Slashdot Mirror

← Back to Stories (view on slashdot.org)

What Happens When Google Doc Credentials Are Leaked On the Dark Web? (csoonline.com)

Posted by timothy on from the nothin'-good dept.

itwbennett writes: It only takes one day of online credentials being available on the Dark Web before login attempts will start, according to security company Bitglass, which set up a simulation using fake credentials for a Google Drive account, complete with real credit card details, fake corporate data and personal data, according to Bitglass' report. Bitglass said there were three attempted logins to Google Drive in the first day and five attempted logins to the fake bank site. Within two days, files were downloaded from the Google Drive account.

4 of 27 comments (clear)

  1. Your point? by jason777 · · Score: 3, Informative

    So? Then dont leak personal details. Why wouldnt you expect people to try it?

  2. Are you seriously suggesting by Maritz · · Score: 2

    That if you post your login and password to Google Drive on the dark web/Tor hidden services, people will try to login to your shit? I don't fucking believe it.

    --
    I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
  3. I don't get the siginificance by gatfirls · · Score: 4, Interesting

    It seems to me like a local news story where they leave a bike to be stolen in an area that is known for it and acting like it's news that people...try to steal the bike.

    Seems like it would be more interesting if they made some sort of honeypot with something they would want like a CC list or something that has a good password and see if/when people get in without social engineering etc.

  4. Google already lets you protect yourself by Solandri · · Score: 2

    Just enable 2-factor authentication on your Gmail/Google account. (Note: I linked to Authy because I recommend it over Google Authenticator. Authy requires you to enter a passcode or password to view an authentication code. Authenticator will just spit out the authentication code if you're in possession of the account owner's device. Kinda defeats the purpose if you're trying to protect yourself if your phone should be stolen.)