Bitcoin Forum

The POODLE vulnerability in TLS/SSL could have allowed a man-in-the-middle attacker to read encrypted forum traffic. For example, Tor exit nodes could have used this attack against anyone using Tor to access the forum. I disabled SSLv3 to prevent this attack in the future, and I logged everyone out to invalidate any possibly-compromised cookies. If you used a proxy or ISP that you don't absolutely trust to access the forum, then you should also change your password.

Most other sites are similarly affected.

Should we consider PIA to be an untrusted proxy, or should be generally be safe with them?

So only "untrustworthy ISP" and TOR users are affected, everyone else safe? I hate changing PW's. More susceptible to forget them.

You'll have to use your own judgement on that. Do you trust that your VPN/ISP didn't use this attack against you to steal your password?

Some things to know:
- It's an active attack, so if your ISP was just recording traffic, this wouldn't help them now.
- If you didn't actually use your password to log in within the last couple of days (ie, not just logging in using "remember me"), then your ISP only could have stolen your password if they'd known about the vulnerability before it was publicly announced.

Doesn't sound too dangerous as I use only ISP directly, changed my password anyway.

Btw, POODLE? Quite a letdown, after cool names like Heartbleed and Shellshock.

Yeah, it's a terrible name. The vulnerability isn't nearly as bad as Heartbleed or Shellshock, though.

Thanks for the info...hate to change pwd's but it's (almost) never too late :)

I've logged in through Cyberghost, but they have decent reviews so I'm not changing PW. ;)

If you used a WIFI that is unsecured or using WEP or vulnerable WPS encryption, you should change your password. Attacks may have been executed on the network, so your accounts may be compromised.

It seems never ending. Every other month some new vulnerability is discovered. This sucks

Thank you theymos. Password changed—again :P.

It is an acronym it stands for "Padding Oracle On Downgraded Legacy Encription"

Oh. Thank you for the clarification and explanation ::)

The vulnerability was discovered by Google, so most likely they came up with DOODLE acronym first and then worked their way back to generate a plausible-sounding full form :P

DOODLE and POODLE - D and P

Dire and Padding?

My bad! Although they both don't look much different to me :P

maybe to add also in the "News" that all useres are automaticly logged out.
I was very surprised if I see me logged out.

Ok first I do was to go (still logged out) to meta and see in this thread that all are logged out by you..

This is the reason I was logged out from bitcointalk. Took me a few minutes to figure out my own password, the one I changed in a rush after the previous SSL bug.

Dont get used to it, just change it again :P

I was pretty pleased to find I still had it saved. I thought I forgot to save it when I last changed it and talked to theymos about an account recovery. Maybe just a weird dream... ever have that? Sometimes dream about weird, mundane stuff like shampooing hair, then forget to take a shower in the morning because I thought I already had. -Or I'll think the dog died a year ago, then see it when I wake up... scares the bejesus out of me.

Anyway - not sure what's wrong with the name. Poodles are bad news. If it derived from BEAST attack, POODLE seems like a pretty reasonable name for a successor.
http://g1.img-dpreview.com/23F4236AC71C429DA1495077582E9B57.jpg

Thanks theymos! :)

Can you please make an option to log-out from all computers except the one user using? So if we checked 'remember me', the account can be logged-out from other computer. ::) Suggestions are welcome! :)

   ~~MZ~~

After see myself logged out and see the bug warning, I thought someone stole my cookies and took my account.

Nice to see I was wrong.

Will change password anyway.

Cheers for the warning, I'm due a password change anyway.

Why was the warning removed from the news section, above the breadcrumbs?

It wasn't removed. The warning about the TLS vulnerability and to change your password rotates with the notice that the new version of QT has been released, with each notice showing on every other time you load a page.

I suggest that in the future, you make the "News: Due to a recently..." sentence clickable, and link to a post or an arcticle mentioning what it is all about.
It would save time for anybody that didn't see any news about that yet and who is curious at what exactly the attack/issue entails (outside of bitcointalk).