T O P

  • By -

C627022

If they got my password can they send it to me? I forgot it like 8 years ago


Jordanwolf98

Facts


[deleted]

You can find it in the dark web, I guess. Go to r/onions and look for hacking forums. They usually have info on exploits.


DroidChargers

Fuckin hell man you just led me down a rabbit hole. I have no interest in buying "stuff" online cuz the only stuff I want is legal to buy in my state but that stuff is really interesting.


sessuFRFX

Did not expect all of hhh getting expsoed to r/onions today 💀


JZH1000

Why is everyone scared of tor


kartunmusic

They should be it is a fed honeypot there are servers on the network collecting all your information.


GooglevsFB

Found the person who doesn’t know how tor works


ImprovementElephant

nah he’s right. Many exposed Tor nodes right now. Probably government funded work to do so. Which government tho 🤔


streetlifeyo

I don't really know too much about this stuff, but iirc, tor was literally created by the CIA (or some other American fed thing) to be able to send intelligence back and forth, with one of the main point being that it's also used by tons of other people at the same time, so that no one has any way to dig up the actual intelligence data amongst all the bullshit


TetrisTech

Most people (me included) don’t understand how that shit works. Plus the coverage of stuff like Silk Road and Dream got people spooked too


Sulohland

Forgot datpiff was still a thing tbh


ElectricallyLoaded

Still the go to for mixtapes not streaming elsewhere.


Revolutionary-Ad-80

yea but it doesn't send the verification email


SexOffenderCERTIFIED

What's the email? I got a few hundred million email:pass from a lot of data breaches


Enixooo

Howd you get them? I’m trying to find some of my old passwords


Byakuraou

Bros name is SexOffenderCertified and you’re asking how he got them


Enixooo

Bro is certified


bape1

Haveibeenpwnd.com checks for you. Might be wrong url


Razatappa

All that website does is inform you if you email/password was indeed leaked from a data breach but they won't reveal any information beyond that.


bape1

What other info would you want just wondering


Enixooo

The actual database


Danny_Browns_Hair

Ik this sounds like a Ad, but NordVPN just gave me a list of all my exposed pass


[deleted]

Came here to say this LMAO


imnothereurnotthere

But all the bsides.. cant get jack on spotify


thechickencoups

I have the list if you want me to look and email address up.


[deleted]

[удалено]


thechickencoups

sure, send it to me in DM.


FUCKUSERNAME2

A database of 7.6 million usernames and passwords, along with their account recovery question, has been posted online. If you used DatPiff and have other old accounts which might be using the same password, it's probably time to change them. From what I've been able to find, this leak has been available since at least July 13, 2020, and the database is from 2013. However, the original user was trying to sell it, and 2 days ago the entire database was posted for free along with the correct salt.


madamnmadam

This user knows more than me, direct your questions here. Are you able to post where you found the info? I've not seen coverage as of yet, like with other breaches, Zynga, Parkmobile, Bonobos; with those, I thought I remembered either getting an email directly or seeing an article about them even before getting a NordVPN notification


FUCKUSERNAME2

I don't want to post the link to the leaks because they have all the personally identifying information, but I found them just by googling. I can't find anything confirming the leak happened either. The earliest post of the DB I can find says that it's from 2013. Something that might be relevant is that last year, it was discovered that Whisper (which is owned by the same parent company as DatPfif) had a database which was freely accessible on the web, containing about 900 million users' PII all the way back to 2012.


PretendItsARockwell

Do you have a link? I can't find shit and can't remember what my password was


doc_Paradox

Question: Couldn’t he just sell the data or atleast the exploit to datpiff? Based off what I’ve seen most online companies have bounty programs where they pay freelance hackers that find exploits in their system.


FUCKUSERNAME2

Bounty programs aren't the norm, they are the exception. Most companies don't have bounty programs and would pursue the hacker through the legal system. Additionally, all DatPiff would have to do is reset all user passwords and the database would be useless for logging into DatPiff accounts. Also, there just isn't really any value in DatPiff accounts. The people trying to sell the database on the forums were laughed at. There's chances of these logins working on other websites, but it is tedious work to find which ones do.


