Re: [tor-talk] [cryptography] The Heartbleed Bug is a serious vulnerability in OpenSSL

[Andrew F <andrewfriedman101@xxxxxxxxx>]

Would be interesting if someone created an app to test for the problem and
then published which big websites are slow to upgrade.
that would certainly be good for consumers.


On Wed, Apr 9, 2014 at 9:57 AM, Joe Btfsplk <joebtfsplk@xxxxxxx> wrote:

> On 4/8/2014 5:24 PM, Joe Btfsplk wrote:
>
>> On 4/8/2014 4:25 PM, grarpamp wrote:
>>
>>>
>>> https://blog.torproject.org/ covers what to do for Tor things.
>>>
>>> For everything else on the net, fix the clients and servers you're
>>> responsible for. Then...
>>>
>>> You're right, there's a big gotcha in all this, users won't really know
>>> if
>>> the services they interact with have been fixed [1] because huge swaths
>>> of services simply don't publish what they do on their pages, they bury
>>> it to keep quiet and shiny happy sites. Only some banks, insurers,
>>> utilities,
>>> schools, etc will post "we're fixed" anywhere remotely prominent. So
>>> you have to trust they did [2], which is a reasonable assumption given
>>> regulation and liability of big institutional services. You should
>>> already have
>>> a regular password changing/logout/session management regimen, so
>>> inserting some extra instances of that along guesstimates of [2] should
>>> suffice with these classes of service.
>>> [2] Sometime during the falloff curve starting yesterday afternoon.
>>>
>>> The real user risk is likely on mid to small services, embedded things,
>>> shared
>>> platforms, legacy systems, services that didn't get the news, don't have
>>> the resources or knowledge to fix, etc. Again, consider some form of
>>> reasonable regimen.
>>>
>>> And there are all sorts of tools and site testing services coming out
>>> now for which a brave user might be completely warranted in using to
>>> determine [1 above] so they know when to utilize [regimen 2].
>>> (Far better to use a testing service or email their help desks seeking
>>> a positive statement than risk being potentially considered an exploiter
>>> of things you don't own.)
>>>
>>> Partial list...
>>>
>>> http://s3.jspenguin.org/ssltest.py
>>> https://gist.github.com/takeshixx/10107280
>>> https://github.com/FiloSottile/Heartbleed
>>> https://www.ssllabs.com/ssltest/index.html
>>> (Note, this is a TLS in process bug, so more than HTTP/S services are
>>> affected...)
>>>
>>> This bug will no doubt trigger some thinking, analysis and change in
>>> the services,
>>> security, infrastructure and user communites... that's a good thing.
>>>
>> Thanks.  Adding one more heartbleed vulnerability site I tried:
>> http://rehmann.co/projects/heartbeat/?domain=
>>
>> It seemed to work (though tough to qualify results).  It came back
>> showing my bank was *still vulnerable* (not surprising).
>> So, made a payment over the phone instead of using their bill pay system
>> (this should probably be taken this seriously, but some won't).
>>
>> I checked a few other major sites at the rehmann link - it showed them
>> as OK.
>>
>> *"So you have to trust they did..."*
>>
>> When something like this comes along, you shouldn't ASS-U-ME anything,
>> or your ass may regret it. :)
>> Hard to imagine any reasonably large financial instit. NOT having a
>> prominent banner on all main pages,
>> "We have (have not) fixed the openSSL issue. Customers can (should not)
>> now do online banking." But not a peep.
>>
> UPDATE:  Users should not assume that by now, their bank / other HTTPS
> sites have patched the OpenSSL software.
> Use one of the check sites, to see if a domain / server is still
> vulnerable to heartbleed bug.
>
> As of late morning, 4/9/14, one of my banks (takes > 1 to hold all my $
> :D) still hasn't patched it.
>
> They have no warning on their site about it & apparently aren't
> restricting user login to access acct info or online bill pay.
>
> They're not cautioning users to be alert for suspicious activity in their
> acct.
>
> --
> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
> To unsubscribe or change other settings go to
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
>
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk