"Analysis of the "10 billion" aka Collection #1 password leak"

on YouTube ↗43m

" summary

Analyzes the Collection #1 assemblage: ~1 TB compressed (≈2 TB extracted), deduplicated to ~900 GB of data and 26 billion records with about 3 billion unique email addresses. Finds heavy Russian and .com representation, government and edu addresses included, and 123456 top password (≈0.15% overall). Shows weak recovery answers in the dump, timestamps allowing rough dating, and a real-world credential-stuffing attack that harvested bank accounts. Recommends per-user salting, password managers, and stopping password reuse.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 29:37top passwords
3. 31:38top.gov.pl passwords
4. 32:08Recovery questions
5. 39:20Salting

" related talks

• 46mKeynote: Lessons From 11 Billion Breached RecordsTroy Hunt · Black Hat Asia 2021
• 31m680,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck Fluffmuffin · ArrrrCamp 2014
• 29m80,000 Plaintext Passwords: An Open Source Love Story in 3 ActsT.J. Schuck · Red Dot Ruby Conference 2014
• 01h 00mHow I Met Your DataTroy Hunt · NDC Sydney 2024
• 31mBreaking Bad (Passwords)Hamed Merati, Willem Mouton · RSAC 2020 Asia Pacific & Japan
• 21mEverything but the User: Reducing Password ReuseMiranda Wei · PasswordsCon 2018 Stockholm
• 25m80,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck · Cascadia Ruby 2014
• 59mInside the Breach: Secrets ExposedTroy Hunt · NDC Melbourne 2025