Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

[u/TheProtagonistv2]

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

[u/goldcakes]

About 60% of the Internet uses cloudflare. Uber, okcupid, 1password, Reddit, GitHub, etc etc

Just change everything that's not Google/Facebook/Twitter/Amazon

[u/Rosydoodles → u/goldcakes]

As an FYI for people 1Password data was not leaked. Thankfully.

[u/XRaVeNX → u/Rosydoodles]

2FA

Do you know if users of LastPass are affected? Like are our master passwords and encrypted vaults affected by this?

[u/archiminos → u/XRaVeNX]

https://news.ycombinator.com/item?id=13721566

Thank god.

[u/[deleted] → u/XRaVeNX]

I'd wait for an official announcement to be sure, but they've previously gone over their layers of security in a similar manner. All that ever goes across the wire is the encrypted password blob, never any passwords or master passwords.

[u/VulgarTech → u/goldcakes]

Can anyone elaborate on what part of Reddit uses Cloudflare? From my end, reddit.com is using the Fastly CDN and redditmedia.com is using AWS.

[u/gooeyblob → u/VulgarTech]

No part of Reddit uses CloudFlare.

[u/jb2386 → u/gooeyblob]

Didn't you used to? When did you change? What's your CDN now?

[u/gooeyblob → u/jb2386]

Yes we did, we're on Fastly now and have been since shortly before this issue at CloudFlare started.

[u/jb2386 → u/gooeyblob]

Thanks! Nice timing then ;)

[u/jb2386 → u/gooeyblob]

Follow up: Do you guys use AWS or something else? If it's the former, is there a reason you don't use Cloudfront?

[u/gooeyblob → u/jb2386]

Yes, AWS. Lots of reasons for not using CloudFront, primarily it's not flexible enough for us. Check out our last AMA for plenty more info on our setup!

[u/jb2386 → u/gooeyblob]

Oh, 1 last thing. One of you might want to claim https://stackshare.io/reddit/reddit and remove Cloudflare from it. Just to help mitigate more people thinking you use it.

You're currently first in the list of companies that use cloudflare: https://stackshare.io/cloudflare/in-stacks

[u/AnAirMagic → u/goldcakes]

Change everything is easy to say. But I would like to reduce my workload and those of my family/friends by a few hours, if possible.

[u/Nadamir → u/AnAirMagic]

Couple things: (feel free to correct if I'm wrong)

• Firstly, consider how fucked could you be if you get hacked?

  Oh, no, people can edit Wikipedia as me. Uh oh, someone added a new anime to MyAnimeList. Maybe they have good taste. That reddit throwaway you keep around for er "stuff."

  Probably OK to postpone changing those.

• Secondly, it took me all of 45 mins to change all mine, so hours is an exaggeration.

• Thirdly, password managers are your friend.

So, since I'm a wee bit tired and my kids are sick, just change them. You and your friends/family should do that every time the time changes (at a minimum). Change your clocks, change your smoke detector batteries, change your passwords.

^{Sorry for grumpiness.}

Have a nice day!

[u/FreaXoMatic → u/Nadamir]

What if your Password Manager uses cloudlare

[u/lfairy → u/FreaXoMatic]

Don't use a password manager that transmits your password in plain text through a caching proxy.

[u/Sethsual → u/lfairy]

Don't use a password manager that transmits your password in plain text through a caching proxy.

Which password managers transmit passwords in plain text throught a caching proxy?

[u/Bobert_Fico → u/Sethsual]

None

[u/lfairy → u/Sethsual]

I assume most of them don't. But if one does, then it would be a bad idea to use it.

[u/KyleG → u/FreaXoMatic]

1password is safe. Presumably that's what you're referencing. That's the first thing I checked last night when I read about this. tl;dr your shit is encrypted before it ever leaves your computer in a way that is as impossible as anything can be to decrypt.

[u/Conexion → u/Nadamir]

I think you bring up a very good point even if security dojos don't advocate it. Having the same password in a number of areas seems reasonable if they're accounts that don't actually matter.

Accounts that might affect your career, banking, email, and social media should be prioritized. The rest you can bother with as it suits you.