4 ms·

Which means any user who has used any service which uses CloudFlare, right? At least in theory.

biafra 10y ago
How can I find out which services I have accounts with are using cloudflare? Or better have been using cloudflare in recent months? Assume I have a list of domains, where I have accounts.
- teraflop 10y ago
  You can check IP whois records, but it'll be very hard to be 100% sure about any of them. For example, one of the examples from the bug report is Uber, which doesn't use Cloudflare for its home page but apparently does for one of its internal API endpoints.
- eropple 10y ago
  At this point, I would just start rolling everything. (And I have.)
- revi 10y ago
  There is a chrome extension named "claire"[1] which tells you if they use CloudFlare or not, but not sure about other browser (FF or else). [1]: https://chrome.google.com/webstore/detail/claire/fgbpcgddpmjmamlibbaobboigaijnmkl https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...
  - photon-torpedo 10y ago
    For Firefox, I just made this: https://github.com/traktofon/cf-detect https://github.com/traktofon/cf-detect
- nikisweeting 10y ago
  We're compiling a list of affected domains using several scrapers here: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare
  - gabemart 10y ago
    I ranked your list of Cloudflare-using domains by their Alexa rank. Sharing here in case anyone else finds it useful (warning - it's 1.1MiB gzipped / 2.4MiB uncompressed) https://polarisedlight.com/tmp/cf_ranked.txt https://polarisedlight.com/tmp/cf_ranked.txt any domains outside the top 1 million are ommitted
  - dustyfresh 10y ago
    Hacked this together to determine which ones out of the list are potentially using cloudflare reverse proxies. You could also send an HTTP request to them and look for the cloudflare-nginx Server header. https://gist.github.com/dustyfresh/4d8d364ca4c6da465cfc7d8176a166b9 https://gist.github.com/dustyfresh/4d8d364ca4c6da465cfc7d817...
- deleted 10y ago
  [deleted]
user5994461 10y ago
[edit: correction]
- rdl 10y ago
  No. 3438 domains were configured to expose this, and were potentially queried and logged by a far greater number of people. And yet other data (anything in cloudflare for months) could be exposed. Potentially huge amounts of stuff might be exposed, but I have some assurances that "the practical impact is low" from someone I trust, so I think it's just a lot of random data. I'd still rotate all credentials which passed through Cloudflare in the past N months (and if I were a big consumer site NOT on Cloudflare, I might change end user passwords anyway, due to re-use), but I don't think it will be the end of the world.

How can I find out which services I have accounts with are using cloudflare? Or better have been using cloudflare in recent months? Assume I have a list of domains, where I have accounts.

teraflop 10y ago
You can check IP whois records, but it'll be very hard to be 100% sure about any of them. For example, one of the examples from the bug report is Uber, which doesn't use Cloudflare for its home page but apparently does for one of its internal API endpoints.
eropple 10y ago
At this point, I would just start rolling everything. (And I have.)
revi 10y ago
There is a chrome extension named "claire"[1] which tells you if they use CloudFlare or not, but not sure about other browser (FF or else). [1]: https://chrome.google.com/webstore/detail/claire/fgbpcgddpmjmamlibbaobboigaijnmkl https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...
- photon-torpedo 10y ago
  For Firefox, I just made this: https://github.com/traktofon/cf-detect https://github.com/traktofon/cf-detect
nikisweeting 10y ago
We're compiling a list of affected domains using several scrapers here: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare
- gabemart 10y ago
  I ranked your list of Cloudflare-using domains by their Alexa rank. Sharing here in case anyone else finds it useful (warning - it's 1.1MiB gzipped / 2.4MiB uncompressed) https://polarisedlight.com/tmp/cf_ranked.txt https://polarisedlight.com/tmp/cf_ranked.txt any domains outside the top 1 million are ommitted
- dustyfresh 10y ago
  Hacked this together to determine which ones out of the list are potentially using cloudflare reverse proxies. You could also send an HTTP request to them and look for the cloudflare-nginx Server header. https://gist.github.com/dustyfresh/4d8d364ca4c6da465cfc7d8176a166b9 https://gist.github.com/dustyfresh/4d8d364ca4c6da465cfc7d817...
deleted 10y ago
[deleted]

user5994461 10y ago

[edit: correction]

rdl 10y ago
No. 3438 domains were configured to expose this, and were potentially queried and logged by a far greater number of people. And yet other data (anything in cloudflare for months) could be exposed. Potentially huge amounts of stuff might be exposed, but I have some assurances that "the practical impact is low" from someone I trust, so I think it's just a lot of random data. I'd still rotate all credentials which passed through Cloudflare in the past N months (and if I were a big consumer site NOT on Cloudflare, I might change end user passwords anyway, due to re-use), but I don't think it will be the end of the world.