Re:Ask HN: What's the actual fallout been from the Cloudflar...
by mseebach on Monday March 06, 2017 @07:55AM
(#13802340)
> nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere
"Not measurable over the background noise" is a pretty workable definition of "no fallout".
Re:Ask HN: What's the actual fallout been from the Cloudflar...
by stouset on Monday March 06, 2017 @12:15PM
(#13804129)
The problem is that you can't magically measure it separately from the background noise. It becomes part of the background noise.
Lacking tools to measure an effect doesn't mean it has no effect.
Some people's accounts will be compromised, and nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere.
The more responsible Cloudflare customers have invalidated existing sessions; that's much less hassle than forcing a password reset, and since session tokens are transmitted in every request, a leaked token is much more likely than a leaked password.