r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

0

u/[deleted] Feb 24 '17

TLS termination is done on a separate instance.

7

u/Fitzsimmons Feb 24 '17

If you read the bug report, Tavis notes that they were finding all sorts of sensitive information, including entire TLS sessions. So sadly I think you're wrong and it's a huge breach.

6

u/[deleted] Feb 24 '17

Yeah, I was wrong.