Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

191–200 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#191

Post by Crosseye_Jack »

clort wrote: post #187
Crosseye_Jack wrote: post #64

Earlier quoted context omitted.

TL;DR? You should be ok... Long Version. That (most likely) would of used oauth. So instead of sending your FB password to the site to log you into FB with. You give your FB password (if your not signed in) to FB and then facebook give the site using "sign in with Facebook" a token they can use with facebook to get account info / do actions on your FB account. Now depending on which "sign in with" system you used the…

Its always interesting to me that such a good answer implies technical excellence of its own, but criticism follows: "would of" which you used twice (and therefore more likely intentionally) is not correct English! The correct phrase is "would have" and its easy to see why, online, people use "of" .. when speaking, the h is silent and the contracted written form is "would've" so it does sound similar, but because "of…

Opinion follows: I don't give a fuck.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#192

Post by jpetersonmn »

cjslep wrote: post #116
vmarsy wrote: post #114

Something I have a hard time understanding, is how Cloudfare's cache generator page had access to sensitive information ? Were the 2 things running on the same process? If they were not, there's no way that the buffer overrun could read an other process memory, right? it would have failed with a segfault type of error. If so, shouldn't Cloudfare consider running the sensitive stuff on a different process, so that no…

SSL connections were terminating at the proxy, so the proxy used plain HTTP to the web service backends.

Are you sure about this? Just because they terminate ssl on the proxy doesn't mean the traffic between the proxy and the web service backends was plain HTTP. That's certainly not how we do things.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#193

Post by kiallmacinnes »

And, I've found several of my domains on this list.. Some of which don't host web content etc and only use cloudflare for DNS. The list is currently ~4.3mil entries, which honestly feels like a rather low figure. I have no data to back up my gut feeling though ;)

Anyway, I'm OK with them being on this list, as I believe understanding the scope of the problem is important to figuring out how we prevent these kinda problems in the future.. (For example, answering this question requires understanding who uses CloudFlare: Why are so many sites concentrated on a single infrastructure?)

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#194

Post by Programmatic »

user5994461 wrote: post #173
xuki wrote: post #33

Earlier quoted context omitted.

2FA doesn't protect you against cookie/token stealing. The website owners need to invalidate all of that on their ends.

It does and you don't even need real 2FA for it. Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.

As someone unfamiliar with this, can you please elaborate? Would the host be fingerprinted on every subsequent usage of the authentication token, and using what methods?

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#196

Post by sah2ed »

user5994461 wrote: post #173
xuki wrote: post #33

Earlier quoted context omitted.

2FA doesn't protect you against cookie/token stealing. The website owners need to invalidate all of that on their ends.

It does and you don't even need real 2FA for it. Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.

Usually only the big tech companies and well-funded startups can afford to use device fingerprinting in addition with auth tokens. This essentially involves keeping track of the last time you logged in, your IP address, your device characteristics then notifying if there is an unusual change in any of those metrics.

For instance, although I have never been to China, I once got a notification from Facebook that someone attempted a password reset on my account from China. This was shortly after the publication of LinkedIn's stolen database of users which affected millions of users including my account.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#197

Post by sah2ed »

Programmatic wrote: post #194
user5994461 wrote: post #173

Earlier quoted context omitted.

It does and you don't even need real 2FA for it. Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.

As someone unfamiliar with this, can you please elaborate? Would the host be fingerprinted on every subsequent usage of the authentication token, and using what methods?

Not the parent but I posted a plausible explanation to your question here: https://news.ycombinator.com/item?id=13731656

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#198

Post by mjmasn »

jgrahamc wrote: post #188
mjmasn wrote: post #182

Earlier quoted context omitted.

@jgrahamc how can you even answer that question when you didn't detect the issue yourselves? The email we received was a joke, OK great our domains 'weren't affected' in the sense of memory dumps weren't being injected into our HTML, and luckily we only proxy static images/html through CF so at worst a visitor's google analytics cookie could have been leaked, but on a personal level any person who has used any CF-pro…

I haven't for once thought about cost or shareholder value in the last week. Been working round the clock to clean up and evaluate impact.

Good to hear, I wasn't really trying to accuse, just frustrated at how downplayed this is for ordinary people - your customers' customers. Using language like affected sites when really you mean sites that dumped data about some unknown quantity of affected sites is already a source of confusion even on HN, let alone the wider world. I appreciate this isn't fun for you and your team right now too, so I do hope you've got lucky here and erased the worst of the damage before anyone malicious managed to get involved.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#199

Post by therealmarv »

pmontra wrote: post #72
ComputerGuru wrote: post #67

Earlier quoted context omitted.

So why do you have to change them all?

My cleartext passwords could have been dumped into the responses of some other site together with my user names. That's the gist of this incident.

I still don't understand why you have to change every password (are not they supposed to be all different in a password manager?). Of course if you are super extra mega careful then change them all...

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#200

Post by snowwrestler »

danielweber wrote: post #110
analogist wrote: post #15

Earlier quoted context omitted.

Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption. So even a full memory dump of what's transported in TLS should, as long as it's properly implemented, only reveal an SRP authentication session and subsequently symmetrically encrypted data. (And inside that SR…

I typically think of "encryption inside of encryption" as a boondoggle more likely to somehow break things than make things stronger. My confidence in that has dropped slightly in the past day.

PGP email sent over TLS would be an example of nested encryption that people take for granted. So would E2E encrypted chat systems like iMessage, Signal, and WhatsApp, which encrypt each message on the machine, then use TLS to communicate with servers.
Post reply on HN