Comment Re:Solution: Public Key Auth (Score 1) 327
I think they might be getting them from the recent google gmail vulnerability. I was logging in to my gmail account one day, but typed my password into the google search box. The very first hit was my e-mail address and password listed in a big password listing. I checked out the site, and the list itself was behind a paywall, but they let the googlebot through. . .so you could get the entire dataset with some googlefu.