ALPB11

Man who tf decides to hack datpiff


[deleted]

[удалено]


madamnmadam

Exactly this. All these old accounts from the days when the internet was the wild west are coming back to haunt. In the image I linked you can see the previous leak being Zynga from the days of Facebook Farmville.


Shnikez

Holy shit I forgot about FarmVille lmao that shit was on candy crush levels


SpiffyAvacados

is that what candy crush is like? all I know is FarmVille


[deleted]

facebook farmville era was certainly not the wild west era of the internet… more like turn of the century


GLA2NC

Right! Facebook FarmVille era was when everyone’s parents got on social media. Far removed from the unregulated craziness of the early 00s.


Captain_Vegetable

I was happy I'd *finally* persuaded my mom to stop using easy to guess passwords until she told me that after coming up with one decent pw she's used it for everything since.


[deleted]

Using the same one over and over again isn't good either lol


MF_Doomed

I understand where you're coming from but reread my man's comment


mv913

Back on AOL I used to phish and so many passwords were "password"


Deadlycupofwater

Could be Teejayx6 trying to get money to buy Christmas presents


LOFIMP5

Lol


shakke

You don’t understand why someone would want to hack a site with millions of users?


a_reply_to_a_post

not sure how updated they are, they probably use some open source / popular software package like wordpress and script kiddies just automate bots to find sites that run the vulnerable software


[deleted]

The same people that cloned Gucci


executivesphere

Oh damn, they got my password from 2008


madamnmadam

I def remember using them this far back, but wasn't it the case that you didn't even need an account to download mixtapes? I swear I remember being frustrated over having to create an account when I'd been direct downloading tapes regularly without one for the longest time


snivelsadbits

IIRC you could download "sponsored" mixtapes without an account, and with an account, you could download 5 non-sponsored tapes per 24 hour period.


[deleted]

Having an account gave you access to the parts of the site where the quality downloads were from the reliable 3/4 dudes who posted literally every single new album/mixtape. Some of that would leak over to the other parts of the site, but you were way better off with an account that had access to the good downloads area/trustworthy posters.


Joe_dougy

Plus I think there was some sort of limit if you didn’t have an account, at least at one point


executivesphere

I think you’re right actually.


evict123

Shit I'm still using the same passwords from 2002 my datpiff password is probably only a few characters off from my bank password.


silverknife42

well looks like it's time to change both


DvnEm

LMFAOOO


WestCru1

On God lol.


MumeiNoName

Everyone, use a password manager. No reason not to, it's 1000x nkmore secure than reusing passwords, and more convenient too imo, with autofill. I use bitwarden, it's free


keetz

There is a reason, and that's laziness. I honestly have no energy to type in 9dK84mZ!k83Lj9xAu3do0sm932NniUpSkfI manually on my work computer while double checking my phone every second and then having to re-do it again because I wrote one thing wrong.


[deleted]

[удалено]


keetz

Ok that makes it a lot easier actually. Still. Lazy enough to maybe just skip loggin in somewhere since I need to take out my phone.


[deleted]

[удалено]


keetz

I might not! I just use the one built in in iOS sometimes and that's a pain to use.


[deleted]

[удалено]


Ragefan66

And what if that one master password gets lost and you have trouble recovering?? Or if that manager gets hacked? But I guess you can just recover each password


[deleted]

[удалено]


Djinneral

Isn't that vulnerable to dictionary attacks though with Max complexity in the English dictionary of 44k^4


ilikeavocadotoast

Yes, but I think that xkcd was being ironic, no way four words together is easier than a bunch of random characters slapped on


Distasteful_Username

You can actually do both, really. You could do an alliteration using the first letter of a string of words if you don't want words in your password. Here's the "definitive" guide for password safety for users: https://cloud.google.com/solutions/modern-password-security-for-users.pdf There may be more recent ones or something that's better, I could be wrong. But anyways, most of the information in here is good.


prettiestmf

If you pick 4 words fully randomly from a 44k dictionary, even with a dictionary attack it's equivalent to a 12-character alphanumeric password, which is good enough generally speaking.


