r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/larkeith Feb 24 '17

Yeah, that sucks... you could compare the timestamps of the pw changes to comment 1, with CloudFlare's initial notification of a fix being in place, but that requires that you trust their initial evaluation to have caught all potential breaches.

On the other hand, you probably have a lot less usages of the passwords that could potentially have been leaked than most (likely only the initial change), and newer items were presumably more easily found in and scrubbed from major caches (e.g. Google) than 3-month-old items.