• Hey Guest. Check out your NeoGAF Wrapped 2025 results here!

Heartbleed SSL bug serious vulnerability impacting major services, being patched now

Status
Not open for further replies.
Gentleman Jack said:
OP title bothers me. This isn't SSL failing over and over again. Apple's bug was an implementation issue. The HeartBleed bug is an implementation issue. This is not an attack on SSL itself. 'SSL keeps on failing' implies there's something wrong with the protocol and shouldn't be trusted, which is foolish.
Click to expand...
There are also things wrong with the protocol, but it does move forward to mitigate those issues. This is why we have several versions of the protocol.
 
epmode said:
Yikes. If anyone in this thread uses Lastpass, I'd suggest Keepass instead since a locally stored database can't be affected by something like this.
Click to expand...

If you have 2-step verification enabled with Lastpass, you should be okay.
 
XiaNaphryz said:
If you have 2-step verification enabled with Lastpass, you should be okay.
Click to expand...

Glad I set that up when I first got it. Only big worry is Yahoo, though it's only for junk mail at this point. Still sucks and it means I probably should just abandon it entirely.
 
captmcblack said:
Crap...I am literally logged into eBay right now.

So I'm screwed, right? :x
Click to expand...
This bug has been around for two years. So potentially all data stored in a server's memory in the past two years has been exposed, if they're running openssl. Realistically, just change your passwords once everybody updates their openssl versions.

There will always be the potential that passwords or keys have been leaked, hacked, stolen etc. The question is what's the probability. In this case, you're probably OK because you can't access arbitrary memory, and the most likely thing taken is keys. Just change your passwords and move on, but you're probably fine either way.
 
LastPass data is only ever encrypted and decrypted locally on your PC, never on their servers. Only an encrypted data blob is stored on the servers, and nothing that could decrypt the data is ever sent there. So as long as you have a strong master password (meaning it doesn't really matter all that much if someone did manage to steal a copy of your synced data) it should be fine, right?

EDIT: Yeah:

LastPass said:
However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection.
Click to expand...

http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

And I do trust these guys, they've never given anyone a reason not to.
 
RoadHazard said:
LastPass data is only ever encrypted and decrypted locally on your PC, never on their servers. Only an encrypted data blob is stored on the servers, and nothing that could decrypt the data is ever sent there. So as long as you have a strong master password (meaning it doesn't really matter all that much if someone did manage to steal a copy of your synced data) it should be fine, right?
Click to expand...

That's how it's supposed to work, but given the type of data you have stored with it 2-step verification is still recommended.
 
I'd suggest logging out or removing any accounts that automatically log in to these affected sites from on your phone as well. Had to manually remove my Yahoo account just in case.

That one is probably already toast anyway. Can't remember if I have 2-step setup on it or not.
 
RoadHazard said:
LastPass data is only ever encrypted and decrypted locally on your PC, never on their servers. Only an encrypted data blob is stored on the servers, and nothing that could decrypt the data is ever sent there. So as long as you have a strong master password (meaning it doesn't really matter all that much if someone did manage to steal a copy of your synced data) it should be fine, right?

EDIT: Yeah:



http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

And I do trust these guys, they've never given anyone a reason not to.
Click to expand...
That's what I assumed about keepass. Maybe I need a stronger password. Yeah, someone can get the file. But then again, it's for all the other passwords.
 
mclem said:
How does that work if you work from multiple computers? Is there an allowance for that?
Click to expand...

Not to be all "I told you so", but I never thought things like LastPass were a good idea.

What I do is use an app like Mmemosyne where I re-generate my pass for a site/service on the fly whenever I need it. Have Mnemosyne on all my computers + my phone.

It is a slightly slower process? Yup. But I'm storing my passwords NOWHERE, online or off.
 
Two-factor isn't enough. (It's at best a mitigation… but if you just logged in, and someone got your session key, welp.)

https://twitter.com/blubbfiction/status/453513110348107776

shidoshi said:
What I do is use an app like Mmemosyne where I re-generate my pass for a site/service on the fly whenever I need it. Have Mnemosyne on all my computers + my phone.

