Hacker News Reader

Comment by _m8fo | Hacker News Reader

> "I am not changing any of my passwords. I think the probability that somebody saw something is so low it's not something I am concerned about."

I am confused. The probability of someone seeing it is irrelevant, given that the leak happened already. Is security not supposed to be preemptive? For such an easy measure to take (password changing), saying you don't want to change it seems pretty silly. You can change all of your passwords in 30 minutes tops.

I believe the CTO is also mistaken about the probability anyway. As this is more publicized the likelihood of malicious people exploiting this will only increase. Therefore it's a race between them and the good actors fixing the problem. In the interim, changing your passwords at the very least should be done.

View on HN

I feel like I'm missing a partial context but "You can change all of your passwords in 30 minutes tops" is not true. I have a minimal amount of accounts (I close accounts I don't use) and I can't imagine it taking me less than several hours of slogging through it to change all my passwords (e.g. updating password database, 2FA confirmations, making sure I don't lock the account I change the password on, etc.)

So I have to aim for the clearly impacted ones from this (if named/discoverable) and then have to decide how vulnerable I feel and whether I should go through the extra effort (or not) for every password I conceivably have.

I am halfway through changing the 60 passwords for services and accounts I have used since last September.

Cloudflare's COO publicly dismissing the danger with a wan smile and a wave of his hand was motivation enough for me.

That, and this ridiculous statement: "Unfortunately, it was the ancient piece of software that contained a latent security problem and that problem only showed up as we were in the process of migrating away from it," he wrote.

My understanding is that they were not "in the process of migrating away from" an "ancient piece of software," but rather that this was something they implemented five months ago and that they had no idea anything was wrong until Google told them what they found.

That sort of behavior does not inspire trust and confidence.

This is clearly PR on his part; I'm not sure it'll play out the way he anticipates though, this basically screams carelessness to a bunch of people who will be (rightfully) upset about the bug.

Reply on news.ycombinator.com