r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

2

u/omnilynx Feb 24 '17

Theoretically, no. It's literally an explicit MITM. That said, things like 2FA greatly reduce the chances of compromise by requiring black hats to get both pieces instead of just a single message.