5 ms·
Neither this thread nor the Cloudflare blog post include concise steps for customers who were exposed. There's an argument for changing secrets (user passwords
by rdl 10y ago
Neither this thread nor the Cloudflare blog post include concise steps for customers who were exposed.
There's an argument for changing secrets (user passwords, API keys, etc.) for potentially affected sites, plus of course investigating logs for any anomalous activity. It would be nice if there were a guide for affected users, maybe a supplemental blog post.
(and yet again: thank you Google for Project Zero!)
- meowface 10y agoWhat can they even say? "Change everything" doesn't really work. Any potentially secret data to or from a server could have been exposed.
- rdl 10y agoYes, but in general keys provide ongoing access; sensitive data itself is more limited in scope. Keys, auth tokens, etc. would be what I'd focus on.
- Kalium 10y agoRight there with you. I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.
- nikisweeting 10y agoI'm scrambling to compile an list of impacted domains and some easy-to-understand instructions that I can send friends and family: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare
- garblegarble 10y ago>I'm currently scrambling for remediation ideas. "Change everything" isn't tractable. It's not easy to deal with but it is the best remediation available to you, given the exceptionally broad scope and months-long period where data was apparently leaking (the cloudflare blog post lists 2016-09-22 as the first date when leaks were possible)
- jstanley 10y agoChange my name? Change my address? Change my date of birth? My mother's maiden name? My passport number? It's simply not possible to change all of the sensitive information that might have been leaked.
- rdl 10y agoI think I've settled on "change admin passwords, change any m2m auth credentials which don't require user intervention (API keys in apps, etc. should be rolled regularly anyway)" Forcing individual end users to change their passwords is probably a net-negative. I might prioritize it if I have OTHER security improvements to roll out soon, though (2FA, upgrading auth infrastructure, other potential compromise, etc.). I don't think anything else is really viable. Bitcoin addresses/keys which transited Cloudflare probably should be updated, though, on the extremely off chance.
- Kalium 10y agoYeah. I'm changing all the passwords I can get my employer to go for and upgrading auth infrastructure for the rest.