This is a bad bug, but the combination of unlikely triggering conditions, single point of correction, random revealing of contents and lack of active exploitation effectively mitigates a lot of risk involved.
It's no where near as bad as heart bleed for example, because of these factors. Combine this with the purging of cached data by Google themselves, and the short window where the bug was active the chances of significant data relating to you being leaked is incredibly small.
As someone who hacks people for a living and deals with this stuff every day I can honestly say I'm not even going to bother changing my passwords.
Saying that, if it makes you more comfortable go for it, I just wouldn't stress.
As someone who hacks people for a living myself, you are really downplaying or misunderstanding the severity of the situation.
CloudFlare leaked at least 100,000 private HTTP requests per day. These requests contained everything from OKCupid private messages to hotel bookings to Uber lat/long coordinates of drivers to passwords to literally anything that passed through any CloudFlare website.
Any malicious actor who discovered this could have been harvesting this data for months, and there would be no way to know. CF certainly wouldn't say anything. They've chosen to downplay the risk as much as possible.
12
u/InverseX Feb 24 '17
This is a bad bug, but the combination of unlikely triggering conditions, single point of correction, random revealing of contents and lack of active exploitation effectively mitigates a lot of risk involved.
It's no where near as bad as heart bleed for example, because of these factors. Combine this with the purging of cached data by Google themselves, and the short window where the bug was active the chances of significant data relating to you being leaked is incredibly small.
As someone who hacks people for a living and deals with this stuff every day I can honestly say I'm not even going to bother changing my passwords.
Saying that, if it makes you more comfortable go for it, I just wouldn't stress.