3 ms·
The trouble with this sort of bug is that we'll likely never know. Some people's accounts will be compromised, and nobody will know if it's been due to fishing
by perlgeek 10y ago
The trouble with this sort of bug is that we'll likely never know.
Some people's accounts will be compromised, and nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere.
The more responsible Cloudflare customers have invalidated existing sessions; that's much less hassle than forcing a password reset, and since session tokens are transmitted in every request, a leaked token is much more likely than a leaked password.
- mseebach 10y ago> nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere "Not measurable over the background noise" is a pretty workable definition of "no fallout".
- pg_is_a_butt 10y agoit's also a pretty workable definition of "ALL of the background noise was caused by this, and we're just now realising that, but don't have any way to prove it." you're all idiots.
- stouset 10y agoThe problem is that you can't magically measure it separately from the background noise. It becomes part of the background noise. Lacking tools to measure an effect doesn't mean it has no effect.