I have like 34 and that is way too much for me to handle.
-
Hey Guest. Check out your NeoGAF Wrapped 2025 results here!
Heartbleed SSL bug serious vulnerability impacting major services, being patched now
- Thread starter itxaka
- Start date
- Status
I have like 34 and that is way too much for me to handle.
anonymous_abc
Member
This sort of thing always bugs the hell out of me, oh you want me to use secure passwords, and oh your limiting me to using 16 letters, thanks for that. Twats...
teacupcopter
Banned
Hey my email address with Neogaf was my university email address back when I studied. I have no access to that and now only have a gmail account. What can I do?
not being able to use symbols is worse. It's like telling hackers the passwords are rubbish and can be cracked in 3 seconds.
PM a mod. http://www.neogaf.com/forum/showgroups.php
anonymous_abc
Member
yes. It's a bug on the server side so everyone is affected if they use a site that uses OpenSSL (which you most certainly do)
Daffy Duck
Member
Using Lastpass security check it highlights the sites below as having had problems that I have accounts for..
o2.co.uk
rockstargames.com
yahoo.com
o2.co.uk
rockstargames.com
yahoo.com
BlackBuzzard
Banned
So is steam/PSN webstore or any other gaming service/site affected by this?
Baron von Loathsome
Member
Steam Community uses OpenSSL.
BlackBuzzard
Banned
Am i safe if i have only logged in from the steam service itself, or is it best just to reset my PW?
anonymous_abc
Member
That can never harm.
anonymous_abc
Member
They use shitty character encoding.
No not really, especially for my bank I want a tripple secure password, makes me angry... My bank only alows @ as a special character. wtf...
Stumpokapow
listen to the mad man
A twelve character random password with alphanumeric has (62^12) possibilities with 71 bits of entropy. With symbols is around (93^12) possibilities, or about 129 times as secure with 78 bits of entropy. So symbols add a significant amount of entropy, but...
A fifty character random password with symbols is 82300000000000000000000000000000000000000000000000000000000000000000000000000 times as secure as a twelve character password that's just alphanumeric. 329 bits of entropy. Length is what you want to add entropy rather than just extended symbol sets.
The real problem is that most people don't use remotely random passwords to begin with, so the effective entropy of their 8-10 character password is near-0 to begin with. Like, if all your passwords are single English words of 8-12 letters with single letter-to-number substitutions, then your entropy is less than 20 bits, or around 3100000000000000 times less secure than a 12 letter alphanumeric random password.
Several times in the past few days. I have 2-step though. I use an authenticator for my Microsoft account.
anonymous_abc
Member
If you aren't using 2 step now you are doing it wrong!
indigo-cyclops
Member
Is Amazon vulnerable still? I just started reading about this this morning and stupidly went in and changed my password before realizing that it's probably not a good idea to yet. Now I feel like I'm fucked. Any reassurance available?
anonymous_abc
Member
just go and change your password and activate 2 step, whats the problem? Even if they are still vunerable at least you have the second step protecting you.
anonymous_abc
Member
It's a server side issue, so I doubt the client makes much of a difference.
anonymous_abc
Member
you have to have entered the password recently.
Mind you the vunerabiltiy has been around a while, so it seems fair to assume noone is safe....
Phoenix
Member
I would advise you to complain. I've found that banks have absurdly worse password security rules than pretty much anything. No special characters, shorter phrases, etc. I remember chatting with someone from American Express to get them to explain why only 4 special characters were allowed and why that made no fucking sense whatsoever.
Phoenix
Member
You should be using 2-step at any place that offers 2 step.
So should I be changing my passwords now or still waiting? I know I can check http://filippo.io/Heartbleed/ to see if sites are still vulnerable, but I have read here that if it comes up red once in a million then it's still vulnerable, so how would I really know?
Phoenix
Member
Wait for the site you're using to issue a statement or reach out to them directly.
TangoAlphaLima
Member
I feel like we're gonna end up with congressional hearings on this shit.
I understand that now, but I guess I'm still iffy on logging in to make that change. If Google is vulnerable (which allegedly they are not), aren't I taking a risk by signing in to change my PW/activate 2 step?
Last pass tells you which accounts are linked to the issue and tells you when you should change your password. Such awesome software and people.
http://lifehacker.com/lastpass-now-tells-you-which-heartbleed-affected-passwo-1561522244
http://lifehacker.com/lastpass-now-tells-you-which-heartbleed-affected-passwo-1561522244
I like Mashable's list. Thy actually show who's been affected or fixed and asked for comments from the sites as well.
http://mashable.com/2014/04/09/heartbleed-bug-websites-affected/?utm_cid=mash-com-Tw-main-link
indigo-cyclops
Member
If you believe what Lastpass statement says, no.
Mashable list is garbage imo. Netflix is unclear while Lastpass is a yes? Sure...
D
Deleted member 12837
Unconfirmed Member
When was it ever vulnerable? It hasn't been on any list that I've come across so far.
anonymous_abc
Member
while your password might be compromised you will have the added 2 step to protect you from any nefarious activities, there is no real downside here.
indigo-cyclops
Member
Yea that's what has me confused.
Right, like I said I just found out about this today so I wasn't following it. You're right, it seems like they were never vulnerable. Didn't mean to spread panic.
Eh, it's pretty much the only way they can explain it and get most people to understand they should freak out about it.
Phoenix
Member
PM me and I can walk you through it.
BlackBuzzard
Banned
Well thanks for the info have reset a few passwords gonna do the rest even one's not affected in a few days.
anonymous_abc
Member
Changed the major passwords, email, social, shopping, banking. Don't care about less curtail ones for now as they are all unique anyway.
So how many passwords does everyone use?
I've got like 2 and a half that I use depending on how important that site is, although I'm thinking that I'll probably start using a third super secure one just for my banking, since the one I created with my bank account has since been spread a bit too far onto sites that are important but maybe not so important that I should be spreading my banking info so far around to all of them (mainly my uni account and various government accounts).
Also, yesterday the CBC segment on Heartbleed advised people to hold off on changing their passwords until this exploit had been fixed. How long should people wait until they start going through all their passwords?
I've got like 2 and a half that I use depending on how important that site is, although I'm thinking that I'll probably start using a third super secure one just for my banking, since the one I created with my bank account has since been spread a bit too far onto sites that are important but maybe not so important that I should be spreading my banking info so far around to all of them (mainly my uni account and various government accounts).
Also, yesterday the CBC segment on Heartbleed advised people to hold off on changing their passwords until this exploit had been fixed. How long should people wait until they start going through all their passwords?
anonymous_abc
Member
I've been using a password manager Strip for a while now. Ever since all my passwords have been unique, long and secure. Even if the PSN is hacked again I just have to change the password there because I am not using it anywhere else.
I would assume most big/important sites will have been updated by now so you should be able change your passwords.
It'll undoubtedly be months till all sites that use OpenSSL are fixed...
I use a different password for everything.
- Status