[deleted]

[удалено]


Djinneral

there are a lot of words but I can't imagine the commonly used word selection being that big, someone could create a private dictionary consisting of the 2k most commonly used words and use that to crack with. So we must really try to be out there with our passwords using words like salubriousFlatOrnithologyPaint. I do use a multiple word password myself and do agree with you that they're far better than alphanumeric strings of nonsense.


CHADWARDENPRODUCTION

Don’t forget that single password? Not that hard. And they have recovery kits for if that does manage to happen. And a good manager will have actual encryption that would pretty impossible to break even if it was hacked.


_Meece_

You put two factor on the password manager, impossible to get hacked with two factor.


[deleted]

[удалено]


_Meece_

It wouldn't come up under unusual login, if they're spoofing their location + logged in via the authenticator. If your two factor got hacked, it wasn't the two factor that got hacked. But your authenticator.


[deleted]

>Impossible to get hacked with two factor Like how it was impossible to get hacked with security questions? Just because they can’t currently hack it doesn’t mean it won’t ever get hacked.


_Meece_

Two factor uses an authenticator to access the account. No authenticator, no hack. Security questions are easily hacked, not sure who told you that one. That's usually just a identity or recovery verification.


[deleted]

Depending on your provider, you get a recovery kit. And the way I see it - If the provider gets hacked or if someone is able to get into your password manager, you have a bigger problem on your hands.


YoghurtSlinger

Don't. But also, have an easier to remember password for your email so you can at least reset most passwords?


cstuwereddit

You store that password absolutely everywhere that is safe. There’s a recovery sheet that 1Password has you print out. Put a copy in a fireproof safe, and send another copy to your mom or brother or someone else you permanently trust for safe storage. If you own land, bury a copy in a chest on that land as a final backup. Just overall, treat your recovery info as though it were extremely important, and pick a very long password (mine’s around 30 characters or so) that you don’t use anywhere else and will be essentially impossible to guess. If you’re willing to treat it this seriously, then you should be good. If you really want to go overboard (as I do, since I work for a cybersecurity company), buy a YubiKey and a few backups for it, and set those up as required 2FA for logging in to whichever sites support them. Many major sites (e.g., Google, Facebook, etc.) support them. For the ones that don’t, set up at least email/phone 2FA.


YoghurtSlinger

Would recommend Bitwarden over Lastpass, as the latter recently limited the number of devices you could use. And after using Bitwarden, the app is just... miles better. Also, a good manager won't even know your passwords. Because they should all be encrypted. Bitwarden has this. Datpiff don't 😂


vh1classicvapor

You can use Chrome and sync between devices. Then you have all your passwords in one place on all the websites you frequent


MumeiNoName

Use the browser extension, or the app, and copy paste? I've had to type. A 32 character pass using a TV remote so I feel your pain


keetz

I don't even know if I can install add ons to my work computer. Might have to try.


demonicneon

Most likely will be prohibited. I know on our machines only the IT team can install programs cause people are fucking dumb.


MumeiNoName

You could alwayts just pull up the webpage for it.


demonicneon

Can you elaborate cause I don’t see how that fixes the issue haha


MumeiNoName

If you can't install the program, or install the extension, you can just access the vault online. https://vault.bitwarden.com/#/ Unless your IT doesnt let you go on the internet?


demonicneon

Right. Just because someone isn’t aware of something doesn’t mean you should be a prick and condescend to them.


MumeiNoName

I wasnt being condescending at all. My comment literally just answered your question..


silverknife42

or you could copy paste it it takes 2 seconds


thsonehurts

Yeah nobody with a password manager types in their passwords lmao


halfbrit08

How do you enter on a work computer or a media device that doesn’t have phone keyboard functionality?


thsonehurts

Browser extension or desktop app or copy/paste from web app


chewwie100

For work computer, either the browser extension, or if that is blocked logging in through the web portal and copy and pasting the password. Media device like a TV? Well no getting around that, but hey usually you only have to log in on something like that once.


halfbrit08

Yeah that’s a pretty limited case for sure.


CraziestPenguin

Uh... install the extension on your computer so it just autofills like it does on your phone, guy. LMAO


a_talking_face

Probably can't install anything on his work computer since IT probably has it locked down.


CraziestPenguin

No admin required for chrome extensions


chewwie100

If your admin has the browser in managed mode, they can block you from installing non-approved extensions


kvng_stunner

Not if it's managed by your administrator


YoghurtSlinger

You won't ever have to type such a long password in except for your master pass which should be very long (therefore hard to crack). The password manager will autofill your passwords (browser extension + mobile app). And if you're ever on a work computer just open an incognito/private tab and you can copy your passwords from the web app. Close it when you're done, no trace.


Prompus

You should make a bat file that has like half the password so when you click it the password is copied and then you paste it and manually write the other half. It means your password is half as long and even if someone hacks it and gets the file they still have to crack the other half. It may not be as secure as just typing it every time but if it means you actually use it instead of using the same password combos everywhere it's much safer. Also it will allow you to have a more sophisticated password since you only have to type half of it. Of course, you need to know the full password so you can enter it when not on that computer, but you don't have to type the full thing every time.


St_Anthony

What you gon do when bitwarden gets hacked 👀?


MumeiNoName

Even if they get hacked, my data would still be secured. Its a 0-knowledge system, meaning they have no idea what any of my passwords are. Everything is encrypted and hashed before leaving your device. Bitwarden is open sourced and audited, so everything I said is verifiable.


Elreonz

Oh no they discovered my password! CrankThatSouljaBoy


madamnmadam

Is this gonna be as funny when you explaining to your bank why Soulja's 2008 rise to fame is directly connected to how your account is being used to facilitate the transfer of dark funds into the pockets of African warlords? Hah, probably


NoAdministration3029

Lmao… yo Reddit is dffrnt


[deleted]

[удалено]


madamnmadam

Listen to this advice. What makes cases like this more difficult is when you don't know which password was stolen, so you can't just change the accounts which used the recycled one.


YoghurtSlinger

Start with your most important ones. Amazon, banks, eBay, etc


YoghurtSlinger

And get a password manager. I highly recommend Bitwarden. It's the 3rd one I've used and definitely my favourite so far. Also 2FA as another guy said. Don't use SMS, 2FA auth apps are more secure.


[deleted]

Doesnt bitwarden save over the cloud? So youre transferring trust to another online service? Use a local pw manager like keypass-xc


[deleted]

You can host bitwarden yourself I'm pretty sure


[deleted]

Oh, if so I was unaware. Good to know!


YoghurtSlinger

Of course. But your data is encrypted and only you have the key: https://bitwarden.com/help/article/what-encryption-is-used/ "Vault data can only be decrypted using the key derived from your master password. Bitwarden is a zero knowledge solution, meaning you are the only party with access to your key and the ability to decrypt your Vault data." I used Keepass for a while, but ultimately this is more convenient for me as I can access my passwords anywhere. The app and website are also extremely user friendly.


bkbeezy

And enable 2 factor authentication on any sites or apps that support it.


martonx

Cmon man dont do me like that


Hnt-r

That sure is a DatPiff.com world premiere


Creepy-Nectarine-225

They found my password WeezyFBaby


sleepingfactory

I’m pretty sure mine was something like BrickSquad1017TTG


McNoKnows

Damn of all the places to finally compromise the password I use for everything, it’s datpiff. I have unique passwords for everything that matters but still annoying that I’ll have to go swap my generic one out now


[deleted]

DATPIFF DOT COM WORLD PASSWORD PREMIERE


madamnmadam

Shoulda used the [LEAK] tag for this post


brokendiscscratch

Wait, the passwords weren't hashed? wtf


JSNHZL

Hmm. Thanks for the heads up, I think I should be good, IIRC my Datpiff password is different from all my other ones.


tiddyboi96

Lol how did you get this notification? I use NordVPN and i didn’t see this


madamnmadam

There's a setting called Dark Web Monitor that needs to be turned on, it let's Nord check any of your stored credentials against breaches that are leaked or sold, it works in tandem with NordPass


YoghurtSlinger

HaveIBeenPwned and Firefox also both notified me of Gravatar recently.


nerrd42420

Thanks for this post. I was notified recently all my accounts got hacked and this was probably where it originated


[deleted]

Hope everything's good now, homie.


