Recent searches
Search options
https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/
the only way for cloudflare to have this data is if it is inside the ssl channel, analyzing traffic to their customers who are logging in.
ssssoooooooo i guess this makes the cloudflare logs a massive target for nation states now?
okay so several people have responded to this thread, pointing at me and figuratively waving off this as "well, duh. cloudflare terminates ssl. theres no surprise here"
so i feel like i have to point this out to the non-security folks.
the part where they, without consent, intercept the traffic (ESPECIALLY FUCKING AUTHENTICATION), imbibe it into a research context, and perform password analysis on it?
Thats a crime
its the same as MITMing someone from their corp workstation and stealing creds
@fedops@fosstodon.org@Viss which incidentally is exactly how all the corpo "security" tools work. Nextgen firewalls, zero trust clients, the lot. Check your certs when assuming you're connecting to a "secure" site and you'll see.
