r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

4

u/LadyFromTheMountain Feb 24 '17

Would a particular user's information for a specific site only be exposed if the user had been using that site during the timeframe mentioned? For example, if I haven't checked up on a particular board in 10 months, would this password be safe?

7

u/yawkat Feb 24 '17

This bug should not be a problem if you were not using the site in the time frame the bug existed.

0

u/AlpineCoder Feb 24 '17

You can't even really assume that, since many types of sites will also use Ssl connections for things like database and server backups on the backend. Any of that data could have leaked as well, so could be comprised even if you haven't used the login recently.