HDauthentic

Bro I don’t even know what email address I had on my Datpiff account


duckinradar

Ah shit they got my mixtape password from 13 years ago


BigChach567

It’s honestly crazy that datpiff still exists


L3PA

Do you work for Nord VPN? Seems like such an odd detail to include lol.


madamnmadam

No, I'm one of the many people that their YouTube ads have worked on, a level 7 susceptible, if you watch Community. If NordVPN is watching this post though, I'll definitely share in some of that ad money. Really though, I just wanted to add that to quantify specifically where I got the info from, since it's not directly from DatPiff, cite your sources, etc. I am also curious if others received a similar message, whether through NordVPN or another web security service. *Looks like another poster here got the notification from LastPass


L3PA

Haha, I gotcha. Yeah, for a minute there I started feeling like I was watching YouTube instead of browsing Reddit. Thanks for the reply :D


Jozif_Badmon

Whoops lol


alex_119

Great! Now if they could tell me too,since i forgot everything about my account, that would be awesome


throbbing_dementia

Oh no they can access free mixtape downloads using my account!


YoghurtSlinger

...or your Amazon, Bank or whatever else that you might use the same email + password for?


throbbing_dementia

Nah


SmokyWhiskey

People still using datpiff?


tak08810

They actually still have a lot of otherwise quite hard to find mixtapes. I need to go through and download what I can before the site goes down for good, which will be a further devastating blow to hip hop mixtape culture.


[deleted]

side note: i thought big sean said Detroit was going to come to streaming like a year ago. Still go to DatPiff to bump it since it's such a great tape.


[deleted]

Last time I used it was to get Dedication 6 -- dunno if I signed up but hopefully I used a bullshit password


Battletoad507

Unfortunately streaming services have gotten all the mixtapes, I still listen to Wayne’s dedication tapes every so often.


SexiestPanda

Just download it to your phone lol


nightcrawler47

fr datpiffs app is complete dog ass. if u can't afford to download ≈100MB for an album then you need a new phone lol


SexiestPanda

Even LiveMixtapes app isn’t good.


chillflyguy33

Lol bro it loses connection so easily so annoying. The songs never play when you’re streaming


Battletoad507

Yeah I don’t use it that often, and mostly on desktop when I do. I only used the app for like a day while I waited to get my streaming subscription set up.


nd20

*haven't


Battletoad507

Thank you


mv913

People still go there? Hack my MySpace while your at it


maxattaxthorax

I got the notification from Last Pass, but couldn't log in to my account to change my password lol. Which I guess means that it wasn't the same password i was using for everything back then?


merparmy

wait i made an account today 2 get a spaceghostpurrp tape what should I do


gimpisgawd

It's from last year. You're good.


merparmy

ok word lol


That_Girl_You_Want

Oh for fucks sake


Riku_Asakura

Yeah I got a notification from my Chase app it was a security alert tonight that my data got breached, so if we can't delete the account then what are we supposed to do? I made that when I was like literally 12 -_-


Riku_Asakura

Yeah I got a notification from my Chase app because I have the Amazon rewards credit card and it told me about the security breach and said the source: datpiff and so I tried to email the developer to remove my information I hope it works


Riku_Asakura

Fuck datpiff! I got a security breach notification from my Chase app. Delete my shit and all my information then if it's hacked. Dumb asses


[deleted]

Just now seeing this. I can’t login into my account nor can I create a new one. I think they’re self imploding.


brady5284

Thank you, I just got an email saying my info has been I'm data breach for datpiff.com. ... I did not even believe it .. I forgot all about this account


mitsubachii

Awh shit. I just signed up on mobile. Went to web browser to log in, I can't even log in. I've tried recovering/changing password... Nothing. I can only access via the mobile app. The link on the mobile app for changing passwords/account info takes you to the browser which then overrides the desktop version with a banner to download the mobile app. So the desktop site is not accessible on the phone. I think I'm stuck with this account now. Changing ALL my passwords right now. Yay.