwords Leaked
Account names and passwords for 5 million Gmail accounts were leaked to Russian forums. A 50MB zip file containing the account names and clear-text passwords has appeared on various sites. Google released a statement that plays down (but does not eliminate) the potential danger. The statement says the users on the list have already been notified to change their passwords, and that "only around 2%" of the name/password combinations were still working.
Google says the leaks are not due to any security breach within Gmail but were obtained from other sources. The exact meaning of this disclaimer is not clear, but it is possible that readers were enticed to give up their Gmail passwords through a trojan or phishing scheme. Other passwords might have been obtained by attacks on third party sites that (for whatever reason) stored the user's Gmail password or, possibly, had a password that exactly matched the Gmail password.
One question that Google did not address (and probably doesn't know) is whether other password lists exist today that are still undiscovered. The best advice for avoiding ending up on such a list is the same as always for password hacks: According to Google, "Make sure you're using a strong password unique to Google. Update your recovery options so we can reach you by phone or email if you get locked out of your account. And consider 2-step verification, which adds an extra layer of security to your account." Google's press release points to a website where users can go to update contact and security information.
Related content
-
Setting up Google Apps for Work
We show how to set up Google Apps for Work and how to configure them for company use. -
Secure remote access and web applications with two-factor authentication
Making your systems really secure can be a bit more complicated than resorting to the use of regular passwords. In this article, we provide an overview of authentication solutions and present potential approaches for common use cases. - Opera’s Password Sync Service Compromised
-
Google+ with Business
Google+ isn’t officially ready for corporate use, but users are already excited about what this new social networking platform means for the workplace. We look at how you can leverage Google’s latest product for business and work around its limitations.
-
John the Ripper
Easy to remember but difficult to guess isn’t just a catchy phrase for choosing passwords, it’s the law of the Net. Learn how to check your password using a tool network intruders use every day: John the Ripper.