https://productforums.google.com/forum/#!topic/gmail/4q3AYMi... and https://facepunch.com/showthread.php?t=1423764 refer to this link.
Edit to add: https://haveibeenpwned.com/PwnedWebsites#BTSec
I only use "password" in random websites that force me to register (but that I'll never visit again).
I didn't feel completely comfortable posting the link but thought it was better that it's out there (and it looks like it's not even new according to comments).
Subject: Yours is one of 4,788,657 email addresses found in a paste titled "pred.me"
At the time, it showed up on the "Latest Pastes" on HIBP, but I think it's aged out now.
curl https://pred.me/gmail.html -vo /tmp/pred.me.gmail.$RANDOM.txt
Just one email per line, and a colon (:) delimiter for the password.
The MD5 hash is:
c1d5f3998459acea8d32937a4485c0b7
The IP address resolved to:
81.4.110.159
In terms of HN community conventions and common behaviors, people will often submit a question like "Ask HN: Lorem Ipsum..." and then provide follow-up details in the message body, including relevant information, such as the details I've provided above.
This way, if the owner of the resource at the address starts serving up malware, users can verify the content before consuming it.
These are merely community memes though. Not any sort of auspicious, high-minded "best practices as prescribed by experts" or anything. Just some stuff a bro might do around here.
Also, WHOIS info might be useful, if safety or malware is a concern...
http://whois.domaintools.com/pred.me
This doesn't preclude the domain owner having been pwnt and used as a patsy. Or even whether that person might have a valid reason for hosting the file?