Heartbleed bug

[Jessica Lares]

More passwords to change.

I agree with DiapDealer, and it's the very reason why over the last few years I've started taking my digital life offline. And sadly, my Flickr account is going to be closed tonight. This is the second time in the last two years that Yahoo hasn't been doing me any good.

[Namekuseijin]

all your passwords are belong to me

[tubemonkey]

Originally Posted by Namekuseijin

all your passwords are belong to me

[DiapDealer]

Can someone add a "1" to the end of my Netflix password for me?
Thanks.

[eschwartz]

Originally Posted by DiapDealer

Can someone add a "1" to the end of my Netflix password for me?
Thanks.

That doesn't seem very secure to me. How 'bout if we do "123" instead?

[DiapDealer]

Originally Posted by eschwartz

That doesn't seem very secure to me. How 'bout if we do "123" instead?

I'll never be able to remember that.

[eschwartz]

Originally Posted by DiapDealer

I'll never be able to remember that.

not sure how to beat that!

[robko]

Originally Posted by eschwartz

That doesn't seem very secure to me. How 'bout if we do "123" instead?

But then it just repeats .....

[eschwartz]

Originally Posted by robko

But then it just repeats .....

You must be looking at the wrong DiapDealer.

Hint: the current password is "password".

You should've been clued in by the statement that 123 makes it too complicated.

password1 is easier than passsword123

but 1231 is actually harder than 123123

[MickiTee]

This from CNET this morning where they are checking top 100 web sites & will keep the list updated. http://www.cnet.com/uk/news/which-si...eartbleed-bug/

[5thWiggle]

XKCD explains how the Heartbleed Bug works.

[elemenoP]

Originally Posted by daffy4u

I use LastPass and have been changing passwords as advised (sometimes you have to wait for sites to update their certificates).

Points to LastPass! I use Dashlane and all they have done is sent me a generic email that I should change passwords on "critical" accounts. I'm frustrated that they weren't more specific.

eP

Originally Posted by DiapDealer

'zactly.

Everybody's gotta do what helps them sleep better at night. I get that. But here's the three scenarios I currently see regarding Heartbleed:

1. They already got my personal info and I'm already screwed--even if I change my password now.
   
2. I changed my password in time, but the site hasn't been patched against Heartbleed and my personal info is still vulnerable.
   
3. The site has already closed the Heartbleed hole, and I'm changing my password because it's just good practice.

Other than making sure my passwords aren't silly-simple, I've come to the realization that I really don't have a single bit of control over my own online "security."

Even if I had absolutely no online accounts, the companies, and financial institutions I did business with would still store my personal info in hackable databases. *shrug*

Yep, not a question of if your online business will be vulnerable, it is a question of when. Sloppy commerce websites seem to be more prevalent than well secure ones.

Originally Posted by daffy4u

Mashable has a chart that's a little easier to read.

http://mashable.com/2014/04/09/heart...ites-affected/

I use LastPass and have been changing passwords as advised (sometimes you have to wait for sites to update their certificates).

The banks seem to be very secure. The commerce sites need to hire the same security firms that the banks use!

[j.p.s]

Originally Posted by jswinden

The banks seem to be very secure. The commerce sites need to hire the same security firms that the banks use!

Just because they are not running the vulnerable versions of openssl or openssl at all does not make them secure, much less very secure. They just are not vulnerable to this particular threat.

Banks are notorious for requiring "insecurity questions" that allow crackers pretending to be a customer that has forgotten the account password to get in by knowing or guessing answers to the "insecurity questions".

[daffy4u]

Originally Posted by j.p.s

Banks are notorious for requiring "insecurity questions" that allow crackers pretending to be a customer that has forgotten the account password to get in by knowing or guessing answers to the "insecurity questions".

I use gibberish for answers to my security questions. Example: Q = What town were you born in? A = @8ndhr38& (not my real answer ). I do store the answers in LastPass and the answers to the same questions on other sites is different gibberish.