Wednesday, April 9, 2014

Internet users told to change ALL passwords in wake of ‘catastrophic’ Heartbleed security bug

Add caption

After the discovery this week of a massive security flaw in the open source software used to secure and encrypt a vast portion of internet communications, major tech firms are urging users across the Web to change the passwords on all of their accounts. - Daily Caller

Dubbed the “Heartbleed” bug by the researchers responsible for uncovering it, the widespread security hole allows hackers to steal code from websites and online services which reveal the most sensitive of user information — including usernames, passwords, communications, credit card and account information.

Websites, web applications, email, instant messenger services and even virtual private networks are among many other Internet programs that use the customizable OpenSSL (secure sockets layer) security library on websites with HTTPS (embedded in the addresses of most websites users browse to) encryption to protect users information on their services.

“The little lock icon (HTTPS) we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible to anyone who knew about the exploit,” the popular blogging platform Tumblr wrote in a post....

“This might be a good day to call in sick and take some time to change your passwords everywhere – especially your high-security services like email, file storage, and banking, which may have been compromised by this bug,” Tumblr said.

The Heartbleed Hit List: The Passwords You Need to Change Right Now - Mashable h/t: Bridget
Why Heartbleed Is the Ultimate Web Nightmare - Mashable (IMAGE: MASHABLE COMPOSITE, ISTOCK, SAUL HERRERA)
It's easy to want to think the reaction to the Heartbleed OpenSSL vulnerability is overblown; Sadly, it's not. Heartbleed is bad. It's not hyperbole; it's a major problem.

In fact, Heartbleed has the potential to be one of the biggest, most widespread vulnerabilities in the history of the modern web.

Writing about Heartbleed, security expert Bruce Schneier says "'catastrophic' is the right word. On the scale of 1 to 10, this is an 11." That's about right.

So why is Heartbleed so bad? Why is this such a big deal?