Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

201–210 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#201

Post by paulddraper »

r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

I no great fan of Dyn, but I spend all day hearing "security is important", that my users and enterprises require security, and that I should do X, Y, and Z for security.

If Dyn delivers where Cloudflare does not....it's not something that can be ignored out of hand.

Maybe Dyn's email was rude maybe it wasn't, but I think perpetually too few people make real decisions based on security, and I'm a little forgiving of pushes in the other direction.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#202

Post by paulddraper »

b1naryth1ef wrote: post #154
r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

Coming from a company that regularly goes down to DDoS attacks :thinking:

Do you have any time in mind other than 2016-10-21?

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#203

Post by drakenot »

data4science wrote: post #152
AGKyle wrote: post #120

Earlier quoted context omitted.

Disclaimer: I work for AgileBits, makers of 1Password I am helping comb through a list of sites to see which of those has suggested password updates. I think we've had very few sites suggest updating the password though. Have you all seen any sites explicitly state users should update? If so I'd love a list so we can get them in Watchtower. Kyle

I would subscribe to Watchtower, or, heck, probably even 1Password Famlies, if AgileBits took a more aggressive/proactive approach to password updates: 1. Prompt batch password resets for services whose vulnerabilities have been exposed before those exposed admit their breach to consumers (e.g. All services compromised by the Cloudflare dump - usually consumers are the last to know). 2. Preformed all password resets…

Yep, I totally agree. Before I read this thread, I actually tweeted to 1Password to ask if they would be willing to produce some way for me to quickly cross reference the Cloudbleed sites against my 1Password vault.

I think Watchtower alerts should be based on any publicly known breach, not based on what the companies themselves say.

At this point, I consider any account using an affected Cloudflare service as potentially compromised.

This is a missed opportunity for 1Password to say that not only is your vault safe, but we will also help protect you from any potentially sites that had their data exposed.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#204

Post by paulddraper »

therealmarv wrote: post #199
pmontra wrote: post #72

Earlier quoted context omitted.

My cleartext passwords could have been dumped into the responses of some other site together with my user names. That's the gist of this incident.

I still don't understand why you have to change every password (are not they supposed to be all different in a password manager?). Of course if you are super extra mega careful then change them all...

pmontra doesn't have to change every password, just every password used by a website using Cloudflare (thus the purpose of the list of affected sites).

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#205

Post by user5994461 »

Programmatic wrote: post #194
user5994461 wrote: post #173

Earlier quoted context omitted.

It does and you don't even need real 2FA for it. Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.

As someone unfamiliar with this, can you please elaborate? Would the host be fingerprinted on every subsequent usage of the authentication token, and using what methods?

On a basic level, you can include a IP or a country inside your authentication tokens. That's enough to block some unwanted access.

On a more advanced level, there is a two step process, you authenticate as usual with your password and get a token, then the site will authenticate your device.

The device fingerprinting is totally transparent, it saves and checks some characteristics from your computer, and ensure you come from the same device next time.

For instance, on Facebook you can see a list of known device somewhere. When you connect on a new computer it sends you an email "connected from a new computer is that you?".

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#206

Post by nandhp »

pmontra wrote: post #35
chrisbolt wrote: post #9

Earlier quoted context omitted.

Is your password manager 1Password? https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...

No, it's keepassx on my laptop. I don't trust my passwords to somebody else.

You might find this script I wrote to be helpful:

https://github.com/nandhp/misc-utils/blob/master/keepassx_do...

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#207

Post by turbohedgehog »

ecnahc515 wrote: post #128
dugmartin wrote: post #117

Earlier quoted context omitted.

My guess given their widespread use of Go is that each parser was a goroutine which uses the same process heap as other goroutines parsing other page requests.

Have you read their incident response? If you had, you would know they weren't using Go for this and it was actually an issue an a parser generated by ragel (C++) which was then used as an nginx module.

To be clear, it was mis-use of Ragel, not the fault of the Ragel module

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#208

Post by wyuenho »

cknight wrote: post #112
r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

I suppose it could be seen as a response in kind after: https://blog.cloudflare.com/dyn-issues-affecting-joint-custo... I would consider an email a bit of an escalation though, as opposed to a blog post.

It may not be clear on that blog post, but internally, management stressed on multiple occasions immediately after the dyn incident to "don't be an asshole".

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#209

Post by cknight »

wyuenho wrote: post #208
cknight wrote: post #112

Earlier quoted context omitted.

I suppose it could be seen as a response in kind after: https://blog.cloudflare.com/dyn-issues-affecting-joint-custo... I would consider an email a bit of an escalation though, as opposed to a blog post.

It may not be clear on that blog post, but internally, management stressed on multiple occasions immediately after the dyn incident to "don't be an asshole".

I've made no claim that Cloudflare did anything wrong with that blog post.

I can however see how Dyn themselves might not have liked it all that much. And in saying so, I think both the content and medium that Dyn chose in r1ch's post might be further contextualised.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#210

Post by pfooti »

pfooti wrote: post #82
StavrosK wrote: post #28

I would like to point out that, if most sites used two-factor authentication, this leak would be at most a minor inconvenience. Maybe we should push for that more. Just days ago I talked to Namecheap about its horrible SMS-only 2FA and asked them to implement something actually secure, maybe contact your favorite site if they don't have 2FA yet.

Worth noting that authy is on the list. So if you synced your authy authenticators during that time, it's possible all your totp secrets leaked. One would hope authy encrypts those keys (I believe they do) client side, but yiiiiikes, I'm thinking about getting a yubikey.

Followup - authy's blog post confirmed what I thought: they do encryption of all the user-entered TOTP secrets on the client side and don't store decrypt keys. So anyone who was able to intercept your secret store would still have to decrypt it, which is (hopefully) Quite Difficult.

link: https://www.authy.com/blog/security-notice-authy-response-to...

Post reply on HN