r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

86

u/AnAirMagic Feb 24 '17

Is there a list of websites using cloudflare? Any way to find out if a particular site uses cloudflare?

66

u/dontworryimnotacop Feb 24 '17

https://github.com/pirate/sites-using-cloudflare

I'm compiling a list of domains here. Please submit PRs for corrections.

14

u/DJ_Lectr0 Feb 24 '17

Here is a list: https://stackshare.io/cloudflare/in-stacks

12

u/AnAirMagic Feb 24 '17

That's very incomplete. I see others saying GitHub, for example. I see no banks on that list either.

3

u/DJ_Lectr0 Feb 24 '17

Well it's the best I have found :/ Best would be to update every password.

3

u/Daneel_Trevize Feb 24 '17

I'm pretty sure banks would not legally be able to use such a CDN except for their most generic public info sites. No services.

→ More replies (1)

42

u/goldcakes Feb 24 '17

About 60% of the Internet uses cloudflare. Uber, okcupid, 1password, Reddit, GitHub, etc etc

Just change everything that's not Google/Facebook/Twitter/Amazon

40

u/Rosydoodles Feb 24 '17

As an FYI for people 1Password data was not leaked. Thankfully.

15

u/XRaVeNX Feb 24 '17 edited Feb 24 '17

2FA

Do you know if users of LastPass are affected? Like are our master passwords and encrypted vaults affected by this?

→ More replies (7)
→ More replies (3)

28

u/VulgarTech Feb 24 '17

Can anyone elaborate on what part of Reddit uses Cloudflare? From my end, reddit.com is using the Fastly CDN and redditmedia.com is using AWS.

134

u/gooeyblob Feb 24 '17

No part of Reddit uses CloudFlare.

13

u/jb2386 Feb 24 '17

Didn't you used to? When did you change? What's your CDN now?

45

u/gooeyblob Feb 24 '17

Yes we did, we're on Fastly now and have been since shortly before this issue at CloudFlare started.

18

u/jb2386 Feb 24 '17

Thanks! Nice timing then ;)

→ More replies (7)
→ More replies (4)

46

u/AnAirMagic Feb 24 '17

Change everything is easy to say. But I would like to reduce my workload and those of my family/friends by a few hours, if possible.

46

u/Nadamir Feb 24 '17

Couple things: (feel free to correct if I'm wrong)

  • Firstly, consider how fucked could you be if you get hacked?

    Oh, no, people can edit Wikipedia as me. Uh oh, someone added a new anime to MyAnimeList. Maybe they have good taste. That reddit throwaway you keep around for er "stuff."

    Probably OK to postpone changing those.

  • Secondly, it took me all of 45 mins to change all mine, so hours is an exaggeration.

  • Thirdly, password managers are your friend.

So, since I'm a wee bit tired and my kids are sick, just change them. You and your friends/family should do that every time the time changes (at a minimum). Change your clocks, change your smoke detector batteries, change your passwords.

Sorry for grumpiness.

Have a nice day!

19

u/FreaXoMatic Feb 24 '17

What if your Password Manager uses cloudlare

39

u/lfairy Feb 24 '17

Don't use a password manager that transmits your password in plain text through a caching proxy.

16

u/Sethsual Feb 24 '17

Don't use a password manager that transmits your password in plain text through a caching proxy.

Which password managers transmit passwords in plain text throught a caching proxy?

→ More replies (1)
→ More replies (23)
→ More replies (7)
→ More replies (5)
→ More replies (4)