101–110 of 228 posts
Oh crap. I've entered my banking password into Transferwise quite a few times. Welp, time to change all my passwords.
> Welp, time to stop using the same password for multiple services. > Welp, time to start using a password manager. FTFY
I already use Lastpass, which makes regenerating all my passwords a little easier.
I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site. 1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...
I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.
Oh crap. I've entered my banking password into Transferwise quite a few times. Welp, time to change all my passwords.
> Welp, time to stop using the same password for multiple services. > Welp, time to start using a password manager. FTFY
Which is pretty strange in itself, to trust a 3rd party with your internet banking password, but that's how it works.
Apparently root case was: /* generated code */ if ( ++p == pe ) goto _test_eof; "The root cause of the bug was that reaching the end of a buffer was checked using the equality operator and a pointer was able to step past the end of the buffer. This is known as a buffer overrun. Had the check been done using >= instead of == jumping over the buffer end would have been caught." Detailed timeline: "2017-02-18 0011 Tweet…
Earlier quoted context omitted.
@jgrahamc: If this problem doesn't justify emailing all proxy service customers, what problem would?
We are emailing them all, but we are starting with those that we know had data cached by a search engine.
Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…
I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site. 1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...
I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.
I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?
Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption. So even a full memory dump of what's transported in TLS should, as long as it's properly implemented, only reveal an SRP authentication session and subsequently symmetrically encrypted data. (And inside that SR…
My confidence in that has dropped slightly in the past day.