[Discuss] openssl security issue a big deal

[Darren Duncan]

Damn shorteners, try this: 
http://arstechnica.com/security/2014/04/heartbleed-vulnerability-may-have-been-exploited-months-before-patch/

On 2014-04-10, 12:11 AM, Darren Duncan wrote:
> As an update, see http://arstechnica.com/.../heartbleed-vulnerability-may.../ it
> looks like the openssl bug may have been exploited as far back as 2013 Nov. Also
> there's a clearer explanation of how the bug and exploiting it works than I've
> seen before, and more detail on circumstances or what may be revealed when.
>
> I want to emphasize that some of the most important websites to change your
> passwords on, once vulnerabilities are fixed, is those you have email accounts
> at, e.g. gmail, yahoo, etc. Because if an attacker can get into your email, they
> can get into most of your other stuff too, due to many websites supporting
> reset-your-password-using-email.
>
> At this point I believe certain major sites, {Google, Facebook, Yahoo, Amazon}
> have all fixed the vulnerabilities.
>
> So all you gmail/yahoo/etc-fixed users, change your passwords now!
>
> Also, if any of you have domain names, maybe check if your domain registrars had
> the vulnerability, you might (only when they're not vulnerable) to change your
> passwords on them too.
>
> -- Darren Duncan