Light

Episode #1035 Quiz

Cloudflare's 1.1.1.1 Outage
Date: 2025-07-22 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! #1035 discusses a critical passkey bypass via adversary-in-the-middle attacks exploiting FIDO2 cross-device sign-in and phishing QR codes to intercept authentication, undermining passkey protections despite no fundamental flaw in FIDO standards.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the fundamental security weakness in cross-device FIDO passkey authentication as discussed in Security Now! Episode 1035?

Question 1

What is the fundamental security weakness in cross-device FIDO passkey authentication as discussed in Security Now! Episode 1035?

It relies solely on password-based authentication without multi-factor verification. It allows an adversary-in-the-middle to trick a user into scanning a QR code to bypass second-factor authentication. It uses deprecated cryptographic algorithms that can be cracked offline. It stores passkey secrets on untrusted cloud servers accessible by attackers.

Question 2: How does Cloudflare's use of anycast IP addressing for 1.1.1.1 improve DNS resolution performance and availability?

Question 2

How does Cloudflare's use of anycast IP addressing for 1.1.1.1 improve DNS resolution performance and availability?

By caching DNS responses locally on client machines to eliminate the need for remote queries. By randomly selecting a Cloudflare data center to evenly distribute load regardless of geographic distance. By routing DNS queries to the nearest Cloudflare data center from many locations globally, enhancing speed and redundancy. By using a single centralized server that handles all DNS requests with specialized high-speed links.

Question 3: What was the immediate cause of the global 1.1.1.1 DNS outage on July 14, 2025, according to Cloudflare's postmortem?

Question 3

What was the immediate cause of the global 1.1.1.1 DNS outage on July 14, 2025, according to Cloudflare's postmortem?

A hardware failure impacting all Cloudflare data centers hosting 1.1.1.1 globally. A software bug causing 1.1.1.1 servers to crash repeatedly under heavy query loads. A misconfiguration linking 1.1.1.1's routing prefixes to a non-production service topology causing withdrawal of routes. A coordinated external BGP hijack attack redirecting 1.1.1.1 traffic to malicious servers.

Question 4: Why does the episode suggest that online age verification requires biometric binding to be effective?

Question 4

Why does the episode suggest that online age verification requires biometric binding to be effective?

Because biometric devices are cheap and universally available to all Internet users today. Because biometrics are required by all websites to unlock their content as mandated by law. Because anonymous tokens or hashes can be easily shared or traded, failing to prove individual age identity. Because biometrics eliminate the need to verify age from government databases entirely.

Question 5: According to the episode, what operational practice in deploying network configuration changes contributed to Cloudflare's 1.1.1.1 outage?

Question 5

According to the episode, what operational practice in deploying network configuration changes contributed to Cloudflare's 1.1.1.1 outage?

Implementing configuration changes only after detecting user reports of errors rather than proactively. Deploying configuration updates incrementally only to limited regions to isolate errors early. Using automated rollback systems that incorrectly reverted stable configurations. Deploying configuration updates simultaneously across all data centers without progressive canary testing.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.