> What would actually have been leaked, a cleartext password or the encrypted/hashed password stored on an affected server (or both)? Depends on the app. The a

> What would actually have been leaked, a cleartext password or the encrypted/hashed password stored on an affected server (or both)? Depends on the app. The apps I write will do a PBKDF2 w/ 20K rounds on a password before sending to the server, which then hashes that hash again before storing/comparing. I suspect most apps just sent the username/password plaintext over SSL, meaning the plaintext passwords would have been leaked if the app used Cloudflare to terminate SSL. That said, if someone got the PBKDF2ed password hash from the SSL payload, they could just as easily use that to log into an account, but they'd have to at least do a little bit of work to break the hash if they wanted to actually crack the password. In other words, you were absolutely right to change all your passwords.