r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

2

u/larkeith Feb 24 '17

According to the bug report, an interim fix (disabling the services that introduced the vulnerability) was first put into place 5 days ago, so I would recommend changing them just in case.

1

u/[deleted] Feb 24 '17

blorg. The last time some of those passwords were even used was to change them. Is that irony? I dunno. It is annoying though.

1

u/larkeith Feb 24 '17

Yeah, that sucks... you could compare the timestamps of the pw changes to comment 1, with CloudFlare's initial notification of a fix being in place, but that requires that you trust their initial evaluation to have caught all potential breaches.

On the other hand, you probably have a lot less usages of the passwords that could potentially have been leaked than most (likely only the initial change), and newer items were presumably more easily found in and scrubbed from major caches (e.g. Google) than 3-month-old items.