Skip to main content

Heartbleed in a Nutshell

By now you have probably heard about the security threat discovered recently that affects up to 2/3 of all websites that use secure login technology.

The news may seem alarming and confusing all at the same time. This is, in many ways, like the news of a major flu epidemic – you have to wonder, “have I been exposed? What is about to happen?” And similar to fighting invisible germs, you have no overtly obvious way of knowing if you’ve come in contact with a website that has been compromised by the Heartbleed vulnerability, or whether that contact will result in some sort of infection. This is an exposure where the symptoms may take a long time to come to light.
The vulnerability affects many sites that use an encrypted login – whether that is a financial site, a shopping site, or a site which asks for your personal information to be sent over the web in a form that is protected. If you pay attention to this sort of thing (and you should) you would know this by seeing the “https://…” in the address of the web site, and by the lock icon at the bottom of the browser page.
This includes a LOT of web pages you’ve visited, so chances are, you have indeed been exposed. Whether or not that results in a compromise of your personal information or finances is something you DO have control over. 
The best response to the Heartbleed vulnerability is similar to the best response to news of a flu epidemic: Prevention.
  •  We stave off the flu by getting a flu shot, limiting our exposure to sick people, washing our hands or using sanitizer, and staying informed.
  •  We stave off our exposure to internet vulnerabilities by using safe passwords, changing them often, avoiding risky sites, and staying informed.
Currently, the companies who are using a certain generation of security software (called SSL/TLS) know they have been affected, and they are cleaning up their sites (getting their flu shots, taking their medication, and going back to the doctor for a note saying they are healthy). Once they have cleaned up their sites, they are considered safe to interact with again. Some big sites are still under quarantine, and others have already been released with a clean bill of health. This process is taking time, but should be completed by sometime next week.
The problem is, knowing which sites are safe is a moving target – which is why changing your password before the site is healthy will not help you. Changing your passwords is a GREAT idea, and you should do this every six months, just as you should take precaution on an annual basis against the flu. Changing your passwords now, and then again next week, is the equivalent of getting your flu shot against the Heartbleed vulnerability.
To be relatively safe, change your passwords this weekend, then change them again on Wednesday or Thursday of next week.
Yes, it’s a pain.
Yes, it takes time.
But your safety is worth it, right?
~ Catherine Hillman

Comments

Post a Comment

Popular posts from this blog

How to welcome students to a class

If you're a Cal Poly professor, I have a gift for you. In the dashboard, you'll find the online workshop called "Launching a Course Online with Canvas" that has a template for welcoming students to an online course. The letter was written for "normal" times, and should be sent out approximately a week prior to the start of class, with a reminder sent out again the day before class starts. For the most part, it works well in our unusual circumstances. I want to share with you what I'm telling my students, and I'll include it below. This is a work in progress, but it will go out to them a full week prior to the start of class (by Tuesday, March 31.) I want them to have the gift of TIME: to look around the online class (I will open it up on Sunday, April 4th) to ask me questions via email if they have any to put important items on their calendar, like purchasing the code for our simulation software to absorb what they will be completing in the...
Post a Comment
Read more

Teaching in the age of Covid-19

I'm overwhelmed. I've been teaching online for 20 years, but the past three weeks of my life have been incredibly complex. Working from home is not a big deal for me - at my last job, I often worked from home and established work "zones" and a daily routine that helped me focus on what needed to be done, but this is different. This time, I've spent the past three weeks setting up and delivering workshops for faculty, answering numerous questions, calming a lot of jittery friends who are not sure how this is going to work, and - I kid you not - I was berated for posting a helpful comment on behalf of my own lengthy experience to a group of faculty. In times like these, you find out who people truly are. But here I am, staring at my computer screen with content that is mine, that I am familiar with, and there is nobody but myself urging me on. I am tired. I feel demoralized from events that took place in the days prior to sheltering at home. And I need a break...
Post a Comment
Read more

Putting the toothpaste back into the tube

We've been asked to teach a 10 week course in 9 weeks. For me, this should be a piece of cake - each summer, I condense a 9 week short course from Cuesta College into a 6 week short course for summer session. I have done this for nearly 10 summers, so one would think a week's worth of snipping would be simple. I spent a frustrating day alternating between my course content and various shiny distractions. It could well be that I need a break - certainly I'm feeling that lack of  focus that comes from stress - but it's also that I'm making incremental changes from one week to the next. This is not hard work like chopping firewood, but hard work like lining up dominoes and finding a gap halfway through that needs to be addressed by nudging every piece by exactly 1/4". It is tedious. Creating an online course is usually completed over three terms; one to create the online shell while teaching the course in person, one to launch the course online, and one to fix...
Post a Comment
Read more