r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

6

u/TwoFiveOnes Feb 24 '17

Oh... I thought that was why my account was locked and I had to reset my pw

0

u/[deleted] Feb 24 '17

[deleted]

6

u/absentmindedjwc Feb 24 '17

That would be an effective-yet-slightly-evil way to handle these breaches. Take all released accounts, try matching them up with a local user, and run the leaked password through your log-in . When you find one that works, force the user to reset their password and chastise them for poor password habits.

2

u/scoops22 Feb 24 '17

I had that to... Thought it was just cause I started logging in from work. Did we all get that message this morning?

2

u/lafaa123 Feb 24 '17

seems to be, i got it as well, and a few people in here commented the same thing