Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

111–120 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#111

Post by OraclesDyn388 »

IgorPartola wrote: post #107
r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

It's clever but feels at least a 3/10 shitty. Dyn is an old company and back in the day they provided free subdomains while nobody else did. I haven't used them recently because their pricing seems so high. How do others feel about them?

With Oracle announcing they're buying Dyn, I'm "voting with my wallet" and moving off them.

I'm small potatoes compared to Netflix or other big dogs that use them.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#112

Post by cknight »

r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

I suppose it could be seen as a response in kind after: https://blog.cloudflare.com/dyn-issues-affecting-joint-custo...

I would consider an email a bit of an escalation though, as opposed to a blog post.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#113

Post by r1ch »

IgorPartola wrote: post #107
r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

It's clever but feels at least a 3/10 shitty. Dyn is an old company and back in the day they provided free subdomains while nobody else did. I haven't used them recently because their pricing seems so high. How do others feel about them?

I still have a lifetime standard DNS subscription with them from back in the day when they were dyndns.org and you could physically mail them cash. The DNS hosting has been very solid (except for the day Mirai took them offline) but the standard query limits are way too low for any moderately trafficked website. All the managed DNS providers I looked at seem to have very restrictive query limits without a "enterprise - contact us" plan, one of the reasons why I decided to just do DNS-only on Cloudflare.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#114

Post by vmarsy »

Something I have a hard time understanding, is how Cloudfare's cache generator page had access to sensitive information ?

Were the 2 things running on the same process? If they were not, there's no way that the buffer overrun could read an other process memory, right? it would have failed with a segfault type of error.

If so, shouldn't Cloudfare consider running the sensitive stuff on a different process, so that no matter how buggy their caching engine is, it would never inadvertently read sensitive information?

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#115

Post by philsnow »

doubleunplussed wrote: post #104
pc86 wrote: post #96

Earlier quoted context omitted.

> Welp, time to stop using the same password for multiple services. > Welp, time to start using a password manager. FTFY

OP isn't saying they used the same password for transferwise as for their bank. Transferwise allows you to log into your internet banking and authorize a transaction through their site. You actually give them your internet banking password, regardless of how you log into their site. Which is pretty strange in itself, to trust a 3rd party with your internet banking password, but that's how it works.

This is the main reason I've never used Mint.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#116

Post by cjslep »

vmarsy wrote: post #114

Something I have a hard time understanding, is how Cloudfare's cache generator page had access to sensitive information ? Were the 2 things running on the same process? If they were not, there's no way that the buffer overrun could read an other process memory, right? it would have failed with a segfault type of error. If so, shouldn't Cloudfare consider running the sensitive stuff on a different process, so that no…

SSL connections were terminating at the proxy, so the proxy used plain HTTP to the web service backends.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#117

Post by dugmartin »

vmarsy wrote: post #114

Something I have a hard time understanding, is how Cloudfare's cache generator page had access to sensitive information ? Were the 2 things running on the same process? If they were not, there's no way that the buffer overrun could read an other process memory, right? it would have failed with a segfault type of error. If so, shouldn't Cloudfare consider running the sensitive stuff on a different process, so that no…

My guess given their widespread use of Go is that each parser was a goroutine which uses the same process heap as other goroutines parsing other page requests.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#119

Post by p49k »

ig1 wrote: post #118

Worth noting this statement by Cloudflare CTO: "I am not changing any of my passwords. I think the probability that somebody saw something is so low it's not something I am concerned about." http://www.bbc.co.uk/news/technology-39077611

That kind of statement reminds me of this guy:

https://www.wired.com/2010/05/lifelock-identity-theft/

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#120

Post by AGKyle »

erichurkman wrote: post #103
poorman wrote: post #99

Earlier quoted context omitted.

I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.

Isn't this what Watchtower is supposed to be for? I have no idea if AgileBits is going to add this list to Watchtower, though.

Disclaimer: I work for AgileBits, makers of 1Password

I am helping comb through a list of sites to see which of those has suggested password updates.

I think we've had very few sites suggest updating the password though. Have you all seen any sites explicitly state users should update? If so I'd love a list so we can get them in Watchtower.

Kyle

Post reply on HN