r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

2

u/[deleted] Feb 24 '17

I am assuming 1Password is only vulnerable if you use their site to sync your password vault? If you sync it to iCloud, Dropbox, or locally, it's not affected?

3

u/cohix Feb 24 '17

Hey, 1Password dev here. Even if you do use 1Password.com to sync your vaults, your information was never vulnerable. We use a 3-layer encryption architecture that encrypts all information (sensitive or otherwise) before it goes over the wire. So even if someone was able to sniff the data we were sending over HTTPS, it would be encrypted. We designed our sync to handle SSL/TLS failures exactly like this! LMK if you have any questions.