Heartbleed bug

[speakingtohe]

Revenue Canada has shut down their internet services de to the heartbleed bug.

http://www.cra-arc.gc.ca/menu-eng.html#msg

http://lifehacker.com/what-the-heart...you-1560801201

http://heartbleed.com/

More than a smidge scary

Helen

[jersysman]

I'll say. It's always something!

[Mike L]

A couple of sites that I visit regularly seem to be off the air at present. I don't know it it's directly because of Heartbleed, but it is quite possible.

Mike

I found that a lot of web sites that I normally visit daily were unreachable starting late afternoon; Pandora, Charles Schwab, . . . All were back online this morning though.

[49Kat]

A member of the Malwarebytes message board posted a link regarding sites that had been tested for vulnerability. The results are here:

https://github.com/musalbas/heartble...er/top1000.txt

Interesting list. So far, I don't see anything that concerns me re sites I log in to. The list is not comprehensive, however, and not all the sites I deal with re finances are on that list either.

Just for funzies, I searched for adobe, and the list shows it is not vulnerable to the bug.

Yahoo...well, it is, from the look of things.

[MickiTee]

This from CNET this morning about protecting yourself http://www.cnet.com/news/how-to-prot...tag=CAD1acfa04

[Prestidigitweeze]

Here's a site for checking present and past site vulnerability:

https://lastpass.com/heartbleed/

Originally Posted by 49Kat

A member of the Malwarebytes message board posted a link regarding sites that had been tested for vulnerability. The results are here:

https://github.com/musalbas/heartble...er/top1000.txt

Interesting list. So far, I don't see anything that concerns me re sites I log in to. The list is not comprehensive, however, and not all the sites I deal with re finances are on that list either.

Just for funzies, I searched for adobe, and the list shows it is not vulnerable to the bug.

Yahoo...well, it is, from the look of things.

The list you linked to might show some fixed sites. For example, Google, Amazon, and Facebook were all reported to be vulnerable yet this list shows them not to be. If they were vulnerable before a fix was made, people who used them are still at risk. So take that list with a grain of salt.

[eschwartz]

Originally Posted by jswinden

The list you linked to might show some fixed sites. For example, Google, Amazon, and Facebook were all reported to be vulnerable yet this list shows them not to be. If they were vulnerable before a fix was made, people who used them are still at risk. So take that list with a grain of salt.

I haven't checked yet, but apparently the LastPass site gives you site history re:heartbleed vulnerability?

Originally Posted by eschwartz

I haven't checked yet, but apparently the LastPass site gives you site history re:heartbleed vulnerability?

It does, and that is how I knew Amazon, Facebook, and Google had all been vulnerable in the past. I wouldn't get a false sense of relief about sites that are now safe if they were once vulnerable, assuming I used any of those sites and exchanged data with them. I have definitely used and have accounts with Amazon, Facebook, Google, and others and once I'm certain they have fixed the issues then I will change passwords. No need to change passwords until they are definitely fixed as that might keep you at risk.

[DiapDealer]

Originally Posted by jswinden

No need to change passwords until they are definitely fixed as that might keep you at risk.

'zactly.

Everybody's gotta do what helps them sleep better at night. I get that. But here's the three scenarios I currently see regarding Heartbleed:

1. They already got my personal info and I'm already screwed--even if I change my password now.
   
2. I changed my password in time, but the site hasn't been patched against Heartbleed and my personal info is still vulnerable.
   
3. The site has already closed the Heartbleed hole, and I'm changing my password because it's just good practice.

Other than making sure my passwords aren't silly-simple, I've come to the realization that I really don't have a single bit of control over my own online "security."

Even if I had absolutely no online accounts, the companies, and financial institutions I did business with would still store my personal info in hackable databases. *shrug*

[Purple Lady]

Originally Posted by jswinden

It does, and that is how I knew Amazon, Facebook, and Google had all been vulnerable in the past. I wouldn't get a false sense of relief about sites that are now safe if they were once vulnerable, assuming I used any of those sites and exchanged data with them. I have definitely used and have accounts with Amazon, Facebook, Google, and others and once I'm certain they have fixed the issues then I will change passwords. No need to change passwords until they are definitely fixed as that might keep you at risk.

I thought for Amazon it wasn't their main website, but their other stuff like Amazon Web Services. So as a regular client that just buys a lot of stuff you're ok.

[daffy4u]

Mashable has a chart that's a little easier to read.

http://mashable.com/2014/04/09/heart...ites-affected/

I use LastPass and have been changing passwords as advised (sometimes you have to wait for sites to update their certificates).

Originally Posted by DiapDealer

'zactly.

Everybody's gotta do what helps them sleep better at night. I get that. But here's the three scenarios I currently see regarding Heartbleed:

1. They already got my personal info and I'm already screwed--even if I change my password now.
   
2. I changed my password in time, but the site hasn't been patched against Heartbleed and my personal info is still vulnerable.
   
3. The site has already closed the Heartbleed hole, and I'm changing my password because it's just good practice.

Other than making sure my passwords aren't silly-simple, I've come to the realization that I really don't have a single bit of control over my own online "security."

Even if I had absolutely no online accounts, the companies, and financial institutions I did business with would still store my personal info in hackable databases. *shrug*

Yes that's about it. The only thing that I have done so far is to avoid logging onto yahoo until I'm sure that it's in the clear.

Originally Posted by daffy4u

Mashable has a chart that's a little easier to read.

http://mashable.com/2014/04/09/heart...ites-affected/

I use LastPass and have been changing passwords as advised (sometimes you have to wait for sites to update their certificates).

I find it funny that Target is on that list with a no [not impacted].

[QuantumIguana]

Passwords are Stone Age technology. The sooner we get away from them, the better.