Heartbleed Bug

Three questions about the 'Heartbleed' bug

A group of security researchers uncovered a major vulnerability in the encryption technology used by millions of websites.

Heartbleed is a security flaw discovered by security firm Codenomicon and members of Google Security. It's found in OpenSSL, which is used to protect sensitive data such as emails, passwords or credit card data.

Click to expand...

Massive OpenSSL Bug 'Heartbleed' Threatens Sensitive Data

Not sure if a site is safe from 'Heartbleed'? Use this tool to check

I've only just heard about this.  One lot says to change your passwords, another says don't bother, it's pointless.

I'll check out the links you've provided..

So I am wondering what people are doing in regards to this problem. Are you signing into online banking, ordering online with credit cards, or are you playing it safe and staying off those websites.

My credit union assured us they were not affected by the Heartbleed thing and not to worry, BUT if you use the same password for banking as you use on another site, you should change it.  My banking passwords are different than those on other sites, so I'm still using my bank online to check balances etc.  Several other sites have suggested changing my password.  I dont want to.  I have enough trouble with remembering them already.

Here's a handy article with a list of which sites have been affected or not affected.

Definitely check with your bank about what SSL they use. 

btw... this bug is no joke. 

I have a friend in Argentina who is a very competent (and responsible) coder... He has stated that he was able to access all his neighbors' network passwords and, even more alarming, passwords off of government sites. 

I wasn't sure what to do, so I started changing passwords on the sites I go to. The problem is if your favorite sites haven't told you that they've been patched, how do you know? Not a lot of sites have even mentioned Heartbleed, let alone if they've been patched. 

We deal primarily with two banks, Both banks say they've not been affected by Heartbleed.

I have a Yahoo email that I have signed into, not my main one. I haven't signed into Pay Pal, E Bay or my banking site. I haven't put my credit card out there since this happened. Is anyone else using E Bay or Pay Pal. The think is I read somewhere that this happened about two years ago and they have only now found it.

I only do online transactions as necessary, always have done and I have been in IT for over 25 years. That said, my particular bank guarantees replacement of funds that are used/taken through fraudulent means. Its a good idea to check with your bank to see if they have a similar policy.

If you can check balances and make payments over the phone, its best to do so, particularly while this issue is being sorted out. Its also a good idea to use a different username and password for each account that you have across websites, and check your bank balance every so often.

The hackers that are responsible for this exploit, are typically going to be interested in personal/financial information (credit card numbers, SIN numbers, DOB) rather than general data and so there should be no issues with accessing email accounts, online blogging sites, etc.You should only provide this information when absolutely necessary. My husband had to provide his credit card number recently in order to signup for paid monthly parking (probably as a security measure). When he told me this, I was surprised and said you should never provide this information unless absolutely necessary. The same for your SIN (can't remember what it is in the states). 

This is what I have done. I called my bank. The bank manager assured me that they did not use the open SSL which is what makes websites vulnerable. Their online banking etc is not affected. I called my credit card company. They said their website is not affected. I then verified with them that they had all phone numbers since they told me they monitor for any odd activity and would notify us by phone. I called E-Bay and PayPal and they said their websites are not affected. So that is a start. I guess folks need to verify with the places where they shop, put their credit cards info, do banking, etc. and ask if they use the open SSL and verify if they are affected. I do fee somewhat relieved now.