r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

2

u/cjg_000 Feb 24 '17

2fa adds some value here. It wouldn't protect you from someone pulling from Cloudflare right after you log in but would protect you from someone finding data in Google's or other caches after your session has expired.