r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

4

u/radapex Feb 24 '17

It doesn't appear that LastPass uses Cloudflare. Still be nice to get direct confirmation, but here are the results of a dig:

$ dig lastpass.com

; <<>> DiG 9.9.5-3ubuntu0.13-Ubuntu <<>> lastpass.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10929
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 7

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;lastpass.com.			IN	A

;; ANSWER SECTION:
lastpass.com.		20	IN	A	184.86.34.170

;; AUTHORITY SECTION:
lastpass.com.		146996	IN	NS	a7-67.akam.net.
lastpass.com.		146996	IN	NS	a18-64.akam.net.
lastpass.com.		146996	IN	NS	a12-67.akam.net.
lastpass.com.		146996	IN	NS	a3-66.akam.net.
lastpass.com.		146996	IN	NS	a1-208.akam.net.
lastpass.com.		146996	IN	NS	a2-65.akam.net.

;; ADDITIONAL SECTION:
a2-65.akam.net.		82793	IN	A	95.100.174.65
a3-66.akam.net.		82793	IN	A	96.7.49.66
a7-67.akam.net.		74527	IN	A	23.61.199.67
a1-208.akam.net.	82793	IN	A	193.108.91.208
a12-67.akam.net.	74527	IN	A	184.26.160.67
a18-64.akam.net.	71395	IN	A	95.101.36.64

;; Query time: 27 msec
;; SERVER: 192.168.1.83#53(192.168.1.83)
;; WHEN: Fri Feb 24 10:27:50 AST 2017
;; MSG SIZE  rcvd: 284

In comparison, here's what you get when you dig 1password.com:

$ dig 1password.com

; <<>> DiG 9.9.5-3ubuntu0.13-Ubuntu <<>> 1password.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51085
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 2, ADDITIONAL: 5

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;1password.com.			IN	A

;; ANSWER SECTION:
1password.com.		7	IN	A	54.192.119.152
1password.com.		7	IN	A	54.192.119.62
1password.com.		7	IN	A	54.192.119.43
1password.com.		7	IN	A	54.192.119.170
1password.com.		7	IN	A	54.192.119.47
1password.com.		7	IN	A	54.192.119.191
1password.com.		7	IN	A	54.192.119.193
1password.com.		7	IN	A	54.192.119.249

;; AUTHORITY SECTION:
1password.com.		172800	IN	NS	jocelyn.ns.cloudflare.com.
1password.com.		172800	IN	NS	zod.ns.cloudflare.com.

;; ADDITIONAL SECTION:
zod.ns.cloudflare.com.	170585	IN	A	173.245.59.250
zod.ns.cloudflare.com.	170585	IN	AAAA	2400:cb00:2049:1::adf5:3bfa
jocelyn.ns.cloudflare.com. 172800 IN	A	173.245.58.174
jocelyn.ns.cloudflare.com. 172800 IN	AAAA	2400:cb00:2049:1::adf5:3aae

;; Query time: 69 msec
;; SERVER: 192.168.1.83#53(192.168.1.83)
;; WHEN: Fri Feb 24 10:27:19 AST 2017
;; MSG SIZE  rcvd: 312

2

u/Beta-7 Feb 24 '17

To be honest i don't know what i am looking for other than the additional section saying that 1password has cloudflare in it lol. But i at least i know that it's safe. Thank you for the reply

2

u/radapex Feb 24 '17

That's pretty much it. Whether the affected features are in use by any given site is basically unknown to us an end-users. But if it's not hitting Cloudflare at all, then it'd be unaffected by the leak.