[Discuss] openssl security issue a big deal

[Darren Duncan]

As an update, see http://arstechnica.com/.../heartbleed-vulnerability-may.../ it 
looks like the openssl bug may have been exploited as far back as 2013 Nov. Also 
there's a clearer explanation of how the bug and exploiting it works than I've 
seen before, and more detail on circumstances or what may be revealed when.

I want to emphasize that some of the most important websites to change your 
passwords on, once vulnerabilities are fixed, is those you have email accounts 
at, e.g. gmail, yahoo, etc. Because if an attacker can get into your email, they 
can get into most of your other stuff too, due to many websites supporting 
reset-your-password-using-email.

At this point I believe certain major sites, {Google, Facebook, Yahoo, Amazon} 
have all fixed the vulnerabilities.

So all you gmail/yahoo/etc-fixed users, change your passwords now!

Also, if any of you have domain names, maybe check if your domain registrars had 
the vulnerability, you might (only when they're not vulnerable) to change your 
passwords on them too.

-- Darren Duncan