4 ms·

I assumed this was a reset from Google due to the Cloudflare stuff, but seems like it wasn't?

kbenson 10y ago
That was my first thought. Maybe accounts with google credentials exposed in some way had a forced logout to invalidate exposed auth token?
6nf 10y ago
I would be surprised if Gmail sent any tokens or credentials via Cloudflare
- dawnerd 10y ago
  Fear might be shared email/passwords since thats really common.
  - wapz 10y ago
    What's the fear? Aren't all passwords encrypted on the server side?
    - pshc 10y ago
      But if an in-transit plaintext password is leaked by CloudFlare, server-side encryption is irrelevant. (... that said, it's not like revoking sessions would impede a password-holding adversary...)
      - amatriain 10y ago
        It would for users that have 2FA enabled.
- pilsetnieks 10y ago
  Third party sites where the Google account was used for authorization, could have transmittted data through Cloudflare. (Think "Log in with Google" button on millions of sites.)
btown 10y ago
Perhaps they are worried about active oauth tokens having leaked?
chipperyman573 10y ago
Does Google use cloudflare? Don't they do everything themselves?
- morecoffee 10y ago
  Yes. They integrate as a proxy for Google's cloud stuff. https://blog.cloudflare.com/cloudflare-is-now-a-google-cloud-platform-technology-partner/ https://blog.cloudflare.com/cloudflare-is-now-a-google-cloud...
  - polishTar 10y ago
    Not quite. CloudFlare is available to users of Google Cloud, but Google services don't use CloudFlare. The only exception I could imagine would be some service that was brought in as part of an acquisition but has not yet been migrated to Google's internal platform. Obviously not applicable to products like Gmail or other core G Suite apps.
notatoad 10y ago
"it's really not related" https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c23 https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
- mirimir 10y ago
  Well, he said that it wasn't. But then refused to say more, and disabled comments. Strange.
  - kelnage 10y ago
    I would imagine that was because the comments are intended for discussion about that particular issue, not for random users to jump in with wild conjecture on its impacts. Honestly not that strange.
  - bestnameever 10y ago
    > But then refused to say more What more is there to say?
    - askvictor 10y ago
      A link to an announcement on the issue?
      - darklajid 10y ago
        Not in a random unrelated bug that people hijacked to discuss a different problem, no. I think there's nothing special about refusing to discuss stuff there and disabling comments.
        mirimir 10y ago
        That's true, if it is "a random unrelated bug". I suspect that there will be many such reports in coming weeks. And lots of denial, and refusal to comment.
      - 10y ago

That was my first thought. Maybe accounts with google credentials exposed in some way had a forced logout to invalidate exposed auth token?

6nf 10y ago

I would be surprised if Gmail sent any tokens or credentials via Cloudflare

dawnerd 10y ago
Fear might be shared email/passwords since thats really common.
- wapz 10y ago
  What's the fear? Aren't all passwords encrypted on the server side?
  - pshc 10y ago
    But if an in-transit plaintext password is leaked by CloudFlare, server-side encryption is irrelevant. (... that said, it's not like revoking sessions would impede a password-holding adversary...)
    - amatriain 10y ago
      It would for users that have 2FA enabled.
pilsetnieks 10y ago
Third party sites where the Google account was used for authorization, could have transmittted data through Cloudflare. (Think "Log in with Google" button on millions of sites.)

btown 10y ago

Perhaps they are worried about active oauth tokens having leaked?

chipperyman573 10y ago

Does Google use cloudflare? Don't they do everything themselves?

morecoffee 10y ago
Yes. They integrate as a proxy for Google's cloud stuff. https://blog.cloudflare.com/cloudflare-is-now-a-google-cloud-platform-technology-partner/ https://blog.cloudflare.com/cloudflare-is-now-a-google-cloud...
- polishTar 10y ago
  Not quite. CloudFlare is available to users of Google Cloud, but Google services don't use CloudFlare. The only exception I could imagine would be some service that was brought in as part of an acquisition but has not yet been migrated to Google's internal platform. Obviously not applicable to products like Gmail or other core G Suite apps.

notatoad 10y ago

"it's really not related" https://bugs.chromium.org/p/project-zero/issues/detail?id=1139#c23 https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

mirimir 10y ago
Well, he said that it wasn't. But then refused to say more, and disabled comments. Strange.
- kelnage 10y ago
  I would imagine that was because the comments are intended for discussion about that particular issue, not for random users to jump in with wild conjecture on its impacts. Honestly not that strange.
- bestnameever 10y ago
  > But then refused to say more What more is there to say?
  - askvictor 10y ago
    A link to an announcement on the issue?
    - darklajid 10y ago
      Not in a random unrelated bug that people hijacked to discuss a different problem, no. I think there's nothing special about refusing to discuss stuff there and disabling comments.
      - mirimir 10y ago
        That's true, if it is "a random unrelated bug". I suspect that there will be many such reports in coming weeks. And lots of denial, and refusal to comment.
    - 10y ago