421–430 of 1001 posts
Can anyone ELI5 what's going on?
Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…
It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)
So the issue wasn't fully fixed on Feb 19, or Google's cache date isn't accurate?
Hopefully people will learn something from today.
What's the rationale behind sending user PII through a CDN? Presumably that is useful to that one user only so a CDN wouldn't be super useful in distributing the load across its edges. Also doesn't CDN caching kinda defeat the purpose of having SSL?
Because you're correct: if CF's info sec team is "very very good at their jobs", how did this incident happen?
Guessing a lot of credit card details are ripe for picking in the data they leaked.
Earlier quoted context omitted.
One of my Uber rides two weeks ago went completely nuts. Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination. You have to wonder whether something like this is implicated.
Probably not. If someone knew about this exploit they're not going to be messing with people's Uber rides for lulz.
Earlier quoted context omitted.
One of my Uber rides two weeks ago went completely nuts. Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination. You have to wonder whether something like this is implicated.
That's one phenomenal leap of logic there. Why would you think that?
Apps that consume APIs would be more sensitive to unexpected junk than browsers.
Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust
For example, Digital Ocean uses cloudflare, but the domain with sensitive data (cloud.digitalocean.com) is entirely blocked from Search Engines https://cloud.digitalocean.com/robots.txt
Earlier quoted context omitted.
Connecting some dots, I'm wondering if the "well-known chat service" is Slack: http://www.computing.co.uk/ctg/news/2462266/whatsapp-reddit-...
I'm fairly sure that it's Discord.