More than two million stolen passwords used for sites such as Facebook, Google and Yahoo and other web services have been posted online.