reticent Says:

Does anyone know when this particular bug was discovered?

That’s too difficult to say, since that would require tracing security developer’s personal conversations. The important date is OpenSSL’s announcement, which is dated April 7, 2014. People had been moving to get OpenSSL itself fixed prior to that, but actually implementing the fix on all those services around the world would’ve started after the 7th.

If you were asked to change your password prior to the 7th, then that had to have been for some other reason. Until servers were patched, this bug opened the door to data leakage, so even if someone changed their passwords on the 6th, they’d need to change them again (yes, that’s a pain. I totally understand), even though it’s only been a few days.

Now, just because the bug existed doesn’t mean that a site was guaranteed to have been mined for information. Since this was a memory leak bug, it’s actually likely that malicious programmers ended up getting an awful lot of irrelevant noise before they dug up certificates, passwords, session keys, etc., but the reason everyone’s taking it so seriously is because it wouldn’t have left any trace of any data theft, so every site owner has to presume theft was possible.

Wait until a site says they’re “fixed” (“patched”, “updated”, whatever) before changing passwords. Changing your credential before a site is fixed is just risking it all over again.

Yeah, this is a pain. For us in the IT profession, it’s an even bigger one.

As some general advice, the things that can be used to link your information together is your birthday, don’t give your real birthday unless it’s absolutely necessary, such as credit cards or bank transfers.

Your social security. Your address. Your gender. The exact spelling of your full name.

The most treasure trove if someone breaks into your password is probably your email account, like someone digging through your mail for your bank account number.

Your email account has those various subscription and notices your online bank sends out, your so and so, and often has your account name on it. Once they figure out your accounts are linked, they can crack the password using brute force if the system doesn’t deny them log in attempts.

Open SSL or secured transmission is merely that HTTPS people see up top. So when people see it, they think it’s legit and not a fishing site. The bug thus makes it so that HTTPS sites are fishing sites, potentially, for your info.

A lot of email hackers are somehow from China, and probably doing it to send spam to your contacts for money. But some of them are from the US government (plea dealed hackers) or Democrat operatives like the ones that cracked Palin’s account.

Almost all the stuff people put on Facebook can be used to data mine their other contacts and background.

http://www.cnet.com/how-to/which-sites-have-patched-the-heartbleed-bug/

From the CNN link, it looks like it’s mostly social networking sites that are affected. That’s good for me, since I’m not involved with them. I do have a YouTube account which I have used for commenting (I don’t have my own YouTube page), but I haven’t used it in months since they started asking for my full name when I try to log in. There’s an excellent chance I’ll never use it again. So I don’t know whether I need to change my password.

I tried to log in a few minutes ago and got a Google login page. I closed the tab instead.

My bank isn’t listed, but it’s a regional bank and I’m sure the list isn’t exhaustive. They haven’t contacted me about this.

Also, I don’t trust CNN to report the “news” accurately, so I don’t know how much I should trust their list.

I wonder whether blogs are also affected. I haven’t heard anything about that.

I know about this given that some companies that deal in encrypted internet mail accounts refused to hand over their keys and thus ended up dismantled.

Google, YouTube and Gmail
Facebook
Yahoo, Yahoo Mail, Tumblr, Flickr
OKCupid
Wikipedia

Google is in the pocket with the Left, they were seen liaisoning with the Regime on several key factors.

FB gave people a mirror copy of their servers, and their server pics are mirrored in INdia anyways.

Yahoo is quieter than Google, but trying to emulate Google.

OkCupid…. yea, we know where that one goes.