Heartbleed internet bug

[steve58]

Yet another internet vulnerability exposed that may or may not affect us.  Bottom line?  Time to change some passwords.  >:(

Q: What is Heartbleed and why is it a big deal?

A: Heartbleed affects the encryption technology designed to protect online accounts for email, instant messaging and e-commerce. It was discovered by a team of researchers from the Finnish security firm Codenomicon, along with a Google Inc. researcher who was working separately.

It's unclear whether any information has been stolen as a result of Heartbleed, but security experts are particularly worried about the bug because it went undetected for more than two years.

Q: How does it work?

A: Heartbleed creates an opening in SSL/TLS, an encryption technology marked by the small, closed padlock and "https:" on Web browsers to show that traffic is secure. The flaw makes it possible to snoop on Internet traffic even if the padlock is closed. Interlopers can also grab the keys for deciphering encrypted data without the website owners knowing the theft occurred.

The problem affects only the variant of SSL/TLS known as OpenSSL, but that happens to be one of the most common on the Internet.

More Qs and As at the link below.

http://www.foxnews.com/tech/2014/04/10/what-need-to-know-about-heartbleed-bug/?intcmp=obnetwork

This Heartbleed Hit List: The Passwords You Need to Change Right Now

http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/

[Capn Darwin]

Realistically, wait a bit. It's going to take time for providers and sites to update and test. If you change now that still won't fix the issue and there is already a good bet your critical info is on someone else drives. I would take the time to check bank statements and credit cards for any odd charges. Weird places or times of day.

Really an ugly issue.

[Staggerwing]

Yep. If you change your PWs now they might simply be hoovered up in any still ongoing exploits. Wait until after the fixes and be diligent in the meantime. And after.

[bayonetbrant]

any of you techies out there can confirm/deny this is how it's working?

[Capn Darwin]

Brant, from whatI have read that is pretty much it and there is no trace/record of the data siphoned off.