In response to Google and Cloudflare's recent disclosures of the Cloudbleed vulnerability, some sources like TNW are recommending that people change passwords for sites and services that use CloudFlare. This seems to me a reasonable precaution.
Others are recommending that people change all passwords, even for services that don't use Cloudflare. Based on what we know so far—admittedly early in the investigation—this seems an overreaction.
As far as I can tell the rationale goes like this:
- You probably reuse your passwords, you big n00b. A compromise of your Cloudbleed-affected password will compromise your other accounts.
- You should change your passwords sometimes anyway. Stop whining. It's good for you.
- Searching through a list off affected sites is really hard. It's so much easier to just change all of your passwords.
I won't change all my passwords lightly. There are over 400 sites in my password manager, and I don't reuse passwords. Looking up a few hundreds sites in a list, whether on Github or Does It Use Cloudflare, doesn't sound hard compared to the tedious time-suck of changing them all.
So far it sounds like Cloudbleed occasionally caused the information from one Cloudflare-supported page to leak into the output of another Cloudflare-supported page.
So am I missing something? Are there good, science-based reasons to change all passwords for all sites and services, given what we know so far (February 25, 2017)? Or is this a panic response?