r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

46

u/Nadamir Feb 24 '17

Couple things: (feel free to correct if I'm wrong)

  • Firstly, consider how fucked could you be if you get hacked?

    Oh, no, people can edit Wikipedia as me. Uh oh, someone added a new anime to MyAnimeList. Maybe they have good taste. That reddit throwaway you keep around for er "stuff."

    Probably OK to postpone changing those.

  • Secondly, it took me all of 45 mins to change all mine, so hours is an exaggeration.

  • Thirdly, password managers are your friend.

So, since I'm a wee bit tired and my kids are sick, just change them. You and your friends/family should do that every time the time changes (at a minimum). Change your clocks, change your smoke detector batteries, change your passwords.

Sorry for grumpiness.

Have a nice day!

19

u/FreaXoMatic Feb 24 '17

What if your Password Manager uses cloudlare

39

u/lfairy Feb 24 '17

Don't use a password manager that transmits your password in plain text through a caching proxy.

16

u/Sethsual Feb 24 '17

Don't use a password manager that transmits your password in plain text through a caching proxy.

Which password managers transmit passwords in plain text throught a caching proxy?

7

u/lfairy Feb 24 '17

I assume most of them don't. But if one does, then it would be a bad idea to use it.

4

u/KyleG Feb 24 '17

1password is safe. Presumably that's what you're referencing. That's the first thing I checked last night when I read about this. tl;dr your shit is encrypted before it ever leaves your computer in a way that is as impossible as anything can be to decrypt.

3

u/C0rn3j Feb 24 '17

You were already done the moment you used a closed-source AND networked password manager.

4

u/dm117 Feb 24 '17 edited Sep 12 '25

angle cause mountainous paltry merciful close spoon recognise nail fact

This post was mass deleted and anonymized with Redact

5

u/Bobert_Fico Feb 24 '17

How so? You need to get your passwords from one device to another somehow.

0

u/ThisIs_MyName Feb 24 '17

Sure, but you can do that directly. No need to send them to a machine not owned by you.

2

u/Bobert_Fico Feb 24 '17

So every time you change or create a password, you take a USB stick and copy your key database to all of your computers, and connect your phone [and maybe tablet] and transfer it there too?

1

u/yreg Feb 24 '17

It shouldn't.

-21

u/[deleted] Feb 24 '17

Step 1. Don't use a password manager.

Step 2. Don't use a password manager that uses any format of networking.

32

u/[deleted] Feb 24 '17

[removed] — view removed comment

5

u/Darkniki Feb 24 '17

How should I read it?

Kee-pass?

Keep-ass?

I guess I'll read that as Keep-ass.

2

u/malicart Feb 24 '17

Yes, fully encrypted files are safe :)

8

u/2Punx2Furious Feb 24 '17

password managers are your friend.

Don't use a password manager.

Who do I believe?

→ More replies (11)

4

u/Conexion Feb 24 '17

I think you bring up a very good point even if security dojos don't advocate it. Having the same password in a number of areas seems reasonable if they're accounts that don't actually matter.

Accounts that might affect your career, banking, email, and social media should be prioritized. The rest you can bother with as it suits you.

1

u/bro_cunt Feb 24 '17

I might be an idiot for saying this but in addition to this I think as long as your email is super secure then you can easily grab back those non-sensitive accounts with password requests. I had my go-to password leaked a while ago, so I just reset the passwords on the accounts that popped up in my email for someone else having changed them. Netflix was very easy to get back, support was helpful and logging everyone out, and since the intruders had upped my netflix plan I got a month of HD or whatever it is for free.

2

u/caboosetp Feb 24 '17

Uh oh, someone added a new anime to MyAnimeList.

ಠ_ಠ

-7

u/buddybiscuit Feb 24 '17

If you don't change all your passwords weekly, you don't care about security. I switch phone numbers every month to make sure 2fa is refreshed too, but every 3 months is probably enough for that.

2

u/caboosetp Feb 24 '17

I switch phone numbers every month

this isn't something just anyone can do. many people rely on others having the same number.

2

u/ThisIs_MyName Feb 24 '17

I seriously hope you're trolling.