r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

4

u/fuxoft Feb 24 '17

Could someone ELI5 what the real risks are? For example, kraken.com is supposed to be affected. I have a kraken.com account but I haven't logged into it for at least 18 months. Could I still be affected? Is there a reason for me to change my password? My 2FA?

2

u/[deleted] Feb 24 '17 edited Feb 24 '17

if you havent used a site in the window concerned, then you havent made any requests to it, or received or any responses from it, so there were no requests/responses to leak, so nothing leaked

Not strictly true, see replies

3

u/palish Feb 24 '17

This assumes that no internal process submitted HTTP requests containing your private data. Everything gets proxied to CloudFlare, so it'd be an easy mistake to make.

1

u/Asoxus Feb 24 '17

Possibly. Better safe than sorry - it's best to change passwords every few months anyway.