Reddit just told me my account was compromised
Unrelated.
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
641–650 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#642Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust
Reddit is not affected.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#643Earlier quoted context omitted.
I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylT...
At least the location isn't embarrassing.[1] [1] https://goo.gl/maps/FjQVttcZCpH2
Oh my gosh, that's the Ivey Business School, where I graduated from last year. I didn't expect this to hit so close to home...
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#644Earlier quoted context omitted.
Lastpass knows how to change your passwords for many popular sites, and can automate it away for you.
LastPass uses local encryption to enable LastPass to have Zero knowledge of users passwords. This means that user's passwords aren't passed in the clear even inside a TSL session. So LastPass isn't the password manager mentioned in the post.
But the server might have sprayed out your login credentials while travelling through Cloudflare.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#645Earlier quoted context omitted.
Merely that both my and the drivers app screwed up at the same time, and have a good chance of hitting the same Uber end-point. Apps that consume APIs would be more sensitive to unexpected junk than browsers.
But there are so many other much more likely reasons why something like that would have happened, it is quite a leap to think that it is somehow related to this issue.
Without disagreeing, can you give me an example.
And it's just a speculation. Shrug.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#646[deleted]
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#647Earlier quoted context omitted.
I found: FitBit Hacker News Stack Overflow Zendesk Discord FastMail (not really see below)
We, FastMail, are not affected by this. We do not proxy TLS connections via any third party. We use CloudFlare for DNS distribution only, which is not part of this issue.
The least surprising message of the day. Thank you.
My Fastmail-money is well spent.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#648Cloudflare is also breaking anonymous surfing by throwing captchas at you.
Security wise they do DDoS ok but not WAF which Incapsula does a lot better.
When I mean better I mean protection against exploits.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#649Earlier quoted context omitted.
Ouch, you really see everything : > authorization: OAuth oauth_consumer_key ... what a shit show. I'm sorry but at that point there must be consequences for incompetence. Some might argue "But nobody can't do anything" ... I'm sorry, CF has the money to to ditch C entirely and rewrite everything from the ground up with a safer language, I don't care what it is, Go,Rust whatever. At that point people using C directly…
These guys were probably saved by using OAuth - there is a consumer secret (which the "_key" is just an identifier for) and an access token secret, both of which are not sent over the wire. Just a signature based on them. (The timestamp and nonce prevent replay attacks.) OAuth2 "simplified" things and just sends the secret over the wire, trusting SSL to keep things safe.
Does this have anything to do with CloudFlare's ambitious attempt to be the first service to proxy your https traffic to your users?
Perhaps the largest MITM ever eh?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#650Earlier quoted context omitted.
whois $(dig +short yoursitehere.com) | grep -i 'Cloudflare' 1>/dev/null; if [[ $? -eq 1 ]]; then echo 'Didnt find CloudFlare'; else echo 'Found CloudFlare'; fi Not at a terminal now, but this long one-liner should work. Like you said, not 100% reliable though. For example, I'm pretty sure Reddit uses CloudFlare, but their whois mentions Fastly, which is a competitor.
We moved off of CloudFlare to Fastly before this vulnerability.
Confirmed, reddit.com was removed from the list. My mistake for not double checking this one.