what's AC's position about the leak of member data?

[IHateMyTreo]

https://www.engadget.com/2017/02/24/server-bug-leaks-user-data-for-thousands-of-popular-websites/

 

[hallux]

That list could be misleading. That's a list of ALL companies associated with that site, even just for DNS routing rather than actual hosting of content/user data. If our info was at risk, I'd expect an email advising of such, possibly from a MobileNations email address rather than AndroidCentral.

I wonder how the folks, like myself, that use Google login for the site would be impacted in this...

 

[Marcus Adolfsson]

We received the following from CloudFlare:
"Your domain is not one of the domains where we have discovered exposed data in any third party caches."
We are looking into any security implications from the CloudFlare issue. Google logins etc should not be an issue due to the way those login mechanism work (we never see any sensitive data, it is all handled on Google's side).

 

[Marcus Adolfsson]

I just spoke with Tech ops and they confirmed that the three features causing the issue with CloudFlare (Email Address, Obfuscation, Server-side Excludes, Automatic HTTPS Rewrites) has never been active on our sites.

 

[Almeuit]

I just spoke with Tech ops and they confirmed that the three features causing the issue with CloudFlare (Email Address, Obfuscation, Server-side Excludes, Automatic HTTPS Rewrites) has never been active on our sites.

Thanks Marcus!

 

[hallux]

Awesome, thanks for the info Marcus. Great to know AC is secure...

 

[Matty]

That's really good to hear, i put a lot of trust in Mobile Nations and AndroidCentral to keep any information i share private So its good to see i can continue with that trust

 

[B. Diddy]

So awesome to hear it straight from the Big Kahuna himself!

 

[gizmo21]

I just spoke with Tech ops and they confirmed that the three features causing the issue with CloudFlare (Email Address, Obfuscation, Server-side Excludes, Automatic HTTPS Rewrites) has never been active on our sites.

But as the site A information is leaked on OTHER site B is it really needed that the vulnerable function have to be enabled on site A, or is it perhaps enough having site B had those active?

Just asking, cause e.g. change.org already writes mails telling me to change my password as precaution: https://www.hackread.com/cloudflare-cloudbleed-attack-change-org-password-email/
(Even if they did on-top some real security mistake sending a password-change link inside an email).

Update: OK did not see this, so if cloudflare told you mobilenations is NOT affected by leak (or at least did not find leaked info on other sites) - it should be save (I think):

We received the following from CloudFlare:
"Your domain is not one of the domains where we have discovered exposed data in any third party caches."

 

[pkcable]

Now just because AC is safe does NOT mean we ALL are safe! Note this advice from Modern Dad...

 

[offsidebowler]

Lol what information could get leaked, your email address? Maybe I'm missing something.

 

[gizmo21]

Lol what information could get leaked, your email address? Maybe I'm missing something.

Perhaps you'll know soon:
Carders capitalize on Cloudflare problems, claim 150 million logins for sale | CSO Online