Anyone know which password manager uses Cloudflare? Just trying to figure out if I'm affected.
Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
61–70 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#62How does such a simple bug not get picked by auto tests, ci or end to end tests? I am baffled. Since we are behind cloudflare, I am not sure what I should tell my manager now. I lack the technical know how to parse that extremely technical article. Are we supposed to just assume all our traffic that passed via cloudflare is possibly compromised? It's also a bit sad that travis has to contact cloudflare by twitter. Se…
I don't think he had to, but he got an answer in minutes. I don't think that's the part to be worried about. As for what you should do: it sounds like the impact is relatively low. I'd personally change easily-changed secrets which go over the session, and potentially externally facing customer passwords (yes in enterprise, maybe not in consumer). (I don't have any insider info on this breach, though, but I read both…
[deleted]
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#63How does such a simple bug not get picked by auto tests, ci or end to end tests? I am baffled. Since we are behind cloudflare, I am not sure what I should tell my manager now. I lack the technical know how to parse that extremely technical article. Are we supposed to just assume all our traffic that passed via cloudflare is possibly compromised? It's also a bit sad that travis has to contact cloudflare by twitter. Se…
I don't think he had to, but he got an answer in minutes. I don't think that's the part to be worried about. As for what you should do: it sounds like the impact is relatively low. I'd personally change easily-changed secrets which go over the session, and potentially externally facing customer passwords (yes in enterprise, maybe not in consumer). (I don't have any insider info on this breach, though, but I read both…
Read Tavis' comments. He disagrees with you regarding the severity. This is a big f--king deal!
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#64TL;DR for the lazy ones:
> The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.
This is huge.
I mean, seriously, this is REALLY HUGE.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#65I'm not 100% clear: Only three features were affected, and only sites with one or more of those features enabled leaked data into their pages. But was the leaked data similarly limited to only the sites with the features enabled? Or could it have come from any request - even an entirely unrelated site?
It appears that it could be from any site that passed through that server, not just those with these features enabled.
That's just how I read it.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#66Everyone: change your HN password asap!
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#67Earlier quoted context omitted.
Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.
To my sibling: the issue is that people can and do consider Flexible SSL "good enough", when it really isn't. It gets you the green lock and the warm fuzzies, but the page just isn't secure. A false sense of security is worse than no security, because no security at least is glaringly obvious.
But it is secure. It's secure against the user being on an untrustworthy connection, it's secure against their ISP deciding to MitM their traffic, and it's also ~~secure against anyone passively sniffing the traffic between the website server and CloudFlare~~ (EDIT: No it's not, see [1]). The only thing it's not secure against is someone in a privileged network position who can MitM the connection between the website and CloudFlare.
So no, it's not 100% secure, but it's far far better than having an unsecured http:// connection.
As for the green lock, you can blame that on Chrome. I have no idea why they insist on using a green lock and green "Secure" text for DV certs. Safari only uses a green lock / green text for EV certs, which is a lot better (and I don't know offhand what Firefox or Edge do). Of course, you could have an EV cert and still use Flexible SSL, but anyone who cares enough to get an EV cert should know better than to use Flexible SSL anyway, and there's a great many ways to make your server insecure, using Flexible SSL is very far from the worst way.
All that said, it would be great if CloudFlare would just stop offering Flexible SSL in favor of the self-signed CSR approach. Any CloudFlare customer who can create their own cert to talk to CloudFlare can also create a CSR to get a cert from CloudFlare just as easily, so it's not clear to me why they still even offer Flexible SSL.
[1]: I thought Flexible SSL was the option to use an arbitrary self-signed cert on the origin server. gkop pointed out that, no, Flexible SSL means no encryption at all.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#68Anyone know which password manager uses Cloudflare? Just trying to figure out if I'm affected.
Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.
taviso called out 1Password in the initial tweet, although that still leaves room for other password managers too: https://twitter.com/taviso/status/834900838837411840
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#69Can someone provide a lay-person's explanation of the issue and its implications?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#70Earlier quoted context omitted.
Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.
I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…
[deleted]