Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

591–600 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#591

Post by gambler »

Udo wrote: post #572
JumpCrisscross wrote: post #490

Earlier quoted context omitted.

They also actively deter Tor use. I've cancelled subscriptions with Cloudflare-hosted sites because they make securely and anonymously browsing their sites a pain.

I'm running a side-project on Cloudflare and it's accessible through Tor without problems. I suspect this comes down to the settings a site owner sets up in their Cloudflare interface. It would stand to reason if for example you applied the highest security setting across the board, Tor and VPN users would get presented with a captcha.

Is this made clear in their UI? Do they have something saying "this setting will screw over many VPN users" and "this setting will screw over with all Tor users"? If not, it's in large part their problem as well.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#593

Post by bubblethink »

homakov wrote: post #570

Chrome marking Cloudflare HTTPS as "Secure" must be turned into something different, like "Not So Secure" or whatever. Secure = end to end. Cloudflare is MitM by design. Chrome and others must not tolerate it. This vulnerability is just another reason to do it asap.

That's because HTTPS allows that. Whether it's cloudflare, or your own servers and load balancers, it's all legal. So it would be unfair to single cloudflare out. You could take some measures to identify their flexible-ssl traffic, and that's a grey area, but their regular ssl is fine. If it weren't for them, you would roll your own solution, which wouldn't be very different.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#594

Post by mcbits »

caf wrote: post #554
mcbits wrote: post #398

Earlier quoted context omitted.

By the same logic, the search engine you used to find those sites is also a "protection racket".

Really? That search engine sells DDOS protection?

Sure. I just searched for "ddos stresser" on three different search engines. The first 1-3 results were ads for Cloudflare and similar services, followed by organic results for several of the sites mentioned above. One could make the same dubious argument that it's a protection racket (free exposure for the "bad guys" while profiting from mitigation).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#596

Post by benjaminl »

Anderkent wrote: post #311
SomeCallMeTim wrote: post #80

Earlier quoted context omitted.

My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon. If it only took 60 seconds per site, it would still take eight hours to change them all. Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords. Anything else is not worth the hassle -- and mostly wou…

Lastpass knows how to change your passwords for many popular sites, and can automate it away for you.

LastPass uses local encryption to enable LastPass to have Zero knowledge of users passwords. This means that user's passwords aren't passed in the clear even inside a TSL session.

So LastPass isn't the password manager mentioned in the post.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#597

Post by edwinyzh »

fagnerbrack wrote: post #64

TL;DR for the lazy ones: > The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https reques…

Just deleted my LastPass account - have been converted to KeePass for over a month.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#598

Post by Kalium »

oldsj wrote: post #549
Kalium wrote: post #448

Earlier quoted context omitted.

They're human too. Look at the response times!

Yea but... seems like a quick run of valgrind would have caught this

Personally, I've never had an experience with valgrind that could be reasonably characterized as "quick". But YMMV.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#599

Post by jedberg »

sneak wrote: post #366
vengefulduck wrote: post #337

Earlier quoted context omitted.

I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylT...

That's terrifying. Thanks to Uber now requiring location services on Always instead of just when hailing a car, my and others' personal location history even outside of Uber usage could have been compromised. Sweet.

To be fair, you were kind of a fool if you actually let Uber have your location at all times. As soon as they announced that I blocked Uber from my location. I only allow it when I take an Uber (which is almost never now).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#600

Post by [deleted] »

ComputerGuru wrote: post #589

Some day, the world will wake up to the fact that we've taken the beauty of a decentralized internet and willingly traded it in for a single-point-of-failure design. I will refrain from any criticism of Cloudflare and what I think about this because they're going through hell as it is. But everyone else is fair game. The higher a level of service you centralize, the more you stand to lose.

[deleted]
Post reply on HN