Re:Cloudflare data still in Bing caches
by nikcub on Saturday February 25, 2017 @12:26AM
(#13730228)
A list of Cloudflare DNS customers is almost completely unrelated to the list of sites affected by this bug.
Being a DNS customer doesn't mean you're using CF SSL proxy and using the proxy service doesn't mean you're using DNS
That's beyond flawed because he assumes any site that uses cloudflare's NS is using the proxied services. Which is 100% utterly _wrong_.
Re:Cloudflare data still in Bing caches
by CamelCaseName on Saturday February 25, 2017 @03:31AM
(#13730645)
But he explained this at the very top of the readme?
>This list contains all domains that use Cloudflare DNS, not just the Cloudflare proxy (the affected service that leaked data). It's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised, and sites may be compromised that do not appear on this list.
Re:Cloudflare data still in Bing caches
by Operyl on Saturday February 25, 2017 @08:03AM
(#13731384)
Originally that wasn't the case, iirc, a bunch of angry people complained to get it added.
Re:Cloudflare data still in Bing caches
by WalterGR on Friday February 24, 2017 @11:56PM
(#13730137)
What is the correct way?
Honest question...
Out of hundreds of passwords I potentially need to reset, I'd like to prioritize.
Passwords and domain lists aren't a good answer. Explained here: https://gist.github.com/raggi/0d22757fee6eff4bb93a5731215060...
Re:Cloudflare data still in Bing caches
by verroq on Saturday February 25, 2017 @12:13AM
(#13730195)
You have resolve the DNS and see if it points to one of Cloudflare's reverse proxies.
And even then, no guarantee. One could host a static shopwindow site on his own, and use CF for the actual backend of a mobile app under a different domain that nobody knows about.
There is no real way to know what has leaked and from whom. The only ones with real info are CF and it's clear from the amount of sites they've missed in their purge-requests that even them don't really know.
Yup, I started it because he didn't merge my pull request :D https://github.com/pirate/sites-using-cloudflare/pull/55
If you find some samples with domain names / unique identifiers of domains (e.g. X-Uber-...) you are welcome to contribute to the list: https://github.com/Dorian/doma/blob/master/_data/cloudbleed....