Aww man I submitted my list hours ago but I guess it never made it past the New page. https://github.com/pirate/sites-using-cloudflare
Original post: https://news.ycombinator.com/item?id=13720199
List of Sites Affected by Cloudflare's HTTPS Traffic Leak
11–20 of 228 posts
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#12I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?
The update from 1password indicated that there was application layer encryption happening in addition to the TLS encryption, so a breach of the TLS protection did not expose any sensitive data. Presumably other sites are in similar situations. But don't take my word for it, go change all your passwords.
> Presumably other sites are in similar situations.
Not to my understanding. 1password uses client-side encryption, using keys generated from your master password. This means that any data transmitted over the wire is already encrypted, whether over SSL or not.
Most other sites do not do this, at all, in any way. If you use a website that use'd CloudFlare's SSL termination, change your passwords, cancel your credit card (if you sent it to that site in the past few months, eg Uber/Lyft).
> go change all your passwords.
Yes, correct =].
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#13I have hundreds of passwords in my password manager. That's going to take a week, considering I also have to work.
Is your password manager 1Password? https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...
Even if your password manager is not compromised, the credentials of so many sites is potentially leaked that you should probably still update a substantial number of passwords.
I hope 1Password's Watchtower service will soon give hints.
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#14I have hundreds of passwords in my password manager. That's going to take a week, considering I also have to work.
Is your password manager 1Password? https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...
Even if it is, what does it have do to with all those hundreds of sites?
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#15I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?
Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption.
So even a full memory dump of what's transported in TLS should, as long as it's properly implemented, only reveal an SRP authentication session and subsequently symmetrically encrypted data.
(And inside that SRP-negotiated encryption should only be more symmetrically encrypted vault items, and RSA-encrypted vault keys. If properly implemented even complete TLS breaks do not break 1Password at all, even the cloud version. Properly implemented being the key words of course.)
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#16If I have an account on an affected site, but did not interact with the site (via my browser or through some other site with an API call) during the time period when the vuln was live, am I still at risk?
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#17I've been tinkering with a Python notebook for a few minutes to try to quickly assess how much of my LastPass vault is affected:
https://gist.github.com/dikaiosune/0ca7829884b3b3f790418f0f1...
Improvements welcome.
One interesting thing: the raw dump that's linked from the list's README doesn't seem to include a couple of notable domains from the README itself, like news.ycombinator.com or reddit.com. I may be mangling the dump or incorrectly downloading it in some way.
EDIT: disclaimer, be responsible, audit how the dump is generated, etc etc etc
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#18I have hundreds of passwords in my password manager. That's going to take a week, considering I also have to work.
Same here. I just spent the last 30 minutes changing passwords at my most critical sites. Banking, email, VPS providers, etc.
I figure I’ll slowly work through the rest in the coming weeks as time allows.
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#19This list doesn't appear to include sites that use a CNAME setup with CloudFlare -- i.e. sites on the Business or Enterprise plans that retain their authoritative DNS and use CNAMEs to point domains to a CloudFlare proxy.
There probably aren't many but with something this serious it could be important. I'm not sure how one would go about finding the sites that use the CNAME option. If it helps, they use a pattern like:
www.example.com --> www.example.com.cdn.cloudflare.net
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#20Aww man I submitted my list hours ago but I guess it never made it past the New page. https://github.com/pirate/sites-using-cloudflare Original post: https://news.ycombinator.com/item?id=13720199
Hey! Super useful, thanks.
Quick question: news.ycombinator.com (as an example) is listed in the README as a potentially affected site, but I don't see it in the raw dump that I've downloaded. Am I crazy?