Healthcare.Gov Users Told To Change Passwords After Government's Heartbleed Probe

[Purveyor]

Source: Associated Press

By JULIE PACE | Associated Press | Apr 18, 2014 11:11 PM CDT in Politics, Money, Technology

WASHINGTON (AP) — People who have accounts on the enrollment website for President Barack Obama's signature health care law are being told to change their passwords following an administration-wide review of the government's vulnerability to the confounding Heartbleed computer virus.

Senior administration officials said there is no indication that the HealthCare.gov site has been compromised and the action is being taken out of an abundance of caution. The government's Heartbleed review is ongoing, the officials said, and users of other websites may also be told to change their passwords in the coming days, including those with accounts on the popular WhiteHouse.gov petitions page.

The Heartbleed computer bug has caused major security concerns across the Internet and affected a widely used encryption technology that was designed to protect online accounts. Major Internet services have been working to insulate themselves against the bug and are also recommending that users change their website passwords.

Officials said the administration was prioritizing its analysis of websites with heavy traffic and the most sensitive user information. A message that will be posted on the health care website starting Saturday reads: "While there's no indication that any personal information has ever been at risk, we have taken steps to address Heartbleed issues and reset consumers' passwords out of an abundance of caution."

Read more: http://www.newser.com/article/de75efe030e44a3f9ac36b12f7b4e647/healthcaregov-users-told-to-change-passwords-after-governments-heartbleed-probe.html

[tofuandbeer]

1. This article is giving the Koch brothers an idea, I'm sure.

[bvf]

3. Or

maybe it was their idea.

Before I get jumped here, let me add that I have absolutely no concrete reason for saying that, other than what everyone knows of their reputations.

[tofuandbeer]

9. Honestly, that's where my comment came from: I was going to say what you said. :)

[progressoid]

2. Great.

[cynzke]

4. The crew...

at Faux news are going to have orgasms over this.

[groundloop]

5. It's not JUST healthcare.gov, EVERY business or financial website is saying this

The AP is making it sound like healthcare.gov has some kind of unique problem. Every single business or financial website on the internet is in the same boat.

[William Seger]

10. Not everyone

"Only" the 60% or so that are using OpenSSL. (Fortunately, my bank, my 401k, and PayPal were all in the other 40%.)

It shouldn't have taken much of a "probe" to determine if healthcare.gov uses OpenSSL, so I don't know why they waited this long to make this announcement.

[PoliticAverse]

12. That's not true at all. It only affects sites that use certain versions of the OpenSSL library. n/t

[PSPS]

13. No they aren't

Very few, if any, major websites use OpenSSL. It may be true that "2/3 of the internet" is hosted on resold or shared servers (i.e., GoDaddy and their ilk,) and OpenSSL is a standard part of those. But major websites like banks and large retailers aren't hosted on such machines, and most websites that are, like DU, don't use SSL anyway.

Besides, Heartbleed's "OMG!!11!!" operation is this: The content of a mere 16K of random memory might get tacked onto the end of the keep-alive response. It isn't like a table or spreadsheet. It's just 16K of unlabeled bytes. WOW!!11!1!!

The media has just gone crazy and ridiculous with this, but fear sells their advertiser's (and "expert consultant's&quot products.

[Skidmore]

6. I always find it amazing that there is never any

anger directed toward the faceless hackers who commit these acts. When viruses are introduced, all become vulnerable.

[steve2470]

7. crap had to change another password ! nt

[jwirr]

8. I got a letter for Norton Anti-virus telling me to change all my sensitive passwords. I do have a

Direct Express bank account and that is all. If they hack into that they are hacking into the bank account of Social Security. Is this thing bad enough that I should be worried?

[PSPS]

11. I'll bet they also have just a "solution" for you too.

All of these silly "sky is falling" stories in the media always happen to have an "expert" they interview who, not only fulfills the requisite fear factor necessary for any media frenzy, also just happens to sell the "ideal product" to "protect" you lest you further soil the floor under your bed with more urine.

[jwirr]

15. Thank you. What you said in the post following ours about hacking into Obamacare is probably true

of that Social Security site also.

[PSPS]

14. I doubt Healthcare.gov was using OpenSSL

Nobody in their right mind would ever use OpenSSL on such a site.

[truthisfreedom]

16. Y2.014K!