It is a slightly slower process? Yup. But I'm storing my passwords NOWHERE, online or off.
Click to expand...
I'm looking at a screenshot of Mnemosyne and I'm sorta curious—how do you keep tabs on sites that have different password requirements?
 
daveo42 said:
I'd suggest logging out or removing any accounts that automatically log in to these affected sites from on your phone as well. Had to manually remove my Yahoo account just in case.

That one is probably already toast anyway. Can't remember if I have 2-step setup on it or not.
Click to expand...

Shouldn't that just rely on the authentication token rather than the username/password combo?

I mean, granted, that token can be compromised, but it will have to get rotated post patch anyway and it's less of an issue than compromising the actual password.
 
RoadHazard said:
LastPass data is only ever encrypted and decrypted locally on your PC, never on their servers. Only an encrypted data blob is stored on the servers, and nothing that could decrypt the data is ever sent there. So as long as you have a strong master password (meaning it doesn't really matter all that much if someone did manage to steal a copy of your synced data) it should be fine, right?

EDIT: Yeah:



http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html

And I do trust these guys, they've never given anyone a reason not to.
Click to expand...

Ohhh, yeah. That's why if you forget your password there is no way to reset it. That makes me feel even better, though I wasn't too worried in the first place.
 
The Albatross said:
Frankly, I trust LastPass to keep my data secure over whatever cloud service I'm opting to use. Although, this SSL certificate issue is worrying, it would effect Dropbox, AmazonS3, Bitbucket, Github, and anything else.
Click to expand...

Yeah, if you're gonna store your passwords in the cloud anyway, might as well just use LastPass directly and skip the middleman cloud service. LastPass pretty much exists to do just this one job securely for you, and by all accounts they're doing it very well.
 
shidoshi said:
Not to be all "I told you so", but I never thought things like LastPass were a good idea.

What I do is use an app like Mmemosyne where I re-generate my pass for a site/service on the fly whenever I need it. Have Mnemosyne on all my computers + my phone.

It is a slightly slower process? Yup. But I'm storing my passwords NOWHERE, online or off.
Click to expand...

So I just looked at this, do you use a different phrase for each site? From what I see, the same phrase with the same criteria (letters, numbers, length, etc.) will always generate the same password. It looks interesting, but it would be very circumstantial on which websites I would use it for. Without creating different phrases and criteria, it looks like the same password would be used for every site.

Lastpass just seems more user friendly and secure, every site has a different, unique password, and my account is secured by two-step authentication. I am always looking to keep my options open if something better comes along. Choosing a password manager for me is a fine line between security and user-friendliness. I don't want to jump through lots of hoops to be able to log in to my credit card account to pay my bill, but I also don't want to use the same password on 20 different sites.
 
XiaNaphryz said:
Well if what he's claiming is true, not even shidoshi's suggestion above would necessarily be safe then if you're between logins.
Click to expand...
I believe the claim is true. Very plausible.

The only safe option at this point is to have never logged in to a given service since the bug went public.

Other than that, you just have to hope your service provider gets their act together, changes out their certs post-haste, and has a safe path for changing your password afterward (re-requiring 2FA, verifying with email, something.)
 
zigg said:
I believe the claim is true. Very plausible.

The only safe option at this point is to have never logged in to a given service since the bug went public.

Other than that, you just have to hope your service provider gets their act together, changes out their certs post-haste, and has a safe path for changing your password afterward (re-requiring 2FA, verifying with email, something.)
Click to expand...

This period of not being able to do nothing to secure my accounts is what worries me. Logging in to change passwords now can be the worst mistake to do at the moment but at the same time someone could have stolen them yesterday when I last logged in to a vulnerable site.

At least when someone hacks a site, we are able to act immediately by changing passwords on that site (if it was unique) or change the universal password. In this situation, we just have to wait... which doesn't make me feel safe at all.
 
