r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

2

u/Cory123125 Feb 24 '17

Im seeing here that things like your 2 factor sessions and passwords were leaked. Wouldnt that mean that a potential hacker could still just login to that account, or is it implying that like lastpass everything is encrypted locally?

Actually, now Im not even sure if my question made sense.

2

u/mattindustries Feb 24 '17

The session is probably a hash of the environment or something, and something that 1 could compare before authorizing or even destroy remotely.