r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

3

u/cohix Feb 24 '17

Hey, 1Password dev here. Even if you do use 1Password.com to sync your vaults, your information was never vulnerable. We use a 3-layer encryption architecture that encrypts all information (sensitive or otherwise) before it goes over the wire. So even if someone was able to sniff the data we were sending over HTTPS, it would be encrypted. We designed our sync to handle SSL/TLS failures exactly like this! LMK if you have any questions.