Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

211–220 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#211

Post by markonen »

orthecreedence wrote: post #12
noahm wrote: post #6

Earlier quoted context omitted.

The update from 1password indicated that there was application layer encryption happening in addition to the TLS encryption, so a breach of the TLS protection did not expose any sensitive data. Presumably other sites are in similar situations. But don't take my word for it, go change all your passwords.

> Presumably other sites are in similar situations. Not to my understanding. 1password uses client-side encryption, using keys generated from your master password. This means that any data transmitted over the wire is already encrypted, whether over SSL or not. Most other sites do not do this, at all, in any way. If you use a website that use'd CloudFlare's SSL termination, change your passwords, cancel your credit c…

If you'd seriously cancel your credit cards over this, I'd love to hear how you model that threat relative to all the other risks inherent in using a credit card anywhere (not just online).

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#212

Post by zer0t3ch »

actuator wrote: post #7

I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site. 1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...

I don't suppose you or anyone else might know: is there any way this could be adapted to work with Firefox history?

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#213

Post by cloudvrfy »

I wrote a simple website[1] to show if user have visited the websites included in the list automatically without browser plug-ins. It uses :visited CSS pseudo-class to highlight the site user have visited before. It is not 100% accurate, but it can be a fun way to quickly show people that they may visit sites on the list.

[1]https://cloudbleed.github.io/

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#214

Post by Gigablah »

IgorPartola wrote: post #107
r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

It's clever but feels at least a 3/10 shitty. Dyn is an old company and back in the day they provided free subdomains while nobody else did. I haven't used them recently because their pricing seems so high. How do others feel about them?

A few years ago I had Dyn hosting my DNS records for a website that had Amazon affiliate links. For some reason, one day someone at Amazon mistook those links for spam and contacted a service called MarkMonitor. MarkMonitor contacted Dyn and Dyn took down my account, shutting off access to the website. Without ever contacting me.

I was able to get my account reinstated after clearing the whole thing up with MarkMonitor and Amazon. I then removed all affiliate links and moved my DNS hosting elsewhere.

Never using Dyn again.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#215

Post by simooooo »

cloudvrfy wrote: post #213

I wrote a simple website[1] to show if user have visited the websites included in the list automatically without browser plug-ins. It uses :visited CSS pseudo-class to highlight the site user have visited before. It is not 100% accurate, but it can be a fun way to quickly show people that they may visit sites on the list. [1] https://cloudbleed.github.io/

Amazing that this hack still exists

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#217

Post by kazagistar »

paulddraper wrote: post #201
r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

I no great fan of Dyn, but I spend all day hearing "security is important", that my users and enterprises require security, and that I should do X, Y, and Z for security. If Dyn delivers where Cloudflare does not....it's not something that can be ignored out of hand. Maybe Dyn's email was rude maybe it wasn't, but I think perpetually too few people make real decisions based on security, and I'm a little forgiving of…

Is there some hard reason to believe that this kind of bug cannot happen on the Dyn stack? If all they have is "we got lucky, pick us instead" then they are just being scummy.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#218

Post by hughtopping »

actuator wrote: post #7

I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site. 1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...

In a similar vein, I wrote a very quick Powershell script to check domains from a LastPass CSV export - can share if anyone wants it.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#219

Post by nicolas_t »

r1ch wrote: post #97

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact. > As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid. > Cloudflare has admitted that the breach occurred, but Ormandy and other securit…

Here's the email I got from Cloudflare as a Dyn customer during the DDOS attacks:

> "As I'm sure you're aware, DDoS attacks on Dyn's network have caused massive outages for millions of sites. This prompted me to reach out on the behalf of Cloudflare to see if we can be helpful.

> Over the last 24 hours, we've been helping other Dyn customers migrate to Cloudflare to mitigate the risk.

> Who on your team would be the correct person to explore this with?"

It's not much better.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#220

Post by nicolas_t »

AGKyle wrote: post #145
dingdongding wrote: post #140

Earlier quoted context omitted.

I never received any notification from Watchtower to change password during linkedin hack, Dropbox hack and Yahoo hack. Apparently Watchtower was only supposed to notify you about Heartbleed vulnerability according to their website. > 1Password Watchtower is a service that identifies websites that are vulnerable to Heartbleed, and will suggest which sites need to have their passwords changed. https://watchtower.agile…

We update it all the time with new items as we see them announced. It won't contain all of them but whatever we stumble on or see in various places get added when there's an actionable thing a user can do. We've added a handful of sites today that have suggested changing passwords after this announcement. Kyle AgileBits

I think you should suggest all sites that could have been compromised not just the few that suggest changing passwords.
Post reply on HN