Does the Heartbleed Bug Mean You Should Stay Off the Internet?

[MindMover]

Update: The NSA knew about the Heartbleed bug for at least two years and actively exploited it in order to gather intelligence, Bloomberg reported on Friday. This means that under the pretense of protecting Americans, the NSA intentionally didn't notify millions of Americans that they were vulnerable to identity theft. Go read that book, now.

On Tuesday, news broke that the safeguard many websites use to protect sensitive information on the internet has had a major security flaw for about two years. These sites use a security system called OpenSSL to encrypt data like content, passwords, and Social Security numbers. But thanks to a small coding error in a popular version of OpenSSL, nicknamed "Heartbleed," hackers can potentially steal sensitive data from vulnerable websites. Richard Bejtlich, chief security strategist at FireEye, a network security company, notes that there's no evidence that malicious hackers have exploited the flaw yet. But the secrecy-minded Tor Project, which enables anonymous internet browsing, nevertheless recommended on Monday that, "If you need strong anonymity or privacy on the internet, you might want to stay away from the internet entirely for the next few days while things settle." Here are seven reasons why you might want to stop looking at cat videos right now:

1. Lots of popular websites have the security problem.

According to the New York Times, up to two-thirds of sites on the internet rely on OpenSSL. A user on Github, an open-source coding site, compiled a list of sites that were allegedly vulnerable after a test was conducted on Tuesday. The Github list included Yahoo, Flickr, OkCupid, and Eventbrite, among dozens of other companies. (Some may have since updated their security.) Facebook and Google both released statements confirming they are not affected by the flaw. If you'd like to test a specific site to see whether it's could be exploited—although this doesn't meant that it has—go here.

http://www.motherjones.com/politics/2014/04/heartbleed-bug-internet-security-ssl

[Xipe Totec]

1. No. It means you're already screwed. nt

[PSPS]

2. Hardly

These articles that claim "two thirds of the Internet relies on OpenSSL" are woefully misinformed, at least as far as major websites go. OpenSSL is a staple on resold and shared servers, but no major website is run on such a system. Maybe it's more accurate to say that 2/3 of Internet websites run on servers that have the OpenSSL option, but that's not the same thing. Most of the websites run on such systems don't use SSL anyway (DU for example.)

Then there's the technical aspect of Heartbleed. The method it uses to "steal" data consists of getting data contained in up to 16K of random memory at a time. It's not defined in any way, it's just 16K or random bytes, and it's only during an SSL session which most traffic on the Internet doesn't use.

But fear sells more papers and magazines, and garners more people to watch ads on TV, I guess.

[Egnever]

5. Thanks for the sanity

[Xipe Totec]

9. You misinterpret

I said nothing about how serious the risk was. I merely stated that it was already in the past. Whatever might have happened has already happened.

[RebelOne]

3. No. I will take my chances. I know that my bank is safe. n/t

[MindMover]

4. LOL... nt

[nadinbrzezinski]

6. I hate to point this out

but I assume they are out to get me. No, it is not paranoia. They are.

So live and be happy, because today it is this, tomorrow it will be another exploit. Welcome to the National Security State

[MindMover]

7. Frankly, I have nothing to hide and if they want to listen to my plans on ...

Tuesday, they will learn that I might be at this park or that park ....

but I am certainly not ordering some fertilizer off the internet delivered to a warehouse in San Diego ....

[nadinbrzezinski]

8. You know, it gets to the point where

you need to assume that you need to live your life. I think we reached that point of absurdity a tad ago though. And I mean this by saying, FUCK HOOVER... and of course FUCK AGENT MIKE.