Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

51–60 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#52

Post by troydavis »

jgrahamc wrote: post #43
sfwwolvw wrote: post #42

Earlier quoted context omitted.

> If you are a verified victim of this bug CloudFlare will contact you. Where do you have that info from?

We are in the process of contacting customer who we are able had information cached by a search engine.

@jgrahamc: If this problem doesn't justify emailing all proxy service customers, what problem would?

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#54

Post by jandy »

analogist wrote: post #15
jandy wrote: post #3

I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?

Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption. So even a full memory dump of what's transported in TLS should, as long as it's properly implemented, only reveal an SRP authentication session and subsequently symmetrically encrypted data. (And inside that SR…

Interesting, thanks for the reply.

I wonder which password manager the original Project Zero thread referred to then if not 1Password.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#55

Post by chatmasta »

jgrahamc wrote: post #43
sfwwolvw wrote: post #42

Earlier quoted context omitted.

> If you are a verified victim of this bug CloudFlare will contact you. Where do you have that info from?

We are in the process of contacting customer who we are able had information cached by a search engine.

That's not the biggest risk. The biggest risk is that a malicious actor stumbled upon this bug, realized they could trigger it with specially crafted HTML, then wrote a script to harvest the data, which would be private data from any website with an active session in memory on the shared proxy. In that case, the bigger websites are more likely to be affected, because high traffic means they're more likely to have data stored in memory at any given time.

If you think this is implausible, consider just one persona who could do this;

- Someone turns clouflare https service on their website

- They check their pages and see some random data in the middle of a

tag

- They reproduce the bug. Then they reproduce it again. Then they script it.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#57

Post by shakna »

vasundhar wrote: post #56

Unfortunately this seem to include news.ycombinator.com

> This list contains all domains that use cloudflare DNS, not just the cloudflare SSL proxy (the affected service that leaked data). It's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised.

In this case, HN , IIRC, does not use the proxy.

Checking the certs, CloudFlare reissue using DigiCert, I think, whereas HN is using a Comodo cert.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#58

Post by jgrahamc »

troydavis wrote: post #52
jgrahamc wrote: post #43

Earlier quoted context omitted.

We are in the process of contacting customer who we are able had information cached by a search engine.

@jgrahamc: If this problem doesn't justify emailing all proxy service customers, what problem would?

We are emailing them all, but we are starting with those that we know had data cached by a search engine.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#60

Post by koolba »

That's a wide impact. While any hijacked account is bad, some of these are really bad.

For example, https://coinbase.com is on that list! If they haven't immediately invalidated every single HTTP session after hearing this news this is going to be bad. Ditto for forcing password resets.

A hijacked account that can irrevocably send digital currency to an anonymous bad guy's account would be target number one for using data like this.

Post reply on HN