their post-mortem indicates this would've been exploitable only 4 days prior to your initial contact. Is that info invalid?
Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc. https://bugs.chromium.org/p/project-zero/issues/detail?id=1139 …
-
-
-
Yes, they worded it confusingly. It was exploitable for months, we have the cached data.
- Još 4 druga odgovora
Novi razgovor -
-
-
Is it possible that server private HTTPS keys were leaked in the uninitialized data? Will
@cloudflare do a SSL key flush / replace? -
We don't think so, just the contents of HTTPS sessions.
Kraj razgovora
Novi razgovor -
-
-
could the internet archive contain cached data and not having been cleaned?
-
I haven't heard anyone say that, but it's possible.
Kraj razgovora
Novi razgovor -
-
-
Yes, we recovered and purged cached 1Password api data.
- Još 5 drugih odgovora
Novi razgovor -
-
-
hmm anything to worry about
@1Password? -
Nothing to worry about here. I got your back:https://blog.agilebits.com/2017/02/23/three-layers-of-encryption-keeps-you-safe-when-ssltls-fails/ …
- Još 2 druga odgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.