One thing I don't understand is: if I change a password now (for a site that's vulnerable), it's sent via SSL? So it could be read from the server's memory?
The other thing is: Isn't the text encrypted?
 
So what does this mean? All logins are just boned? If you change now they just steal the data right? Do apps like yahoo mail or gmail use SSL also?
 
Snakethesniper said:
One thing I don't understand is: if I change a password now (for a site that's vulnerable), it's sent via SSL? So it could be read from the server's memory?
The other thing is: Isn't the text encrypted?
Click to expand...

Encrypted with the server's public key which is decrypted using its secret key.. and if the secret key is exposed~~
 
Guys, shouldn't we create a list or update the OP with services that we know are vulnerable for people who don't know about it yet?
 
epmode said:
Yikes. If anyone in this thread uses Lastpass, I'd suggest Keepass instead since a locally stored database can't be affected by something like this.
Click to expand...
Almost everyone who uses Keypass is going to be using a file sharing service to keep their passwords synchronised between their devices. That file sharing service is going to be just as vulnerable as LastPass was.

Also, even with this bug, the passwords are still encrypted. Even presuming people have exploited it to steal data, they can't get the actual passwords.

May16 said:
Oh fuck. I logged in a few hours ago but I have my pw saved on my comp/browser. My wife also paid for something with PayPal like an hour ago. Am I fucked?
Click to expand...
No. To actually exploit this beyond a handful of targeted users would require a lot of work.
 
Slavik81 said:
Almost everyone who uses Keypass is going to be using a file sharing service to keep their passwords synchronised between their devices. That file sharing service is going to be just as vulnerable as LastPass was.
Click to expand...

My Keepass database requires a key file that isn't stored on Dropbox. Even if you get into my Dropbox account AND had my database password, you're still not getting in. Keepass is as secure as you want to make it.

They're not paying me, I swear. I just think it's a great program that has saved me from a lot of security headaches.
 
epmode said:
My Keepass database requires a key file that isn't stored on Dropbox. Even if you get into my Dropbox account AND had my database password, you're still not getting in. Keepass is as secure as you want to make it.
Click to expand...
LastPass also requires a key that isn't stored on LastPass servers.

I use Keepass myself, but I feel I should be cautious in recommending Keepass because the vast majority of users will not make their database more secure than LastPass. Or they won't properly back up their database, and they'll lose all their passwords when their hard drive dies.
 
epmode said:
My Keepass database requires a key file that isn't stored on Dropbox. Even if you get into my Dropbox account AND had my database password, you're still not getting in. Keepass is as secure as you want to make it.

They're not paying me, I swear. I just think it's a great program that has saved me from a lot of security headaches.
Click to expand...

And LastPass requires a master password (which you should obviously make sure is strong) that never leaves your computer, since all encryption and decryption happens locally. The LastPass servers only store your encrypted data blob. So their servers could also be completely compromised (which is highly unlikely as they employ very high security), and your data would still be safe as long as your master password is good. Plus, you can choose to add extra security to that via various methods of multi-factor authentication.

EDIT: As Slavik81 says, LastPass is probably more secure and safe (these things both matter greatly) for the average person.
 
Snakethesniper said:
yes I've read that later, but how was the private key exposed? Is it stored in the memory?
Click to expand...

During the authentication handshake the server has to keep the secret key in memory for a bit. The vulnerability arbitrarily allows the client to disclose 64KB of the server's ram (around the openssl process memory) continuously if desired. So they could pull out the secret key with enough polling.
 
Status
Not open for further replies.

Similar threads

RTINGS.com is now a Paywalled Service
2
62
1K
Celcius replied
AI browser vulnerability (Perplexity Comet)
News 
4
570
Draugoth replied
Hayley Atwell now
2
53
1K
-BLITZ- replied
Being a Drifter
2
59
1K
Agave replied
Major Job Cuts At Microsoft Coming, Between 11,000 and 22,000 Roles.
18
417
Bojji replied
Top Bottom