71–80 of 228 posts
That's a wide impact. While any hijacked account is bad, some of these are really bad. For example, https://coinbase.com is on that list! If they haven't immediately invalidated every single HTTP session after hearing this news this is going to be bad. Ditto for forcing password resets. A hijacked account that can irrevocably send digital currency to an anonymous bad guy's account would be target number one for using…
Earlier quoted context omitted.
No, it's keepassx on my laptop. I don't trust my passwords to somebody else.
So why do you have to change them all?
You missed the "possibly" in the header. And the disclaimer right at the top: This list contains all domains that use cloudflare DNS, not just the cloudflare SSL proxy (the affected service that leaked data). It's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised.
I would like to point out that, if most sites used two-factor authentication, this leak would be at most a minor inconvenience. Maybe we should push for that more. Just days ago I talked to Namecheap about its horrible SMS-only 2FA and asked them to implement something actually secure, maybe contact your favorite site if they don't have 2FA yet.
If you setup TOTP (Authenticator) while this bug was out in the wild your shared secret key could have leaked. SMS would actually be safer than TOTP in this scenario.
I think it's a flaw of TOTP though. The client secret should be client generated and should never leave the device.
What if I sign in with facebook or other? Should I change muy password con facebook or what?
TL;DR? You should be ok... Long Version. That (most likely) would of used oauth. So instead of sending your FB password to the site to log you into FB with. You give your FB password (if your not signed in) to FB and then facebook give the site using "sign in with Facebook" a token they can use with facebook to get account info / do actions on your FB account. Now depending on which "sign in with" system you used the…
I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?
The update from 1password indicated that there was application layer encryption happening in addition to the TLS encryption, so a breach of the TLS protection did not expose any sensitive data. Presumably other sites are in similar situations. But don't take my word for it, go change all your passwords.
You missed the "possibly" in the header. And the disclaimer right at the top: This list contains all domains that use cloudflare DNS, not just the cloudflare SSL proxy (the affected service that leaked data). It's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised.
Affected sites leaked data from random other CF customers. So any site using CF regardless of settings could have leaked private data out there.
Today I learned that uber does not have a change password option once you are logged in. You have to log out and pretend you forgot the password. Bad UX if you don't know.
this is despite (or maybe because) of my best efforts to secure systems as a major part of my job.