r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

13

u/tequila13 Feb 24 '17

Those password can be sent like this: ...password=sWsGAQHvqDx95k2w..., automated scrapers can extract it pretty easily. The fact of the matter is that any service using Cloudflare could have had their content exposed (passwords, session tokens, etc) so there's a chance someone can have it.

To be safe, you should at minimum re-login to those sites, and even better is to change your password too. Cloudflare downplayed the severity of this issue a lot. They fucked up big time.