Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

141–150 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#141

Post by philsnow »

detaro wrote: post #123
philsnow wrote: post #121

Earlier quoted context omitted.

What ? No, that shouldn't be possible (unless the site operator massively fucked up, or there's some attack that feasibly lets you go from one or more TOTP values to the likely shared secret). TOTP works by having (as you said) a shared secret key, and both sides calculate an HMAC of the secret along with the timestamp, and then just modulo the resulting HMAC by 10^6 (usually, for TOTPs with six digits). Your google…

parent said "if you setup TOTP". If you did that, you somehow communicated the shared secret key to your authenticator, presumably from a web page. Which could have leaked.

ah, thank you, that makes more sense.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#142

Post by dingdongding »

danjoc wrote: post #134

Is there a "standard" in the works for changing a password? Stuff like this is happening rather too frequently for my taste. I need a tool I can use to update all my passwords everywhere automatically and store the new ones in my password manager.

I agree. This is about time password managers and "changing password" should be standardized. Password Managers should now be supported across the board. Not just browsers.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#143

Post by jbkly7 »

danjoc wrote: post #134

Is there a "standard" in the works for changing a password? Stuff like this is happening rather too frequently for my taste. I need a tool I can use to update all my passwords everywhere automatically and store the new ones in my password manager.

LastPass has auto-password change: https://blog.lastpass.com/2015/05/auto-password-change-now-a...

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#144

Post by analogist »

danielweber wrote: post #110
analogist wrote: post #15

Earlier quoted context omitted.

Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption. So even a full memory dump of what's transported in TLS should, as long as it's properly implemented, only reveal an SRP authentication session and subsequently symmetrically encrypted data. (And inside that SR…

I typically think of "encryption inside of encryption" as a boondoggle more likely to somehow break things than make things stronger. My confidence in that has dropped slightly in the past day.

I'm no expert, but intuitively it would seem that encryption-inside-encryption would be snake oil when they're meant to guard against the same layer/attack vector/threat model: for example, if you nest Serpent inside AES for a single local file encryption operation (ahem, TrueCrypt), that seems very gimmicky.

But if the encryption are supposed to protect separate and independent OSI layers or operation steps, then it would seem to me it's fully valid - specifically, in this case: - TLS dissolves inside HTTP-HTTPd endpoints or any reverse proxies, if used - additional SRP-negotiated AES dissolves inside client to the process doing key handling - final "actual" key encryption, handling at-rest encryption, and to make sure it's zero-knowledge to the storage handler

They seem to me to be guarding information leakage against very different parts of the key mangement process (storage, manipulation, http transport), and that doesn't seem to be snake oil to me.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#145

Post by AGKyle »

dingdongding wrote: post #140
erichurkman wrote: post #103

Earlier quoted context omitted.

Isn't this what Watchtower is supposed to be for? I have no idea if AgileBits is going to add this list to Watchtower, though.

I never received any notification from Watchtower to change password during linkedin hack, Dropbox hack and Yahoo hack. Apparently Watchtower was only supposed to notify you about Heartbleed vulnerability according to their website. > 1Password Watchtower is a service that identifies websites that are vulnerable to Heartbleed, and will suggest which sites need to have their passwords changed. https://watchtower.agile…

We update it all the time with new items as we see them announced. It won't contain all of them but whatever we stumble on or see in various places get added when there's an actionable thing a user can do.

We've added a handful of sites today that have suggested changing passwords after this announcement.

Kyle

AgileBits

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#146

Post by [deleted] »

r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

[deleted]

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#147

Post by IveStopped »

r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

Sorry bout that. Wasn't really even my idea, either.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#148

Post by mbesto »

ig1 wrote: post #118

Worth noting this statement by Cloudflare CTO: "I am not changing any of my passwords. I think the probability that somebody saw something is so low it's not something I am concerned about." http://www.bbc.co.uk/news/technology-39077611

*Article says COO, but Twitter says CTO. Strange.

And he's fairly active on these forums. That seems like such an odd thing to say given how important security is/should be at CF...curious if jgrahamc would further clarify his position here.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#149

Post by pkcsecurity »

poorman wrote: post #99
actuator wrote: post #7

I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site. 1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...

I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.

fwiw, I wrote a script in node that takes your 1Password exported URLs and checks them for cfduid and headers...not nearly as nice as if 1Password did this with Watchtower, but in the meantime...

https://github.com/weltan/cloudbleed-1password

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#150

Post by wallacoloo »

r1ch wrote: post #77
eli wrote: post #73

Earlier quoted context omitted.

Affected sites leaked data from random other CF customers. So any site using CF regardless of settings could have leaked private data out there.

Sites using Cloudflare in DNS only mode won't have sent any requests that could be leaked.

Indeed, and it's pretty annoying having my site in that list despite not using CloudFlare's reverse proxy service. If my website handled user logins or sensitive data no doubt I'd have customers contacting me or shying away from my site now. This list needs more vetting.
Post reply on HN